An information security risk assessment system based on the Internet of Things

Abstract

The present invention relates to an information security risk assessment system based on the Internet of Things, the system comprising: a data acquisition module determines habit data based on historical behavior data; a behavior deviation determination module acquires current behavior data based on login account behavior, and determines behavior deviation according to current behavior data and habit data; a behavior correction module determines whether to trigger a behavior correction instruction according to the behavior deviation, and obtains response information; a deviation correction module determines a target correction value according to the response information, and corrects the behavior deviation based on the target correction value to obtain a corrected deviation; a risk assessment determination module determines an account prediction risk level based on the corrected deviation, and determines whether to generate a deep risk assessment instruction based on the account risk level. The present invention achieves the goal of avoiding users from triggering deep assessment by clicking by mistake, and can also timely discover whether others have maliciously logged into the account and conduct deep assessment, thereby ensuring information security and avoiding resource waste.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to an information security risk assessment system based on the Internet of Things. Background Art

[0002] The widespread application of information technology has greatly increased information security risks while improving scientific research and production efficiency and quality. At present, the commonly used method to solve information security problems is risk assessment. From the perspective of risk management, it systematically analyzes the threats faced by information systems and their existing vulnerabilities, assesses the degree of harm that may be caused once a security incident occurs, and proposes targeted protection countermeasures and rectification measures to control risks at an acceptable level and maximize information security. The existing information security risk assessment system includes regular assessment and non-regular assessment. At present, most non-regular assessments also have certain triggering limitations, and their assessment depth is usually fixed, resulting in a certain waste of resources. Summary of the invention

[0003] In view of the above-mentioned problems, the present invention proposes an information security risk assessment system based on the Internet of Things.

[0004] To achieve the above object, the present invention provides the following technical solutions:

[0005] An information security risk assessment system based on the Internet of Things, the system comprising:

[0006] A data acquisition module, used to acquire historical behavior data of system users and determine habit data based on the historical behavior data;

[0007] A behavior deviation determination module, used to obtain current behavior data based on the login account behavior, and determine the behavior deviation according to the current behavior data and habit data;

[0008] A behavior correction module, used to determine whether to initiate a behavior correction instruction according to the behavior deviation, and obtain response information;

[0009] A deviation correction module, used for determining a target correction value according to the response information, and correcting the behavior deviation based on the target correction value to obtain a corrected deviation;

[0010] The risk assessment determination module is used to determine the predicted risk level of the account based on the corrected deviation, and to determine whether to generate a deep risk assessment instruction based on the account risk level.

[0011] As a further technical solution of the present invention, the behavior deviation determination module includes:

[0012] A current data copying unit, used to obtain current behavior data based on the login account behavior, copy the current behavior data, and obtain a set to be checked;

[0013] A data traversal unit, used for reading data from the habit data in sequence, and traversing the set to be inspected according to the read data;

[0014] A data matching unit, used for deleting the corresponding data item in the to-be-checked set when the match is successful;

[0015] a cutoff signal generating unit, configured to generate a cutoff signal when each data in the habit data is read;

[0016] A data statistics unit, used to count the remaining data items in the to-be-checked set and the total number of data items in the current behavior data;

[0017] The deviation calculation unit is used to determine the behavior deviation according to the remaining data items and the total number of data items, where the behavior deviation = the number of remaining data items / the total number of data items in the current behavior data.

[0018] As a further technical solution of the present invention, the behavior correction module includes:

[0019] A behavior correction trigger unit, used for comparing the behavior deviation with a preset deviation, and triggering a behavior correction instruction when the behavior deviation exceeds the preset deviation;

[0020] A deviation degree acquisition unit, used to acquire a final behavior deviation degree calculated from several previous account login behaviors, wherein the final behavior deviation degree is the highest behavior deviation degree generated by each account login;

[0021] A target behavior selection unit, used to select a target login account behavior based on a number of final behavior deviations;

[0022] A jump resource determination unit, used to obtain the final access resource in the behavior data generated by the target login account behavior as a target jump resource;

[0023] A jump instruction generating unit, used to generate a page jump instruction so that the current page jumps to a target jump resource page;

[0024] The response information acquisition unit is used to acquire the execution operation of the current user on the target jump resource page as response information.

