Confidential evaluation methods, systems, equipment, storage media and products

Abstract

The present application discloses a method, system, device, storage medium and product for evaluating cryptographic reviews, which are applied to a SAAS platform. The method comprises: obtaining the primary encryption features of an encryption algorithm in an application by reverse engineering to form a training feature library; inputting the application into a pre-trained parsing model to obtain first encryption algorithm type information, wherein the parsing model is generated based on the training feature library and a preset algorithm; obtaining traffic data, and inputting the traffic data into a pre-trained hybrid model to obtain traffic data type information and second encryption algorithm type information; generating cryptographic standard indicator data based on the cryptographic review standard and preset evaluation rules; judging whether the first encryption algorithm type and the second encryption algorithm type match the standard indicator data, thereby determining the indicator level of the traffic data and / or the application, wherein the judging operation method is simple and the indicator level judgment is reliable.

Description

Technical Field

[0001] The present application generally relates to the field of network security technology, and specifically to a confidentiality evaluation method, system, device, storage medium and product. Background Art

[0002] With the implementation of the basic requirements of information security technology network security level protection, cryptographic technology will be applied in more places, and domestic cryptographic algorithms will have a larger application space. At the same time, with the implementation of cryptographic standard requirements, the standardization and normalization of the application of cryptographic algorithms are proposed, which requires us to have corresponding detection methods to determine the compliance, correctness and integrity of cryptographic algorithms. The application of cryptographic algorithms is very extensive, so there is a great demand for cryptographic reviews or pre-evaluations before cryptographic reviews.

[0003] Existing evaluation methods usually use white box methods or packet capture methods. These two methods have the problems of complex and cumbersome operations, low reliability, and put forward higher requirements for reviewers. Summary of the invention

[0004] In view of the above-mentioned defects or deficiencies in the prior art, it is desirable to provide a secret review evaluation method, system, device, storage medium and product.

[0005] On the one hand, it provides a method for evaluating the secret review, including:

[0006] The primary encryption features of the encryption algorithm in the application are obtained by reverse engineering to form a training feature library;

[0007] Inputting the application into a parsing model to obtain first encryption algorithm type information, wherein the parsing model is generated based on a training feature library and a preset algorithm;

[0008] Acquire traffic data, and input the traffic data into a pre-trained hybrid model to obtain traffic data type information and second encryption algorithm type information;

[0009] Generate password standard indicator data based on password evaluation standards and preset evaluation rules;

[0010] Determine whether the first encryption algorithm type and the second encryption algorithm type match the standard indicator data, thereby determining the indicator level of the traffic data and / or the application.

[0011] Preferably, the method of acquiring traffic data and inputting the traffic data into a pre-trained hybrid model to obtain traffic data type information and second encryption algorithm type information further includes:

[0012] The hybrid model includes a clustering model and a traffic identification model.

[0013] Further, traffic data is obtained, and the traffic data is input into a pre-trained hybrid model to obtain traffic data type information and second encryption algorithm type information, further comprising:

[0014] Inputting the traffic data into the pre-trained clustering model to obtain traffic data type information;

[0015] The traffic data is input into the pre-trained traffic identification model to obtain the second encryption algorithm type information.

[0016] Preferably, generating password standard indicator data based on password evaluation standards and preset evaluation rules also includes:

[0017] Generate encryption algorithm indicators required for level 4 encryption applications based on encryption evaluation standards and preset evaluation rules;

[0018] An indicator level is generated based on the algorithm indicator, and standard indicator data is generated based on the indicator level.

[0019] In a second aspect, the present application provides a secret review evaluation system, comprising:

[0020] An application algorithm acquisition module is used to obtain encryption characteristics of encryption algorithms in applications;

[0021] A feature library generation module is used to construct a training feature library by reversely acquiring primary encryption features of the encryption algorithm in the application program;

[0022] A first acquisition module, used to input the application into a parsing model to obtain first encryption algorithm type information, wherein the parsing model is generated based on a training feature library and a preset algorithm;

[0023] A second acquisition module is used to acquire traffic data, and input the traffic data into a pre-trained hybrid model to obtain traffic data type information and second encryption algorithm type information;

[0024] A standard indicator data generation module is used to generate password standard indicator data based on password evaluation standards and preset evaluation rules;

[0025] The control module is used to determine whether the first encryption algorithm type and the second encryption algorithm type match the standard indicator data, so as to determine the indicator level of the traffic data and / or the application.

