A computer internal risk monitoring and repair method based on dynamic risk assessment

Abstract

The invention belongs to the field of computer security technology, and relates to a computer internal risk monitoring and repair method based on dynamic risk assessment, including the steps of classifying the security risks of existing computers and proving completeness; determining the risk weight by the AHP method and obtaining a global risk function; taking the global risk function as an objective function and analyzing the sensitivity of the computer's internal software and hardware; performing risk detection on the real-time monitoring data flow of software and hardware and the physical hardware state characteristics by a deep learning model, giving the risk factor category, and obtaining the dynamic risk priority according to the objective function; initiating an early warning in combination with the risk factor category and the corresponding software and hardware priority, and performing the risk repair step; the invention improves the comprehensiveness of risk analysis, gives the dynamic change relationship between the risk category and the computer's internal software and hardware, equips different risks with different repair plans, and saves resources while ensuring the computer's security.

Description

Technical Field

[0001] The present invention relates to the technical field of computer security, and in particular to a computer internal risk monitoring and repair method based on dynamic risk assessment. Background Art

[0002] With the accelerated advancement of digital transformation in all walks of life, a large amount of sensitive data and key business processes are stored in computer systems. At the same time, security risks such as cyber attacks, data leaks and internal threats have also increased. Therefore, establishing an effective computer internal risk monitoring mechanism is a key link in ensuring information security and business continuity. By monitoring computer internal risks, potential threats and vulnerabilities can be identified in a timely manner, and corresponding measures can be taken to strengthen security protection to avoid data leaks and system attacks. At the same time, monitoring computer internal risks can help understand the current security situation, discover security weaknesses and room for improvement, so as to continuously improve security strategies and strengthen employee training. However, some existing monitoring methods are too complex in design, resulting in high implementation and operation costs. A large amount of resources are required for configuration and management, making implementation difficult; there are false alarms, that is, false warnings or erroneous security incident reports are generated, which may lead to fatigue and ignore real threats; lack of flexibility and customization, unable to adapt to the specific needs and environments of different organizations, resulting in limited monitoring effects; slow response after the problem is discovered, resulting in delayed handling of risk events and increased loss risks. Summary of the invention

[0003] The purpose of the present invention is to overcome the deficiencies in the prior art and to provide a computer internal risk monitoring and repair method based on dynamic risk assessment.

[0004] In order to achieve the purpose of the present invention, the present invention will be implemented by adopting the technical solution described below.

[0005] A computer internal risk monitoring and repair method based on dynamic risk assessment includes the following steps:

[0006] Step S1, classifying the security risks of existing computers and proving the completeness of the risk classification;

[0007] Step S2: Use the AHP method to analyze the five major security risks of addition, deletion, modification, query, and restriction summarized in step S1, obtain the risk weights of the five major security risks, and obtain the global risk function:

[0008] f(A,D,M,R,L)=aA+bD+cM+dR+eL;

[0009] Among them, f(A,D,M,R,L) represents the output result; A,D,M,R,L respectively represent the quantitative value set of the five major security risks of adding, deleting, modifying, querying, and limiting faced by the current software and hardware; a,b,c,d,e respectively represent the weight values ​​of the five major security risks of adding, deleting, modifying, querying, and limiting;

[0010] Step S3, taking the number of risk categories faced by the detected computer internal software and hardware as the key parameter, calculating the sensitivity coefficient by solving the derivative or partial derivative of the global risk function with respect to the key parameter, and judging the influence of the key parameter change on the optimal solution by the sensitivity coefficient, so as to determine the dynamic risk priority;

[0011] Step S4: The deep learning model detects and judges the real-time monitoring data stream of software and hardware and the physical hardware status characteristics. If it is judged that there is a risk, the risk factor category is given, and the obtained risk factor category is substituted into step S3 to obtain a dynamic risk priority; if it is judged that there is no risk, the deep learning model continues to detect the real-time monitoring data stream of software and hardware and the physical hardware status characteristics;

[0012] Step S5: Initiate an early warning based on the risk factor category and the dynamic risk priority of the corresponding software and hardware, and perform risk repair.

[0013] As a preferred solution of the present invention, the global privacy risk classification and completeness proof summarizes the security risks faced by existing computers into five categories: addition, deletion, modification, query, and restriction, and proves the completeness of the classification through a completeness proof;

[0014] As a preferred embodiment of the present invention, the global risk function based on the AHP method is to analyze the five categories of addition, deletion, modification, query and restriction according to the AHP method, obtain the risk weights of the five categories of security risks, and obtain the global risk function:

[0015] f(A,D,M,R,L)=aA+bD+cM+dR+eL

[0016] Among them, f(A,D,M,R,L) represents the output result; A, D, M, R, L respectively represent the quantitative value sets of the five major security risks of addition, deletion, modification, query, and restriction faced by the current software and hardware; a, b, c, d, e respectively represent the weight values ​​of the five major security risks of addition, deletion, modification, query, and restriction.