[0025] As a further technical solution of the present invention, the content of selecting the target login account behavior based on a number of final behavior deviations includes:

[0026] Selecting the final behavior deviation closest to the current moment and not exceeding the preset deviation from the multiple final behavior deviations as the target behavior deviation;

[0027] The login account behavior corresponding to the target behavior deviation is determined as the target login account behavior.

[0028] As a further technical solution of the present invention, the deviation correction module includes:

[0029] An accuracy determination unit, configured to determine the accuracy of the response information based on a preset response rule;

[0030] A correction value matching unit, used for comparing the accuracy with a preset accuracy correction table, and matching to obtain a target correction value;

[0031] The deviation correction unit is used to calculate the corrected deviation according to the target correction value and the behavior deviation, where the corrected deviation = target correction value * behavior deviation.

[0032] As a further technical solution of the present invention, the risk assessment and determination module includes:

[0033] A risk level determination unit, used to determine the predicted risk level of the account according to the corrected deviation and a preset risk level prediction rule;

[0034] A first determination unit is used to compare the predicted risk level of the account with a preset risk level threshold, and when the predicted risk level of the account does not exceed the preset risk level threshold, only generate an account security prompt instruction;

[0035] A second determination unit is configured to match a corresponding target risk assessment depth based on the predicted account risk level while generating an account security prompt instruction when the predicted account risk level exceeds a preset risk level threshold;

[0036] The assessment project determination unit is used to determine the risk assessment project according to the target risk assessment depth, and the account predicted risk level and the target risk assessment depth are positively correlated.

[0037] As a further technical solution of the present invention, the historical behavior data includes login location, login device, accessed resources and executed operations, and the habit data includes frequently used login locations, frequently used login devices, frequently used accessed resources and daily operations.

[0038] Compared with the prior art, the beneficial effects of the present invention are as follows: the present invention can determine the behavior deviation according to the current behavior data and habit data, and compare the behavior deviation with the preset deviation, so as to preliminarily judge whether the current login behavior is abnormal, and thus decide whether to trigger the behavior correction instruction, and can obtain the target correction value according to the behavior correction instruction, and implement the correction of the behavior deviation based on the target correction value to obtain the corrected deviation, and finally determine whether to conduct a deep risk assessment according to the corrected deviation, thereby avoiding the triggering of a deep assessment due to user's late clicks, and also, to a certain extent, can timely discover whether someone else has maliciously logged into the account and conduct a deep assessment, thereby ensuring information security and avoiding waste of resources. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 This is a structural block diagram of an information security risk assessment system based on the Internet of Things.

[0040] Figure 2 This is a structural block diagram of a behavior deviation determination module in an information security risk assessment system based on the Internet of Things.

[0041] Figure 3 This is a structural block diagram of a behavior correction module in an information security risk assessment system based on the Internet of Things.

[0042] Figure 4 This is a structural block diagram of a deviation correction module in an information security risk assessment system based on the Internet of Things.

[0043] Figure 5 This is a structural block diagram of a risk assessment and determination module in an information security risk assessment system based on the Internet of Things. DETAILED DESCRIPTION

[0044] The technical solution of this patent is further described in detail below in conjunction with specific implementation methods.

[0045] like Figure 1 As shown, an embodiment of the present invention provides an information security risk assessment system based on the Internet of Things, the system comprising:

[0046] The data acquisition module 100 is used to obtain the historical behavior data of the system users and determine the habit data based on the historical behavior data. The historical behavior data includes the login location, login device, access resources and execution operations. The habit data includes the commonly used login location, commonly used login device, commonly used access resources and daily operations. The types of daily operations include resource browsing mode, downloading, modification, deletion, etc. The commonly used access resources can be commonly used documents, commonly used URLs, etc.

