Information security risk perception method and system

Abstract

The present invention discloses an information security risk perception method and system, wherein the method includes: obtaining a characteristic value interval of device data in a target control system through a self-learning state chain; specifically: obtaining multiple device data of the target control system in each preset acquisition cycle, and dividing them into a first odd area and a first even area according to the order of statistics; obtaining the characteristic values ​​of the device data in the first odd area and the first even area in each preset acquisition cycle, and then obtaining the characteristic value interval in the entire self-learning stage; then obtaining the current characteristic value of the real-time device data in the target control system in real time through the risk perception state chain; and judging the information security risk of the target control system based on the characteristic value interval and the current characteristic value. The method uses the business model as a benchmark to judge whether the entire control system has been invaded by information security, and can effectively perceive the risk that the threshold of the business system has not exceeded the limit but has actually been invaded by a high level.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and more specifically to an information security risk perception method and system. Background Art

[0002] Under the wave of digital transformation, traditional control systems and the Internet have gradually achieved interconnection, which has brought risks to business systems in many aspects such as information security. When the system suffers from information security intrusion, the intruder will not directly trigger the traditional threshold over-limit alarm in order to conceal its whereabouts. There is currently no effective perception method for this kind of covert intrusion.

[0003] Therefore, how to quickly realize risk perception for the risk that the business system threshold has not yet been exceeded but has actually been hidden and invaded is an issue that technical personnel in this field urgently need to solve. Summary of the invention

[0004] In view of the above problems, the present invention provides an information security risk perception method and system to at least solve some of the technical problems mentioned in the above background technology.

[0005] In order to achieve the above object, the present invention adopts the following technical solution:

[0006] In one aspect, the present invention provides an information security risk perception method, comprising the following steps:

[0007] S1. Obtain the characteristic value interval of the device data in the target control system through the self-learning state chain;

[0008] S2. Obtaining the current characteristic value of the real-time device data in the target control system in real time through the risk perception state chain; and judging the information security risk of the target control system based on the characteristic value interval and the current characteristic value;

[0009] The step S1 specifically includes:

[0010] S11, acquiring multiple device data of the target control system in each preset acquisition cycle;

[0011] S12, dividing the plurality of device data into a first odd-numbered area and a first even-numbered area according to the order in which they are counted;

[0012] S13. Acquire characteristic values ​​of the device data in the first odd area and the first even area in each preset acquisition cycle, and then acquire the characteristic value interval in the entire self-learning stage; the characteristic value includes a ratio characteristic value and a difference characteristic value; the characteristic value interval includes a ratio characteristic value interval and a difference characteristic value interval.

[0013] Furthermore, the step S13 specifically includes:

[0014] In each preset acquisition cycle, a first product value and a first sum value of the device data in the first odd-numbered area are obtained; and a second product value and a second sum value of the device data in the first even-numbered area are obtained;

[0015] The ratio of the first product value to the second product value in each preset acquisition period is used as a ratio characteristic value;

[0016] The difference between the first sum value and the second sum value in each preset acquisition cycle is used as a difference feature value;

[0017] The maximum ratio eigenvalue and the minimum ratio eigenvalue in the entire self-learning stage are taken as the ratio eigenvalue interval;

[0018] The maximum difference eigenvalue and the minimum difference eigenvalue in the entire self-learning stage are taken as the difference eigenvalue interval.

[0019] Furthermore, the step S2 specifically includes:

[0020] S21, acquiring multiple real-time device data of the target control system in real time;

[0021] S22, dividing the plurality of real-time device data into a second odd-numbered area and a second even-numbered area according to the order in which they are counted;

[0022] S23, obtaining current characteristic values ​​of real-time device data in the second odd-numbered area and the second even-numbered area;

[0023] S24: judging the information security risk of the target control system based on the characteristic value interval and the current characteristic value.