[0017] As a preferred solution of the present invention, the dynamic risk priority evaluation process includes the following steps:

[0018] Step S41: using the number of risk categories faced by the detected computer internal software and hardware as a key parameter;

[0019] Step S42: Obtaining a sensitivity coefficient by solving a derivative or partial derivative of the global risk function with respect to a key parameter;

[0020] Step S43: Based on the calculated sensitivity coefficient, determine the degree of influence of parameter changes on the optimal solution; a high sensitivity coefficient means that a small parameter change will lead to a significant output change, while a low sensitivity coefficient means that the output is not very sensitive to parameter changes.

[0021] Step S44: Determine the current system software and hardware priority according to the sensitivity coefficient.

[0022] As a preferred solution of the present invention, the real-time software and hardware monitoring uses a deep learning model to perform risk detection and classification on factors such as monitored data flow and physical hardware status, provides risk factor categories, and initiates an early warning.

[0023] As a preferred solution of the present invention, the risk repair determines the risk level of the current risk software or hardware: if the risk level is low, the system's built-in automatic repair program will repair it according to the risk category; if the risk level is high, the equipment administrator is required to perform manual inspection and repair according to the risk category and sign a safety order.

[0024] As a preferred solution of the present invention, the risk level is defined as follows:

[0025] There are five categories of risks, with priorities 1-3 belonging to low priority and 4-5 belonging to high priority;

[0026] The weight range is [0,1], where [0,0.5] belongs to the low weight range and (0.5,1] belongs to the high weight range;

[0027] If the current risk priority is 1-3 and the weight range is [0,0.5], the current risk is defined as low level;

[0028] If the current risk priority is 1-3 and the weight range is (0.5,1], the current risk is defined as high level;

[0029] If the current risk priority is 4-5 and the weight range is (0.5,1], the current risk is defined as high level;

[0030] If the current risk priority is 4-5 and the weight range is [0,0.5], the current risk is defined as low level.

[0031] Beneficial Effects

[0032] The present invention has the following advantages: providing a global risk classification of computers and proving the completeness of the classification through extensive research, thereby improving the comprehensiveness of risk analysis; providing a dynamic change relationship between risk categories and the software and hardware inside the computer based on a global risk function of the AHP method and a software and hardware risk priority based on sensitivity analysis, providing specific warnings for specific problems, and realizing intelligent risk warnings; using a machine learning algorithm to implement real-time software and hardware risk detection, and equipping different risks with different repair plans, thereby ensuring computer security while saving resources. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 It is the overall flow chart of the present invention;

[0034] Figure 2 It is a schematic diagram of the global risk classification and dynamic risk assessment process of the present invention;

[0035] Figure 3 It is a schematic diagram of the real-time software and hardware detection process of the present invention;

[0036] Figure 4 It is a schematic diagram of the risk repair solution matching process of the present invention. DETAILED DESCRIPTION

[0037] The present invention is further described in conjunction with the accompanying drawings and embodiments.

[0038] As the technical solution of the present invention, Figure 1 As shown, a computer internal risk monitoring and repair method based on dynamic risk assessment includes the following steps:

[0039] Step S1, classifying the security risks of existing computers and proving the completeness of the risk classification;

[0040] Step S2: Use the AHP method to analyze the five major security risks of addition, deletion, modification, query, and restriction summarized in step S1, obtain the risk weights of the five major security risks, and obtain the global risk function:

[0041] f(A,D,M,R,L)=aA+bD+cM+dR+eL;

[0042] Among them, f(A,D,M,R,L) represents the output result; A,D,M,R,L respectively represent the quantitative value set of the five major security risks of adding, deleting, modifying, querying, and limiting faced by the current software and hardware; a,b,c,d,e respectively represent the weight values ​​of the five major security risks of adding, deleting, modifying, querying, and limiting;

[0043] Step S3, taking the number of risk categories faced by the detected computer internal software and hardware as the key parameter, calculating the sensitivity coefficient by solving the derivative or partial derivative of the global risk function with respect to the key parameter, and judging the influence of the key parameter change on the optimal solution by the sensitivity coefficient, so as to determine the dynamic risk priority;

[0044] Step S4: The deep learning model detects and judges the real-time monitoring data stream of software and hardware and the physical hardware status characteristics. If it is judged that there is a risk, the risk factor category is given, and the obtained risk factor category is substituted into step S3 to obtain a dynamic risk priority; if it is judged that there is no risk, the deep learning model continues to detect the real-time monitoring data stream of software and hardware and the physical hardware status characteristics;

[0045] Step S5: Initiate an early warning based on the risk factor category and the dynamic risk priority of the corresponding software and hardware, and perform risk repair.