[0047] The method of determining habit data based on historical behavior data can be: Frequently used login locations: set a threshold, and locations exceeding the threshold are considered frequently used login locations. Frequently used login devices: count the types and frequency of devices used by users, and the device types that are frequently used exceeding the set threshold are frequently used login devices. Frequently accessed resources: analyze the types and frequency of resources accessed by users, and those that exceed the preset access frequency threshold are frequently accessed resources. Daily operations: Resource browsing mode: determine the user's browsing mode by analyzing the user's browsing path and dwell time, such as deep browsing, shallow browsing, or specific path browsing. Download, modify, and delete operations: count the frequency and objects of users performing these operations to identify the user's operating habits.

[0048] The behavior deviation determination module 200 is used to obtain current behavior data based on the login account behavior when receiving the login signal, and determine the behavior deviation based on the current behavior data and habit data until the login is logged out;

[0049] A behavior correction module 300, used to determine whether to initiate a behavior correction instruction according to the behavior deviation, and obtain response information;

[0050] The deviation correction module 400 is used to determine a target correction value according to the response information, and correct the behavior deviation based on the target correction value to obtain a corrected deviation;

[0051] The risk assessment determination module 500 is used to determine the predicted risk level of the account based on the corrected deviation, and determine whether to generate a deep risk assessment instruction based on the account risk level.

[0052] In this embodiment, in order to ensure information security, the historical behavior data of the system user is obtained, and the habit data is determined based on the historical behavior data. The habit data here refers to the common data of the current user. The behavior deviation can be determined based on the current behavior data and the habit data, and the behavior deviation and the preset deviation are compared to preliminarily determine whether the current login behavior is abnormal, so as to decide whether to trigger the behavior correction instruction. According to the behavior correction instruction, the target correction value can be obtained, and the behavior deviation is corrected based on the target correction value to obtain the deviation after correction. Finally, it is determined whether to perform a deep risk assessment based on the deviation after correction, thereby avoiding the user's late click and triggering the deep assessment. To a certain extent, it can timely discover whether someone else has maliciously logged into the account and conduct a deep assessment, ensuring information security while avoiding resource waste.

[0053] like Figure 2 As shown, as a preferred embodiment of the present invention, the behavior deviation determination module 200 includes:

[0054] The current data copying unit 201 is used to obtain the current behavior data based on the login account behavior, and copy the current behavior data to obtain a set to be checked;

[0055] A data traversal unit 202, used to read data from the habit data in sequence, and traverse the to-be-checked set according to the read data;

[0056] A data matching unit 203, configured to delete the corresponding data item in the to-be-checked set when the match is successful;

[0057] A cut-off signal generating unit 204, configured to generate a cut-off signal when each data in the habit data is read;

[0058] A data statistics unit 205 is used to count the remaining data items in the to-be-checked set and the total number of data items in the current behavior data;

[0059] The deviation calculation unit 206 is used to determine the behavior deviation according to the remaining data items and the total number of data items, where behavior deviation = the number of remaining data items / the total number of data items in the current behavior data.

[0060] In this embodiment, the behavior deviation determination module can monitor the current behavior data in real time, and can determine the behavior deviation generated by the current login account behavior according to the current behavior data and habit data.

[0061] like Figure 3 As shown, as a preferred embodiment of the present invention, the behavior correction module 300 includes:

[0062] The behavior correction trigger unit 301 is used to compare the behavior deviation with the preset deviation, and when the behavior deviation exceeds the preset deviation, trigger the behavior correction instruction; when the behavior deviation does not exceed the preset deviation, the behavior correction instruction is not triggered;

[0063] The deviation acquisition unit 302 is used to acquire the final behavior deviation calculated from the previous login account behaviors, where the final behavior deviation is the highest behavior deviation generated by each login account;

[0064] A target behavior selection unit 303, configured to select a target login account behavior based on a number of final behavior deviations;

[0065] The jump resource determination unit 304 is used to obtain the final access resource in the behavior data generated by the target login account behavior as the target jump resource, wherein the final access resource can be the resource last accessed before logging out, or the access resource with the most access times in the behavior data generated by the target login account behavior;

[0066] The jump instruction generating unit 305 is used to generate a page jump instruction so that the current page jumps to the target jump resource page;

[0067] The response information acquisition unit 306 is used to acquire the execution operation of the current user on the target jump resource page as response information.