[0024] Further, in the step S23, the current eigenvalue includes a current ratio eigenvalue and a current difference eigenvalue.

[0025] Furthermore, the step S24 specifically includes: if the current eigenvalue does not fall within the eigenvalue interval, it is determined that there is an information security risk in the target control system.

[0026] On the other hand, the present invention also provides an information security risk perception system, which applies the above-mentioned information security risk perception method; the information security risk perception system comprises: a self-learning unit and a risk perception unit;

[0027] The self-learning unit is used to obtain the characteristic value interval of the device data in the target control system through the self-learning state chain;

[0028] The risk perception unit is used to obtain the current characteristic value of the real-time device data in the target control system in real time through the risk perception state chain; and judge the information security risk of the target control system based on the characteristic value interval and the current characteristic value;

[0029] The self-learning unit includes a first acquisition module, a first statistics module and a first calculation module;

[0030] The first acquisition module is used to acquire multiple device data of the target control system in each preset acquisition cycle;

[0031] The first statistical module is used to divide the plurality of device data into a first odd area and a first even area according to the order in which they are counted;

[0032] The first calculation module is used to obtain the characteristic values ​​of the device data in the first odd area and the first even area in each preset acquisition cycle, and then obtain the characteristic value interval in the entire self-learning stage; the characteristic value includes a ratio characteristic value and a difference characteristic value; the characteristic value interval includes a ratio characteristic value interval and a difference characteristic value interval.

[0033] Further, the risk perception unit includes a second acquisition module, a second statistical module, a second calculation module and a judgment module;

[0034] The second acquisition module is used to acquire multiple real-time device data of the target control system in real time;

[0035] The second statistical module is used to divide the multiple real-time device data into a second odd area and a second even area according to the order of statistics;

[0036] The second calculation module is used to obtain the current characteristic value of the real-time device data in the second odd area and the second even area;

[0037] The judgment module is used to judge the information security risk of the target control system based on the characteristic value interval and the current characteristic value.

[0038] It can be seen from the above technical solutions that, compared with the prior art, the present invention discloses an information security risk perception method and system, which has the following beneficial effects:

[0039] The present invention is different from traditional information security risk perception and protection solutions. The present invention uses the business model as a benchmark to determine whether the entire control system has been invaded by information security. It can effectively perceive the risk that the business system threshold has not been exceeded but has actually been invaded at a high level.

[0040] Other features and advantages of the present invention will be set forth in the description which follows, and in part will be apparent from the description, or may be learned by practice of the present invention.

[0041] The technical solution of the present invention is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0043] Figure 1 A flowchart of an information security risk perception method provided by an embodiment of the present invention.

[0044] Figure 2 A schematic diagram of the information security risk perception system framework provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0045] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0046] Embodiment 1:

[0047] See also Figure 1 As shown, an embodiment of the present invention discloses an information security risk perception method, comprising the following steps:

[0048] S1. Obtain the characteristic value interval of the device data in the target control system through the self-learning state chain;

[0049] S2. Obtain the current characteristic value of the real-time device data in the target control system in real time through the risk perception status chain; and judge the information security risk of the target control system based on the characteristic value interval and the current characteristic value.

[0050] This method can be used to quickly detect hidden intrusion risks in business systems, and is suitable for industrial control systems. The following describes each of the above steps.

[0051] In the above step S1, it specifically includes:

[0052] S11, acquiring multiple device data of the target control system in each preset acquisition cycle;

[0053] Specifically, in the embodiment of the present invention, multiple device data of the target control system are acquired according to a preset acquisition cycle, and all preset acquisition cycles are regarded as the entire self-learning stage; then, the device data is self-learned according to the preset self-learning conditions, for example, the self-learning conditions are set to a certain stage of the year, or a certain time period of the day, and the device data that meets the preset requirements is selected;

[0054] S12, dividing the plurality of device data into a first odd-numbered area and a first even-numbered area according to the order in which they are counted;