[0046] As an embodiment of the present invention, Figure 2 As shown, classifying the security risks of existing computers and proving the completeness of risk categories is to summarize the global privacy risks, which are divided into five categories: addition, deletion, modification, query, and restriction, and the completeness of the classification is proved through completeness proof; wherein, the global privacy risk refers to all security risks faced by existing computers.

[0047] The specific classification and certification process is as follows:

[0048] Define a non-empty set X, X = {a, d, m, s, l} represents the five categories of network attack methods, where a = {a1, a2, ..., a q} represents the currently known q illegal increase network attack methods, d =

[0049] {d1,d2,...,d q} represents the currently known q illegal deletion network attack methods, m={m1,m2,...,m q} represents the currently known q illegal modification network attack methods, s={s1,s2,...,s q} represents the q known illegal query network attack methods, l={l1,l2,...,l q} represents the currently known q illegal restricted network attack methods, q∈Q (including the number of all new attacks in the future).

[0050] Given the distance measurement rule: the distance of the same classification result is 0, and the distance of different classification results is d. Since the five types of network attack methods {a, d, m, q, l} are not completely consistent, there is a distance between the classification results. Therefore, the distance function d(x, y) can be constructed. Construct the metric space based on the non-empty set X and the distance function d(x, y), we have:

[0051] Theorem 1: If d:X×X→R, and for As long as d has the following three properties, it can be shown that X is a metric space.

[0052] Property 1: d(x,y)≥0, the equality holds if and only if x=y.

[0053] Property 2: d(x,y)=d(y,x).

[0054] Property 3: d(x,y)+d(y,z)≥d(x,z).

[0055] Next, we will prove that the distance function d in this paper has the above three properties.

[0056] Proof: d(x,y)≥0, the equality holds if and only if x=y.

[0057] First, using proof by contradiction, assume that d(x,y)<0. From the definition of distance, we know that distance represents the physical length between two points, and there is no negative length. Therefore, this assumption is not true, and the original proposition is true, so d(x,y)>0 must exist.

[0058] Secondly, we can also use proof by contradiction to prove that d(x,y) = 0 if and only if x = y. Assume that there are two different points x = y such that d(x,y) = 0. According to the definition of distance, we can get d(x,y) ≥ 0, and d(x,y) = 0 means that the two points are at the same position. Therefore, x and y must be the same point, that is, x = y. This assumption is not true, and the original proposition is true.

[0059] Therefore, for any two points x and y, the distance between the two points satisfies d(x, y) ≥ 0, and d(x, y) = 0 if and only if x = y.

[0060] Proof: d(x,y)=d(y,x).

[0061] Assume that there are any two points A(x1,y1) and B(x2,y2) in X. Map the two points to the plane coordinate system. The distance between A and B is: At the same time (x1-x2) 2 and (y1-y2) 2Transpose the terms, That is, d(A, B) = d(B, A). Therefore, the distance function has symmetry, that is, the distance between two points is independent of the order of the two points. Whether from point A to point B or from point B to point A, the physical length of the distance between the two points is the same.

[0062] Proof: d(x, y) + d(y, z) ≥ d(x, z).

[0063] Consider using mathematical induction to prove this triangle inequality. First, prove that the inequality holds when n = 2, that is, the distance between two points satisfies this triangle inequality. Assume that when n = k, the inequality holds, that is, the distance between any k points satisfies the triangle inequality. Now consider the case of k + 1. Select any two points A and B among the k + 1 points, and the distance between them is d(A, B). According to the induction hypothesis, the distance between the remaining k - 1 points satisfies this triangle inequality. Now it only needs to be proved that the distance between A and B and the remaining k - 1 points also satisfies the triangle inequality.

[0064] Assume that there exists a point C such that d(A, C) + d(C, B) < d(A, B). Then, according to the triangle inequality d(A, C) + d(C, B) ≥ d(A, B), which is a contradiction to the assumption. That is, this triangle inequality also holds in the case of n = k + 1. Therefore, the triangle inequality of the distance function of the present invention holds for any n points.