[0026] In a third aspect, the present application provides an electronic device comprising a processor and a memory, wherein the memory stores at least one instruction, at least one program, a code set or an instruction set, and the instruction, the program, the code set or the instruction set is loaded and executed by the processor to implement the above-mentioned secret review evaluation method.

[0027] In a fourth aspect, the present application provides a non-temporary computer-readable storage medium, which, when the instructions in the storage medium are executed by a processor of a mobile terminal, enables the mobile terminal to execute the above-mentioned secret review evaluation method.

[0028] On the other hand, the present application provides a computer program product. When instructions in the computer program product are executed by a processor of a mobile terminal, the mobile terminal is enabled to execute the above-mentioned secret review evaluation method.

[0029] Additional aspects and advantages of the present invention will be given in part in the following description and in part will be obvious from the following description, or will be learned through practice of the present invention.

[0030] The technical solution provided by the embodiments of the present disclosure may include the following beneficial effects: the present application obtains the first encryption algorithm type information through an analytical model, obtains the traffic data type information and the second encryption algorithm type information through a hybrid model, and then determines the indicator level of the traffic data and / or application through the information. The discrimination operation method is simple and the indicator level judgment is reliable.

[0031] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Other features, objects and advantages of the present application will become more apparent by reading the detailed description of non-limiting embodiments made with reference to the following drawings:

[0033] Figure 1 A flowchart of a method for evaluating a critical review provided in an embodiment of the present application;

[0034] Figure 2 A block diagram of a secret review evaluation system provided for an embodiment of the present application;

[0035] Figure 3 An internal structure diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0036] The present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the relevant invention, rather than to limit the invention. It is also necessary to explain that, for ease of description, only the parts related to the invention are shown in the accompanying drawings.

[0037] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0038] This solution can be applied in the field of network security evaluation to determine the indicator level of application programs and traffic data.

[0039] The evaluation of information system cryptographic application is divided into general evaluation and cryptographic application evaluation. Among them, the general evaluation includes "cryptographic algorithm and cryptographic technology compliance" and "key management security" evaluation, and the cryptographic application evaluation includes four technical levels: physical and environmental security of information systems, network and communication security, equipment and computing security, and application and data security.

[0040] Existing evaluation methods usually use white-box methods, that is, by querying source code or question-and-answer methods, which seem simple to operate, but are actually very complex and sometimes unreliable. Or they evaluate by capturing packets, which places great demands on reviewers and is also very cumbersome.

[0041] Please see Figure 1 The present application provides a method for evaluating a secret review, which is applied to a SAAS platform and includes:

[0042] S101, constructing a training feature library by reversely acquiring the primary encryption features of the encryption algorithm in the application.

[0043] Specifically, each encryption algorithm in the application is initially reverse analyzed, and each encryption algorithm is transformed into an encryption feature. The encryption feature is as follows: y i ∈N,y i The encryption algorithm name and N are matched through Table 1.

[0044] Table 1

[0045]

[0046]

[0047] S102, inputting the application into a pre-trained parsing model to obtain first encryption algorithm type information, wherein the parsing model is generated based on a training feature library and a preset algorithm.

[0048] Specifically, the application is input into a pre-trained parsing model, which is generated by training feature libraries and preset algorithms, namely, a naive Bayesian generative model. Before the parsing model is used, training data needs to be input into the parsing model. The training data D is D = {(x1, y1), (x2, y2), …, (x N ,y N )},in middle, is the jth feature of the i-th sample. yi ∈{c1,c2,…,c k Thus, the encryption algorithm classification of the binary application to be tested, that is, the first encryption algorithm type information is output.