[0068] In this embodiment, when the behavior deviation exceeds the preset deviation, a behavior correction instruction is triggered, and the behavior correction instruction specifically refers to: determining a target jump resource, making the current page jump to the target jump resource page, and then obtaining response information.

[0069] In the present invention, the content of selecting the target login account behavior based on a number of final behavior deviations includes:

[0070] Selecting the final behavior deviation closest to the current moment and not exceeding the preset deviation from the multiple final behavior deviations as the target behavior deviation;

[0071] The login account behavior corresponding to the target behavior deviation is determined as the target login account behavior.

[0072] like Figure 4 As shown, as a preferred embodiment of the present invention, the deviation correction module 400 includes:

[0073] An accuracy determination unit 401, configured to determine the accuracy of the response information based on a preset response rule, wherein the preset response rule is generated based on the user's habit data;

[0074] A correction value matching unit 402, used to compare the accuracy with a preset accuracy correction table to obtain a target correction value;

[0075] The preset accuracy correction table includes several accuracy and correction values ​​set in pairs; when the accuracy exceeds a first preset accuracy threshold, the behavior deviation can be reduced based on the target correction value; when the accuracy is between the first preset accuracy threshold and the second preset accuracy threshold, the behavior deviation is kept unchanged based on the target correction value; when the accuracy exceeds the second preset accuracy threshold, the behavior deviation is increased based on the target correction value.

[0076] The deviation correction unit 403 is used to calculate the corrected deviation according to the target correction value and the behavior deviation, where the corrected deviation = target correction value * behavior deviation;

[0077] In this embodiment, after the behavior correction instruction is triggered, the response information is obtained, and the accuracy of the response information is determined based on the preset response rules, wherein the preset response rules are generated based on the user's habit data, and the accuracy refers to whether the execution operation information in the response information belongs to the daily operation information in the habit data. After the accuracy is determined, the target correction value is matched based on the preset conditions, and finally the deviation after correction = target correction value * behavior deviation. The target correction value can be used to correct and regulate the behavior deviation, avoiding the user's own delay and triggering a deep assessment. To a certain extent, it can also timely discover whether someone else has maliciously logged into the account and conduct a deep assessment, ensuring information security while avoiding waste of resources.

[0078] like Figure 5 As shown, as a preferred embodiment of the present invention, the risk assessment and determination module 500 includes:

[0079] A risk level determination unit 501 is used to determine the predicted risk level of the account according to the corrected deviation and a preset risk level prediction rule;

[0080] The corrected deviation is positively correlated with the predicted risk level of the account. The value of the predicted risk level of the account can be determined by a linear function, or a risk level matching table can be determined by a preset risk level prediction rule. The risk level matching table includes a number of deviation values ​​and risk levels set in pairs. The predicted risk level of the account is obtained by matching the corrected deviation with the risk level matching table.

[0081] The first determination unit 502 is used to compare the predicted risk level of the account with a preset risk level threshold, and when the predicted risk level of the account does not exceed the preset risk level threshold, only generate an account security prompt instruction;

[0082] The second determination unit 503 is configured to match the corresponding target risk assessment depth based on the predicted account risk level while generating an account security prompt instruction when the predicted account risk level exceeds a preset risk level threshold;

[0083] The assessment project determination unit 504 is used to determine the risk assessment projects according to the target risk assessment depth. The account prediction risk level and the target risk assessment depth are positively correlated. The higher the account prediction risk level, the deeper the matching target risk assessment depth, and the more corresponding risk assessment projects. The risk assessment projects include detailed permission and access control analysis, password policy and management depth analysis, account activity and log depth analysis, vulnerability and threat depth detection, compliance and security policy depth review, technology and architecture depth analysis and user behavior and intention analysis.

[0084] In this embodiment, the account prediction risk level is determined according to the corrected deviation and the preset risk level prediction rules. When the account prediction risk level exceeds the preset risk level threshold, while generating the account security prompt instruction, the corresponding target risk assessment depth is matched based on the account prediction risk level. The account prediction risk level and the target risk assessment depth are positively correlated. The higher the account prediction risk level, the deeper the target risk assessment depth is matched, and the more risk assessment items it corresponds to. The assessment depth is flexibly adjusted according to the deviation, avoiding resource waste.