[0065] In summary, it shows that the distance function d satisfies the constraint conditions of all properties, and further shows that X is a metric space. If it is necessary to prove that X is a complete metric space, and further show that the five categories of network attack methods divided based on the concept of distance are complete, it must be satisfied that:

[0066] Theorem 2: In the metric space X, if there exists a real number sequence L (since the distance between any two points selected from the space is determined, a real number sequence L can be constructed to represent the distance between two points in the space), if for any positive real number φ, there exists a positive integer N, when n > N, it satisfies: |L - m| < φ, where m is the convergence point (real number), then L is called a Cauchy sequence, and X is a complete metric space. Therefore, it only needs to be proved that the real number sequence L is a Cauchy sequence and converges to a certain real number in this space, which conforms to the definition that the distance space constructed based on the real number distance is complete [1], then it shows that the constructed metric space X has completeness, that is, the division of the five categories for network attacks is complete.

[0067] Proof: Assume that L converges to m. Then for any positive real number φ, there exists a positive integer N, when n > N, such that |L - m| < φ. Since φ is any positive real number, φ = 3 can be taken, and we have: |L - m| < 3, that is, m - 3 < L < m + 3. Take Y = max{|L1 - m|, |L2 - m|,..., |Ln-1 -m|,L+1}, when n≥N, |Lm|≤Y≤∞. Since φ>0, take |Lm|<φ. Therefore, the sequence L meets the definition of Cauchy sequence and converges to m.

[0068] In summary, the constructed metric space X is complete, that is, the classification of the five categories of network attacks is complete.

[0069] The global risk function based on the AHP method is to analyze the five major types of security risks of addition, deletion, modification, query and restriction according to the AHP method, obtain the risk weights of the five types of risks, and obtain the global risk function:

[0070] f(A,D,M,R,L)=aA+bD+cM+dR+eL

[0071] Among them, f(A,D,M,R,L) represents the output result; A, D, M, R, L respectively represent the quantitative value sets of the five major security risks of addition, deletion, modification, query, and restriction faced by the current software and hardware; a, b, c, d, e respectively represent the weight values ​​of the five major security risks of addition, deletion, modification, query, and restriction.

[0072] The calculation process of the risk weight value of each indicator in the AHP risk calculation system includes the following steps:

[0073] 1) Calculate the risk weight value of each indicator in the risk system according to AHP and construct a judgment matrix It is constructed by comparing the five risk indicators of addition, deletion, modification, check and restriction. The quantitative judgment rules are as follows.

[0074]

[0075] (2) Use the square root method to calculate the eigenvalues ​​and eigenvectors of the judgment matrix. Calculate the product of each row of the judgment matrix:

[0076]

[0077] Normalize the feature vector to the weight, the formula is as follows:

[0078]

[0079] W A =[W1,W2,...,W n ] T

[0080] Compute the largest eigenvalue.

[0081]

[0082] (AW) i It means that the weights of the judgment matrix J are normalized and then the values ​​are accumulated row by row.

[0083] (3) Check consistency. Define the consistency index CI. This step is used to check whether the construction of the judgment matrix is ​​reasonable.

[0084]

[0085] Generally speaking, CI ≤ 0.1 indicates that J is consistent.

[0086] Multiply the risk level by the weight corresponding to each indicator. Divide the risk assessment level into five levels: extreme, high, medium, low and lowest. Since the judgment error increases with the increase of n, we need to consider the influence of n and use CR for consistency judgment:

[0087]

[0088] RI is the average random consistency index. It is shown below.

[0089]

[0090] As an embodiment of the present invention, the dynamic risk priority evaluation process includes the following steps:

[0091] Step 1: Determine the key parameters, where the key parameters are the quantitative values ​​of the security risk categories faced by the detected computer internal hardware and software; Step 2: Calculate the sensitivity coefficients, for the above key parameters, calculate their sensitivity coefficients. The sensitivity coefficient is achieved by solving the derivative or partial derivative of the global risk function with respect to these parameters; Step 3: Analyze the results, and judge the degree of influence of parameter changes on the optimal solution based on the calculated sensitivity coefficients. A high sensitivity coefficient means that a small parameter change will lead to a significant output change, while a low sensitivity coefficient means that the output is not very sensitive to parameter changes; Step 4: Determine the current system hardware and software priority according to the sensitivity coefficient. The specific process is:

[0092] Assume that the global risk function is:

[0093] f(A,D,M,R,L)=0.2A+0.1D+0.3M+0.05R+0.35L

[0094] The key parameters detected are A, D, M, and L. The sensitivity coefficients for risk factors A, D, M, and L are:

[0095]

[0096] The current system software and hardware priorities are processed according to risk factors L, M, A, and D.