[0049] The model calculates prior probabilities and conditional probabilities

[0050]

[0051]

[0052] j=1,2,…,nl=1,2,…,sk=1,2,…,K

[0053] In the above formula, P(Y=c k ) indicates that the label value is equal to c k The probability of N is the number of samples in the population, I(y i =c k ) indicates whether the label value of the i-th sample is equal to c k , if equal, its value is 1, if not equal, its value is 0.

[0054] In the above formula Indicates that among N samples, the label value is equal to c k K represents the number of categories for prediction recognition (or label value), and λ is greater than or equal to 0, usually 1, indicating Laplace smoothing.

[0055] In the above formula, P(X j =a jl |Y=c k ) means if x i The jth feature is equal to a jl , and its label value is equal to c k , then it is 1, otherwise it is 0.

[0056] This is the origin of the Naive Bayesian generative model. At this stage, the probability of each category (label value) is generated, and the probability of each feature is also generated (this probability actually corresponds to what we often call weights).

[0057] Then for a given instance x=(x 1 ,x 2 ,…,x n ) Determine which encryption algorithm class the instance belongs to in the following way, i.e., the first encryption algorithm type information.

[0058]

[0059] Naive Bayes makes a conditional independence assumption for conditional probability distribution, which means that each feature is independent of each other.

[0060] For example, each sample is composed of n features, and the feature probability (or weight) of each feature belonging to a certain class is generated by the "calculation of prior probability and conditional probability" calculation formula. Because of the assumption of conditional independence, the probability of these n features is multiplied by the probability of each class to get the possible value of a sample belonging to a certain class, and then c k class, you will get c k possible values, and the sizes of these possible values ​​are compared. The largest one is the most likely category. In other embodiments, the logarithm of the feature probability is used to generate the possible values.

[0061] Thus, the naive Bayes model, that is, the construction of the analytical model is completed through the above method, so that the model can determine the first encryption algorithm type information.

[0062] S103, acquiring traffic data, and inputting the traffic data into a pre-trained hybrid model to obtain traffic data type information and second encryption algorithm type information.

[0063] Specifically, the hybrid model can be used to accurately locate and recognize the traffic data, thereby specifically identifying the information of the traffic data, and ultimately predicting which encryption algorithm type the current traffic data belongs to.

[0064] In some embodiments, obtaining traffic data, inputting the traffic data into a pre-trained hybrid model to obtain traffic data type information and second encryption algorithm type information, further includes:

[0065] The hybrid model includes a clustering model and a traffic identification model.

[0066] Specifically, the hybrid model consists of a clustering model and a traffic identification model.

[0067] In some embodiments, obtaining traffic data, inputting the traffic data into a pre-trained hybrid model to obtain traffic data type information and second encryption algorithm type information, further includes:

[0068] Inputting the traffic data into the pre-trained clustering model to obtain traffic data type information;

[0069] The traffic data is input into the pre-trained traffic identification model to obtain the second encryption algorithm type information.

[0070] Specifically, the clustering model adopts a modified K-means clustering algorithm, and the algorithm is shown in the following formula:

[0071]

[0072]

[0073] The above formula is used to optimize C * .

[0074] To determine the K value, we use the enumeration method to determine the best K value by comparing the overall loss value.

[0075] The clustering algorithm process is as follows:

[0076] First, perform initialization operation, k = 0, t = 0, C * =inf Select the farthest k points as the initial cluster centers.

[0077] Secondly, cluster the samples. Calculate the Euclidean distance from each sample to the class center and assign each sample to the class closest to it.

[0078] Then, calculate the new class center. Calculate the mean of the samples of the new class as the new class center

[0079] Then, if the iteration converges or meets the stopping condition, compare C * , C (t) , if C * >C (t) , then C * =C (t) , k=k+1; if C * <=C (t) , then k=k+1.

[0080] Finally, if K meets certain conditions, output C * , if K does not meet the output condition, continue to cluster the samples.