[0055] Specifically, see Figure 1 As shown, first determine whether the IP address of the corresponding device data has been counted. If it has been counted before, directly divide the device data into the first odd area or the first even area according to the position in the previous statistical sequence; if it has not been counted before, determine the position of the device data in the current statistical sequence and divide it into the first odd area or the first even area; for example, the data carried by the device with an IP address of 172.10.1.1 in the business data is "21", and 172.10.1.1 has not been counted; the data carried by the device with an IP address of 172.10.1.2 is "22", and 172.10.1.2 has been counted If it has been counted, check how many IP addresses have been counted before 172.10.1.1. If an even number of IP addresses have been counted before, 172.10.1.1 is in an odd position, and an odd number is assigned to 172.10.1.1 according to the original order, and the data "21" is temporarily stored in the odd area; if an odd number of IP addresses have been counted before, 172.10.1.1 is in an even position, and an even number is assigned to 172.10.1.1 according to the original order, and the data "21" is temporarily stored in the even area; because 172.10.1.2 has been counted, the data "22" is directly temporarily stored in the odd area or even area originally arranged;

[0056] Assuming that there are M device data in the first odd area, the i-th device data in the first odd area is recorded as X i (i=1,…,M); Assuming that there are N device data in the first even area, the jth device data in the first even area is recorded as Y j (j=1,…,N);

[0057] S13, obtaining the characteristic values ​​of the device data in the first odd area and the first even area in each preset acquisition cycle, and then obtaining the characteristic value interval in the entire self-learning stage; wherein the characteristic value includes a ratio characteristic value and a difference characteristic value; the characteristic value interval includes a ratio characteristic value interval and a difference characteristic value interval; specifically:

[0058] (1) In each preset acquisition cycle, a first product value and a first sum value of the device data in the first odd area are obtained; and a second product value and a second sum value of the device data in the first even area are obtained; expressed as:

[0059] X 积 =∏X i (i=1,…,M)

[0060] X 和 =∑X i (i=1,…,M)

[0061] Y 积 =∏Y j (j=1,…,N)

[0062] Y 和 =∑Y j (j=1,…,N)

[0063] Among them, X 积 Represents the first product value; X 和 Represents the first sum value; Y 积 Indicates the second product value; Y 和 represents the second sum; the symbol ∏ represents a continuous multiplication operation;

[0064] (2) The first product value X in each preset collection period 积 and the second product value Y 积 The ratio of the first sum value X in each preset acquisition cycle is taken as the ratio characteristic value; and 和 and the second sum Y 和 The difference is taken as the difference eigenvalue; it is expressed as:

[0065] Z 比特征值 =X 积 / Y 积

[0066] Z 差特征值 =X 和 -Y 和

[0067] Among them, Z 比特征值 Represents the ratio eigenvalue; Z 差特征值 Represents a difference eigenvalue; based on this, a ratio eigenvalue and a difference eigenvalue are obtained in each preset acquisition cycle; thus, multiple ratio eigenvalues ​​and multiple difference eigenvalues ​​can be obtained in the entire self-learning stage;

[0068] (3) The maximum ratio eigenvalue and the minimum ratio eigenvalue in the entire self-learning stage are taken as the ratio eigenvalue interval; the maximum difference eigenvalue and the minimum difference eigenvalue in the entire self-learning stage are taken as the difference eigenvalue interval; expressed as:

[0069] Ratio eigenvalue interval = [Z 比特征值min , Z 比特征值max ]

[0070] Among them, Z 比特征值min represents the minimum ratio eigenvalue; Z 比特征值max represents the maximum ratio eigenvalue;

[0071] Difference eigenvalue interval = [Z 差特征值min , Z 差特征值max ]

[0072] Among them, Z 差特征值min represents the minimum difference eigenvalue; Z 差特征值max represents the maximum difference eigenvalue.