[0097] As an embodiment of the present invention, Figure 3 As shown in the figure, real-time software and hardware monitoring uses deep learning models to perform risk detection and classification on factors such as monitoring data flow and physical hardware status, gives risk factor categories, and initiates early warnings. The specific process is as follows:

[0098] The current real-time software and hardware detection model adopts the CNN model, which takes monitoring data such as monitoring data flow and physical hardware status as model input and outputs risk factor categories, where category 0 is defined as no risk, and the five risk factors of adding, deleting, modifying, querying, and restricting are defined as 1, 2, 3, 4, and 5 respectively; if the model output is 0, it means that there is no risk in the current monitoring data; if the model output is 1, 2, 3, 4 or 5, it means that there is a risk in the current monitoring data and an early warning is initiated.

[0099] As an embodiment of the present invention, Figure 4 As shown, risk repair determines the risk level of the current risk software or hardware: if the risk level is low, the system's built-in automatic repair program will repair it according to the risk category; if the risk level is high, the device administrator is required to perform manual inspection and repair according to the risk category and sign a safety order; among them, low priority means that the risk priority is not high and the risk factor category weight is not high; otherwise, it is a high priority risk.

[0100] The risk levels are defined as follows:

[0101] There are five types of risks, with priorities 1-3 belonging to low priority and 4-5 belonging to high priority. The weight range is [0,1], where [0,0.5] belongs to the low weight range and (0.5,1] belongs to the high weight range.

[0102] If the current risk priority is 1-3 and the weight range is [0,0.5], the current risk is defined as low level;

[0103] If the current risk priority is 1-3 and the weight range is (0.5,1], the current risk is defined as high level;

[0104] If the current risk priority is 4-5 and the weight range is (0.5,1], the current risk is defined as high level;

[0105] If the current risk priority is 4-5 and the weight range is [0,0.5], the current risk is defined as low level.

Claims

1. A computer internal risk monitoring and repair method based on dynamic risk assessment, characterized in that: The steps include: Step S1, classifying the security risks of existing computers and proving the completeness of the risk classification; Step S2: Use the AHP method to analyze the five major security risks of addition, deletion, modification, query, and restriction summarized in step S1, obtain the risk weights of the five major security risks, and obtain the global risk function: f(A,D,M,R,L)=aA+bD+cM+dR+eL; Among them, f(A,D,M,R,L) represents the output result; A,D,M,R,L respectively represent the quantitative value set of the five major security risks of adding, deleting, modifying, querying, and limiting faced by the current software and hardware; a,b,c,d,e respectively represent the weight values ​​of the five major security risks of adding, deleting, modifying, querying, and limiting; Step S3, taking the number of risk categories faced by the detected computer internal software and hardware as the key parameter, calculating the sensitivity coefficient by solving the derivative or partial derivative of the global risk function with respect to the key parameter, and judging the influence of the key parameter change on the optimal solution by the sensitivity coefficient, so as to determine the dynamic risk priority; Step S4: The deep learning model detects and judges the real-time monitoring data stream of software and hardware and the physical hardware status characteristics. If it is judged that there is a risk, the risk factor category is given, and the obtained risk factor category is substituted into step S3 to obtain a dynamic risk priority; if it is judged that there is no risk, the deep learning model continues to detect the real-time monitoring data stream of software and hardware and the physical hardware status characteristics; Step S5: Initiate an early warning based on the risk factor category and the dynamic risk priority of the corresponding software and hardware, and perform risk repair.

2. According to claim 1, a computer internal risk monitoring and repair method based on dynamic risk assessment is characterized in that: The risk categories are divided into five categories: addition, deletion, modification, query, and restriction.

3. A computer internal risk monitoring and repair method based on dynamic risk assessment according to claim 1, characterized in that: The risk repair is based on the risk level of the current software or hardware: if the risk level is low, the system's built-in automatic repair program will repair it according to the risk category; if the risk level is high, the device administrator is required to perform manual inspection and repair according to the risk category and sign a safety order.

4. A computer internal risk monitoring and repair method based on dynamic risk assessment according to claim 3, characterized in that: The risk levels are defined as follows: There are five categories of risks, with priorities 1-3 belonging to low priority and 4-5 belonging to high priority; The weight range is [0,1], where [0,0.5] belongs to the low weight range and (0.5,1] belongs to the high weight range; If the current risk priority is 1-3 and the weight range is [0,0.5], the current risk is defined as low level; If the current risk priority is 1-3 and the weight range is (0.5,1], the current risk is defined as high level; If the current risk priority is 4-5 and the weight range is (0.5,1], the current risk is defined as high level; If the current risk priority is 4-5 and the weight range is [0,0.5], the current risk is defined as low level.

Images