[0081] For example, extract the source IP, destination IP, time, source port, destination port, packet length, protocol, and PAYLOAD segmented by self-encoding from the traffic data to form the traffic tuple dimension, and then construct the corresponding data into input:

[0082]

[0083] Then, the traffic data is clustered and learned according to the above clustering algorithm process to obtain traffic data type information.

[0084] The traffic recognition model is identified through neural network.

[0085] For example, first, enter the following:

[0086]

[0087] where x1, x2, …, x n ∈N,n each encryption algorithm x i The maximum number of flow characteristic factors. The corresponding input less than the maximum number is 0.

[0088]

[0089]

[0090]

[0091] Thus, the weights of each input layer, hidden layer and hidden layer are output.

[0092] The flow identification model algorithm flow is as follows:

[0093] First, initialize the weights, activation functions, and loss functions:

[0094] The weight is W [l] (l∈[1,n]);

[0095] The activation function is f(x)=Relu(x);

[0096] The loss function is MSELoss or cross entropy function.

[0097] Next, set the epoch and select a batch of data. Epoch represents the number of times training can be repeated, which can be set to a specific number such as 40,000 or infinity. Batch represents the data taken at one time, which is set to 512. The input value is X, and the label value (true value) is y′.

[0098] Then, the forward calculation based on the residual

[0099] Z [l] =W (l) X+B (l)

[0100] y l =A [l] =f(Z [l] )+A [l-2]

[0101] Among them, W (l) is the weight of layer l, X is the input, B (l) is the bias, Z [l] is the result of linear calculation, A [l] To activate the output, it means to change the previously calculated Z [l] After the activation function RELU is transformed into a nonlinear function, A [l-2]Used to prevent gradient vanishing and exploding in multi-layer training.

[0102] Then, reverse error propagation is performed, for the Lth layer:

[0103] If the output layer

[0104] Z [l] =A [l] -y'

[0105] but

[0106] Z [l] =A [l-1] *f'(Z [l] )

[0107]

[0108]

[0109]

[0110] For the output layer, because the loss function we use in actual use is MSE, the gradient of the output after the loss function is actually A [l] -y', y' represents the true value or label value. For non-output layers, its gradient is expressed as A [l-1] *f'(Z [l] ) is used to represent, where f'(Z [l] ) represents Z [l] The activation function is used to calculate the derivative. Then dW is calculated [l] , dW [l] Represents the gradient of the weight, that is, the direction of change. dW [l] The gradient is calculated using the dZ calculated above [l] With A [l-1] In the specific implementation process, in order to improve the training efficiency, it is usually trained in batches at a time, so it needs to be divided by N for conversion, where N represents batch. In this embodiment, N is set to 512, and there is usually no limit on the setting of N. Then calculate dB [l] , dB [l] Represents the gradient of the bias, which is calculated by taking Z [l] Sum by row, this is the meaning of sum, then dW [l] Then divide by N, where N represents batch. In this embodiment, N is set to 512, and there is usually no limit on the setting of N. Thus, the above method is used to calculate the gradient of the weight W and the bias B of each layer.

[0111] Then, adjust the weights.

[0112] W [i] =W[i] -ηdW [i]

[0113] B [i] =B [i] -ηdB [i]

[0114] This step is used to adjust the gradient direction with a set step size, where η is the step size. During the training process of this application, η is set to 0.001, and there is no restriction on the value of η.

[0115] After each training, the weights and biases are adjusted. Here is an example: for each layer such as W [i] , put W [i] Subtract the step size η multiplied by the direction dW of the gradient change of this layer [i] The bias is also adjusted in this way.

[0116] Finally, determine whether the error meets the requirements. If the error does not meet the requirements, reset the epoch and select a batch of data for training; if the error meets the requirements, output the weights of each layer.

[0117] The traffic characteristics are then input into the neural network for training and learning of the weight parameters of each layer, ultimately predicting the second encryption algorithm type information of the current traffic data.

[0118] S104, generating cryptographic standard indicator data based on cryptographic evaluation standards and preset evaluation rules.

[0119] Specifically, the password standard indicator data generated based on the password evaluation standards and preset evaluation rules can better reflect the password characteristics.