[0073] In the above step S2, it specifically includes:

[0074] S21, acquiring multiple real-time device data of the target control system in real time;

[0075] S22, dividing the plurality of real-time device data into a second odd-numbered area and a second even-numbered area according to the order in which they are counted; specifically, dividing them according to the order in which they are currently counted;

[0076] S23, obtaining current feature values ​​of the real-time device data in the second odd area and the second even area; the current feature values ​​include current ratio feature values ​​and current difference feature values;

[0077] Specifically, referring to the calculation process of step S1 above, the current first product value and the current first sum value of the real-time device data in the second odd-numbered area are obtained; and the current second product value and the current second sum value of the real-time device data in the first even-numbered area are obtained; the ratio of the current first product value to the current second product value is used as the current ratio feature value; the difference between the current first sum value and the current second sum value is used as the current difference feature value;

[0078] S24. Based on the eigenvalue interval and the current eigenvalue, judge the information security risk of the target control system; if the current eigenvalue does not fall within the eigenvalue interval, judge that the target control system has information security risks; specifically, if the current ratio eigenvalue does not fall within the ratio eigenvalue interval, or the current difference eigenvalue does not fall within the difference eigenvalue interval, judge that the target control system has information security risks.

[0079] Embodiment 2:

[0080] See also Figure 2As shown, an information security risk perception system is also provided in an embodiment of the present invention, which applies the above-mentioned information security risk perception method; the information security risk perception system includes: a self-learning unit and a risk perception unit; wherein: the self-learning unit is used to obtain the characteristic value interval of the device data in the target control system through the self-learning state chain; the risk perception unit is used to obtain the current characteristic value of the real-time device data in the target control system in real time through the risk perception state chain; and based on the characteristic value interval and the current characteristic value, the information security risk of the target control system is judged.

[0081] The above-mentioned self-learning unit includes a first acquisition module, a first statistical module and a first calculation module; wherein the first acquisition module is used to acquire multiple device data of the target control system within each preset acquisition cycle; the first statistical module is used to divide the multiple device data into a first odd area and a first even area according to the order of statistics; the first calculation module is used to obtain the characteristic values ​​of the device data in the first odd area and the first even area within each preset acquisition cycle, and then obtain the characteristic value interval in the entire self-learning stage.

[0082] The above-mentioned risk perception unit includes a second acquisition module, a second statistics module, a second calculation module and a judgment module; wherein the second acquisition module is used to acquire multiple real-time device data of the target control system in real time; the second statistics module is used to divide the multiple real-time device data into a second odd area and a second even area according to the order of statistics; the second calculation module is used to obtain the current characteristic value of the real-time device data in the second odd area and the second even area; the judgment module is used to judge the information security risk of the target control system based on the characteristic value interval and the current characteristic value.