[0085] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0086] The above are only preferred embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. An information security risk assessment system based on the Internet of Things, characterized in that: The system comprises: A data acquisition module, used to acquire historical behavior data of system users and determine habit data based on the historical behavior data; A behavior deviation determination module, used to obtain current behavior data based on the login account behavior, and determine the behavior deviation according to the current behavior data and habit data; A behavior correction module, used to determine whether to initiate a behavior correction instruction according to the behavior deviation, and obtain response information; A deviation correction module, used for determining a target correction value according to the response information, and correcting the behavior deviation based on the target correction value to obtain a corrected deviation; A risk assessment determination module, used to determine the predicted risk level of the account based on the corrected deviation, and determine whether to generate a deep risk assessment instruction based on the account risk level; The behavior deviation determination module comprises: A current data copying unit, used to obtain current behavior data based on the login account behavior, copy the current behavior data, and obtain a set to be checked; A data traversal unit, used for reading data from the habit data in sequence, and traversing the set to be inspected according to the read data; A data matching unit, used for deleting the corresponding data item in the to-be-checked set when the match is successful; a cutoff signal generating unit, configured to generate a cutoff signal when each data in the habit data is read; A data statistics unit, used to count the remaining data items in the to-be-checked set and the total number of data items in the current behavior data; A deviation calculation unit, used to determine the behavior deviation according to the remaining data items and the total number of data items, where the behavior deviation = the number of remaining data items / the total number of data items in the current behavior data; The deviation correction module comprises: An accuracy determination unit, configured to determine the accuracy of the response information based on a preset response rule; A correction value matching unit, used for comparing the accuracy with a preset accuracy correction table, and matching to obtain a target correction value; The deviation correction unit is used to calculate the corrected deviation according to the target correction value and the behavior deviation, where the corrected deviation = target correction value * behavior deviation.

2. According to claim 1, an information security risk assessment system based on the Internet of Things is characterized in that: The behavior correction module comprises: A behavior correction trigger unit, used for comparing the behavior deviation with a preset deviation, and triggering a behavior correction instruction when the behavior deviation exceeds the preset deviation; A deviation degree acquisition unit, used to acquire a final behavior deviation degree calculated from several previous account login behaviors, wherein the final behavior deviation degree is the highest behavior deviation degree generated by each account login; A target behavior selection unit, used to select a target login account behavior based on a number of final behavior deviations; A jump resource determination unit, used to obtain the final access resource in the behavior data generated by the target login account behavior as a target jump resource; A jump instruction generating unit, used to generate a page jump instruction so that the current page jumps to a target jump resource page; The response information acquisition unit is used to acquire the execution operation of the current user on the target jump resource page as response information.

3. According to claim 2, an information security risk assessment system based on the Internet of Things is characterized in that: The content of selecting the target login account behavior based on a number of final behavior deviations includes: Selecting the final behavior deviation closest to the current moment and not exceeding the preset deviation from the multiple final behavior deviations as the target behavior deviation; The login account behavior corresponding to the target behavior deviation is determined as the target login account behavior.

4. According to the information security risk assessment system based on the Internet of Things in claim 1, it is characterized in that: The risk assessment and determination module comprises: A risk level determination unit, used to determine the predicted risk level of the account according to the corrected deviation and a preset risk level prediction rule; A first determination unit is used to compare the predicted risk level of the account with a preset risk level threshold, and when the predicted risk level of the account does not exceed the preset risk level threshold, only generate an account security prompt instruction; A second determination unit is configured to match a corresponding target risk assessment depth based on the predicted account risk level while generating an account security prompt instruction when the predicted account risk level exceeds a preset risk level threshold; The assessment project determination unit is used to determine the risk assessment project according to the target risk assessment depth, and the account predicted risk level and the target risk assessment depth are positively correlated.

5. According to the information security risk assessment system based on the Internet of Things in claim 1, it is characterized in that: The historical behavior data includes login locations, login devices, accessed resources and executed operations, and the habit data includes frequently used login locations, frequently used login devices, frequently used accessed resources and daily operations.

Images