[0120] In some embodiments, generating password standard indicator data based on password evaluation criteria and preset evaluation rules also includes:

[0121] Generate encryption algorithm indicators required for level 4 encryption applications based on encryption evaluation standards and preset evaluation rules;

[0122] An indicator level is generated based on the algorithm indicator, and standard indicator data is generated based on the indicator level.

[0123] Specifically, according to the relevant standards and evaluation rules of the encryption evaluation, each encryption algorithm is constituted into the algorithm index required by the four-level encryption application, and the algorithm index level of each encryption algorithm is determined, and the standard index data is generated based on the algorithm index level, thereby forming a password standard index library, and the four-level encryption has a higher confidentiality level. Therefore, the standard index data is determined based on the four-level encryption requirement indicators.

[0124] S105, determining whether the first encryption algorithm type and the second encryption algorithm type match the standard indicator data, thereby determining the indicator level of the traffic data and / or the application.

[0125] Specifically, the first encryption algorithm type and the second encryption algorithm type identified based on the analytical model and the hybrid model are matched with the cryptographic standard indicator data to obtain the level of a certain indicator of the application or traffic evaluation. The user can then decide whether to make corrections based on the level of the indicator.

[0126] The SAAS platform is built on a cloud computing platform and is used to provide service modules, including a registration service module, an upload service module, an evaluation service module, and a second deletion service module. Users register for the service, upload the application and / or traffic data that needs to be pre-evaluated through the upload service module, and then evaluate it through the evaluation service module. The evaluation service module evaluates based on the secret evaluation method. Users can also call the second deletion service module for shredding and deletion. In other embodiments, the SAAS platform will call the removal and deletion service module for shredding and deletion after a preset time, such as 10 minutes.

[0127] In summary, the encryption evaluation method of the present application obtains the first encryption algorithm type information through an analytical model, obtains the traffic data type information and the second encryption algorithm type information through a hybrid model, and then determines the indicator level of the traffic data and / or application through this information. The discrimination operation method is simple and the indicator level judgment is reliable.

[0128] Further references Figure 2 , which shows an exemplary structural block diagram of a critical review evaluation system 200 according to the present application, including a feature library generation module 210, a first acquisition module 220, a second acquisition module 230, a standard indicator data generation module 240, and a comparison module 250:

[0129] A feature library generation module 210, used to construct a training feature library by reversely acquiring the primary encryption features of the encryption algorithm in the application;

[0130] A first acquisition module 220, configured to input the application into a parsing model to acquire first encryption algorithm type information, wherein the parsing model is generated based on a training feature library and a preset algorithm;

[0131] The second acquisition module 230 is used to acquire traffic data, and input the traffic data into a pre-trained hybrid model to obtain traffic data type information and second encryption algorithm type information;

[0132] The standard indicator data generation module 240 is used to generate password standard indicator data based on the password evaluation standard and the preset evaluation rules;

[0133] The comparison module 250 is used to determine whether the first encryption algorithm type and the second encryption algorithm type match the standard indicator data, so as to determine the indicator level of the traffic data and / or the application.

[0134] In some embodiments, the second acquisition module further includes:

[0135] The hybrid model includes a clustering model and a traffic identification model.

[0136] In some embodiments, the second acquisition module is further used to:

[0137] Inputting the traffic data into the pre-trained clustering model to obtain traffic data type information;

[0138] The traffic data is input into the pre-trained traffic identification model to obtain the second encryption algorithm type information.

[0139] In summary, the encryption evaluation device of the present application obtains the first encryption algorithm type information through an analytical model, obtains the traffic data type information and the second encryption algorithm type information through a hybrid model, and then determines the indicator level of the traffic data and / or application through this information. The discrimination operation method is simple and the indicator level judgment is reliable.