[0083] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the system disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0084] The above description of the disclosed embodiments enables one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. An information security risk perception method, characterized in that: The steps include: S1. Obtain the characteristic value interval of the device data in the target control system through the self-learning state chain; S2. Acquire the current characteristic value of the real-time device data in the target control system in real time through the risk perception state chain; and judging the information security risk of the target control system based on the characteristic value interval and the current characteristic value; The step S1 specifically includes: S11, acquiring multiple device data of the target control system in each preset acquisition cycle; S12, dividing the plurality of device data into a first odd-numbered area and a first even-numbered area according to the order in which they are counted; S13, obtaining characteristic values ​​of the device data in the first odd area and the first even area in each preset acquisition cycle, and then obtaining the characteristic value interval in the entire self-learning stage; the characteristic value includes a ratio characteristic value and a difference characteristic value; the characteristic value interval includes a ratio characteristic value interval and a difference characteristic value interval; The step S13 specifically includes: In each preset acquisition cycle, a first product value and a first sum value of the device data in the first odd-numbered area are obtained; and a second product value and a second sum value of the device data in the first even-numbered area are obtained; The ratio of the first product value to the second product value in each preset acquisition period is used as a ratio characteristic value; The difference between the first sum value and the second sum value in each preset acquisition cycle is used as a difference feature value; The maximum ratio eigenvalue and the minimum ratio eigenvalue in the entire self-learning stage are taken as the ratio eigenvalue interval; The maximum difference eigenvalue and the minimum difference eigenvalue in the entire self-learning stage are taken as the difference eigenvalue interval; The step S2 specifically includes: S21, acquiring multiple real-time device data of the target control system in real time; S22, dividing the plurality of real-time device data into a second odd-numbered area and a second even-numbered area according to the order in which they are counted; S23, obtaining current characteristic values ​​of real-time device data in the second odd-numbered area and the second even-numbered area; S24, judging the information security risk of the target control system based on the characteristic value interval and the current characteristic value; In the step S23, the current eigenvalue includes a current ratio eigenvalue and a current difference eigenvalue; The step S24 specifically includes: if the current eigenvalue does not fall into the eigenvalue interval, it is judged that there is an information security risk in the target control system; specifically, if the current ratio eigenvalue does not fall into the ratio eigenvalue interval, or the current difference eigenvalue does not fall into the difference eigenvalue interval, it is judged that there is an information security risk in the target control system.

2. An information security risk perception system, characterized in that: Apply the information security risk perception method described in claim 1; The information security risk perception system comprises: a self-learning unit and a risk perception unit; The self-learning unit is used to obtain the characteristic value interval of the device data in the target control system through the self-learning state chain; The risk perception unit is used to obtain the current characteristic value of the real-time device data in the target control system in real time through the risk perception state chain; and judge the information security risk of the target control system based on the characteristic value interval and the current characteristic value; The self-learning unit includes a first acquisition module, a first statistics module and a first calculation module; The first acquisition module is used to acquire multiple device data of the target control system in each preset acquisition cycle; The first statistical module is used to divide the plurality of device data into a first odd area and a first even area according to the order in which they are counted; The first calculation module is used to obtain the characteristic values ​​of the device data in the first odd area and the first even area in each preset acquisition cycle, and then obtain the characteristic value interval in the entire self-learning stage; the characteristic value includes a ratio characteristic value and a difference characteristic value; the characteristic value interval includes a ratio characteristic value interval and a difference characteristic value interval; The first calculation module specifically includes: In each preset acquisition cycle, a first product value and a first sum value of the device data in the first odd-numbered area are obtained; and a second product value and a second sum value of the device data in the first even-numbered area are obtained; The ratio of the first product value to the second product value in each preset acquisition period is used as a ratio characteristic value; The difference between the first sum value and the second sum value in each preset acquisition cycle is used as a difference feature value; The maximum ratio eigenvalue and the minimum ratio eigenvalue in the entire self-learning stage are taken as the ratio eigenvalue interval; The maximum difference eigenvalue and the minimum difference eigenvalue in the entire self-learning stage are taken as the difference eigenvalue interval; The risk perception unit includes a second acquisition module, a second statistical module, a second calculation module and a judgment module; The second acquisition module is used to acquire multiple real-time device data of the target control system in real time; The second statistical module is used to divide the multiple real-time device data into a second odd area and a second even area according to the order of statistics; The second calculation module is used to obtain the current characteristic value of the real-time device data in the second odd area and the second even area; The judgment module is used to judge the information security risk of the target control system based on the characteristic value interval and the current characteristic value; In the second calculation module, the current eigenvalue includes a current ratio eigenvalue and a current difference eigenvalue; The judgment module specifically includes: if the current eigenvalue does not fall into the eigenvalue interval, it is judged that there is an information security risk in the target control system; specifically, if the current ratio eigenvalue does not fall into the ratio eigenvalue interval, or the current difference eigenvalue does not fall into the difference eigenvalue interval, it is judged that there is an information security risk in the target control system.

Images