[0140] For the several modules or units mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0141] The flowcharts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operating instructions of the systems, methods and computer program products according to various embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the aforementioned module, a program segment or a part of a code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order than the order marked in the accompanying drawings. For example, the boxes represented by two connections can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented by a dedicated hardware-based system that executes the specified function or operating instruction, or can be implemented by a combination of dedicated hardware and computer instructions. The above description is only a preferred embodiment of the present application and an explanation of the technical principles used. Those skilled in the art should understand that the scope of disclosure involved in this application is not limited to the technical solutions formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the aforementioned disclosed concept. For example, the above features are replaced with (but not limited to) technical features with similar functions disclosed in this application.

[0142] In one embodiment, an electronic device is provided. The electronic device may be a terminal, and its internal structure diagram may be as follows: Figure 3 As shown. The electronic device includes a processor, a memory, a communication interface, a display screen and an input device connected through a system bus. Among them, the processor of the electronic device is used to provide computing and control capabilities. The memory of the electronic device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be achieved through WIFI, an operator network, near field communication (NFC) or other technologies. When the computer program is executed by the processor, a method for predicting the vulnerability of assets for security situation awareness is implemented. The display screen of the computer device can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covered on the display screen, or a key, trackball or touchpad set on the computer device housing, or an external keyboard, touchpad or mouse, etc.

[0143] Those skilled in the art will understand that Figure 3The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0144] In one embodiment, the secret review evaluation system provided by the present application can be implemented in the form of a computer program. The computer program can be Figure 3 The electronic device shown in the figure is run. The memory of the electronic device can store various program modules constituting the secret review evaluation system.

[0145] The memory in the electronic device stores at least one instruction, at least one program, code set or instruction set, and the instruction, the program, the code set or the instruction set are loaded and executed by the processor to implement the cryptographic evaluation method according to any one of the above embodiments, for example, to implement the cryptographic evaluation method, including: obtaining encryption features of an encryption algorithm in an application; inputting the encryption features into a pre-trained parsing model to obtain first encryption algorithm type information; obtaining traffic data, and inputting the traffic data into a pre-trained hybrid model to obtain traffic data type information and second encryption algorithm type information; generating a cryptographic standard indicator based on the indicator level of the first encryption algorithm type information and the second encryption algorithm type information; judging whether the cryptographic standard indicator matches the first encryption algorithm type and the second encryption algorithm type, thereby determining the indicator level of the traffic data and / or the application.

[0146] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented: a training feature library is formed by reversely acquiring the primary encryption features of the encryption algorithm in the application; the application is input into a parsing model to obtain first encryption algorithm type information, and the parsing model is generated based on the training feature library and a preset algorithm; traffic data is obtained, and the traffic data is input into a pre-trained hybrid model to obtain traffic data type information and second encryption algorithm type information; cryptographic standard indicator data is generated based on cryptographic evaluation standards and preset evaluation rules; and it is determined whether the first encryption algorithm type and the second encryption algorithm type match the standard indicator data, thereby determining the indicator level of the traffic data and / or the application.

[0147] In one embodiment, a computer program product is provided. When the instructions in the computer program product are executed by a processor of a mobile terminal, the mobile terminal is enabled to perform the following steps: obtain encryption features of an encryption algorithm in an application; input the encryption features into a pre-trained parsing model to obtain first encryption algorithm type information; obtain traffic data, and input the traffic data into a pre-trained hybrid model to obtain traffic data type information and second encryption algorithm type information; generate a cryptographic standard indicator based on the indicator level of the first encryption algorithm type information and the second encryption algorithm type information; determine whether the cryptographic standard indicator matches the first encryption algorithm type and the second encryption algorithm type, thereby determining the indicator level of the traffic data and / or the application.

[0148] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory may include read-only memory (ROM), magnetic tape, floppy disk, flash memory or optical memory, etc. Volatile memory may include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in various forms, such as static random access memory (SRAM) and dynamic random access memory (DRAM).

[0149] The technical features of the above embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0150] The above embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.

Claims

1. A method for evaluating a secret review, characterized in that: The method is applied to the SAAS platform, and the secret review evaluation method includes: The primary encryption features of the encryption algorithm in the application are obtained by reverse engineering to form a training feature library; Input the application into a parsing model to obtain first encryption algorithm type information, wherein the parsing model is generated based on a training feature library and a preset algorithm; the first encryption algorithm type information represents the encryption algorithm classification of the application output by the parsing model; Obtain traffic data, and input the traffic data into a pre-trained hybrid model to obtain traffic data type information and second encryption algorithm type information; the traffic data includes at least one of source IP, destination IP, time, source port, destination port, packet length, protocol, and self-encoded segmented PAYLOAD; the hybrid model includes a clustering model and a traffic identification model; the second encryption algorithm type information represents the encryption algorithm classification of the traffic data output by the traffic identification model; Generate cryptographic standard indicator data based on cryptographic evaluation standards and preset evaluation rules; the standard indicator data includes an algorithm indicator level of at least one encryption algorithm; Determine the indicator level of the traffic data based on the matching result of the first encryption algorithm type and the standard indicator data, and / or determine the indicator level of the application based on the matching result of the second encryption algorithm type and the standard indicator data.

2. The method for evaluating the secret review according to claim 1, characterized in that: Acquiring traffic data, inputting the traffic data into a pre-trained hybrid model to obtain traffic data type information and second encryption algorithm type information, further comprising: Inputting the traffic data into the pre-trained clustering model to obtain traffic data type information; Based on the traffic data type information, the traffic data is input into the pre-trained traffic identification model to obtain the second encryption algorithm type information.

3. The method for evaluating the secret review according to claim 1, characterized in that: Generate password standard indicator data based on password evaluation standards and preset evaluation rules, including: Generate encryption algorithm indicators required for level 4 encryption applications based on encryption evaluation standards and preset evaluation rules; An indicator level is generated based on the algorithm indicator, and standard indicator data is generated based on the indicator level.

4. A secret review evaluation system, characterized in that: The system is applied to the SAAS platform, and the secret review evaluation system includes: A feature library generation module is used to construct a training feature library by reversely acquiring primary encryption features of the encryption algorithm in the application program; A first acquisition module is used to input the application into a parsing model to obtain first encryption algorithm type information, wherein the parsing model is generated based on a training feature library and a preset algorithm; the first encryption algorithm type information represents the encryption algorithm classification of the application output by the parsing model; The second acquisition module is used to acquire traffic data, and input the traffic data into a pre-trained hybrid model to obtain traffic data type information and second encryption algorithm type information; the traffic data includes at least one of source IP, destination IP, time, source port, destination port, packet length, protocol, and self-encoding segmented PAYLOAD; the hybrid model includes a clustering model and a traffic identification model; the second encryption algorithm type information represents the encryption algorithm classification of the traffic data output by the traffic identification model; A standard indicator data generation module, used to generate cryptographic standard indicator data based on cryptographic evaluation standards and preset evaluation rules; the standard indicator data includes an algorithm indicator level of at least one encryption algorithm; A control module is used to determine the indicator level of traffic data based on the matching result of the first encryption algorithm type and the standard indicator data, and / or determine the indicator level of the application based on the matching result of the second encryption algorithm type and the standard indicator data.

5. The secret review evaluation system according to claim 4, characterized in that: The second acquisition module is further used for: Inputting the traffic data into the pre-trained clustering model to obtain traffic data type information; Based on the traffic data type information, the traffic data is input into the pre-trained traffic identification model to obtain the second encryption algorithm type information.

6. An electronic device, characterized in that: It includes a processor and a memory, wherein the memory stores at least one instruction, at least one program, code set or instruction set, and the instruction, the program, the code set or the instruction set is loaded and executed by the processor to implement the secret evaluation method according to any one of claims 1-3.

7. A non-transitory computer-readable storage medium, characterized in that: When the instructions in the storage medium are executed by a processor of the mobile terminal, the mobile terminal is enabled to execute the confidential review evaluation method according to any one of claims 1-3.

8. A computer program product, characterized in that When the instructions in the computer program product are executed by a processor of a mobile terminal, the mobile terminal is enabled to execute the confidential review evaluation method according to any one of claims 1 to 3.

Images