Software information security assessment method, device and equipment based on artificial intelligence

Abstract

The present invention discloses a software information security assessment method, device and equipment based on artificial intelligence, the method comprising: obtaining a first assessment result corresponding to a user data confidentiality parameter set based on a first classification model; obtaining a second assessment result corresponding to a user data integrity verification model based on a test user data set; obtaining a third assessment result corresponding to an anti-attack capability parameter set based on a second classification model; performing a recoverability test on the software to be assessed based on an automatic recovery service capability test set to obtain a fourth assessment result; determining the corresponding software information security assessment result based on the first assessment result, the second assessment result, the third assessment result, the fourth assessment result and a preset comprehensive assessment model. The above-mentioned embodiment can quickly obtain the application software data to be assessed, and automatically test and evaluate from multiple dimensions of user data confidentiality, user data integrity verification, anti-attack capability and automatic recovery service capability, and quickly and intelligently determine the final assessment result.

Description

Technical Field

[0001] The present invention relates to the field of information security detection technology, and in particular to a software information security assessment method, device and equipment based on artificial intelligence. Background Art

[0002] At present, when testing application software before it goes online, the testers of the application software developer usually conduct various functional tests on it, such as rollback testing, stress testing, code standardization, etc. However, the above functional tests are more focused on testing the overall system stability of the application software and cannot accurately reflect its software information security indicators. Moreover, at present, the software information security testing methods adopted by various application software developers are inconsistent. For example, some application software developers focus on testing from the user data storage security indicators, while other application software developers focus on testing from the security policy and management system. This makes it impossible to conduct intelligent automated testing on the application software to obtain accurate information security assessment results. Summary of the invention

[0003] The embodiments of the present invention provide a software information security assessment method, device and equipment based on artificial intelligence, aiming to solve the problem that the software information security testing methods adopted by various application software developers in the prior art methods are inconsistent, resulting in the inability to perform intelligent automated testing on the application software to obtain accurate information security assessment results.

[0004] In a first aspect, an embodiment of the present invention provides a software information security assessment method based on artificial intelligence, which includes:

[0005] In response to the evaluation instruction, acquiring the application software data to be evaluated corresponding to the evaluation instruction;

[0006] Acquire a user data confidentiality parameter set corresponding to the application software data to be evaluated, and acquire a first evaluation result corresponding to the user data confidentiality parameter set based on a pre-trained first classification model;

[0007] Acquire a user data integrity verification model corresponding to the application software data to be evaluated, and acquire a second evaluation result corresponding to the user data integrity verification model based on a pre-generated test user data set;

[0008] Acquire an anti-attack capability parameter set corresponding to the application software data to be evaluated, and acquire a third evaluation result corresponding to the anti-attack capability parameter set based on a pre-trained second classification model;

[0009] Acquire an automatic recovery service capability test set corresponding to the application software data to be evaluated, and perform a recoverability test of the software to be evaluated based on the automatic recovery service capability test set to obtain a fourth evaluation result;

[0010] Based on the first evaluation result, the second evaluation result, the third evaluation result, the fourth evaluation result and a preset comprehensive evaluation model, a software information security evaluation result corresponding to the application software data to be evaluated is determined.

[0011] In a second aspect, an embodiment of the present invention further provides a software information security assessment device based on artificial intelligence, which includes:

[0012] The to-be-evaluated application software data acquisition unit is used to, in response to the evaluation instruction, acquire the to-be-evaluated application software data corresponding to the evaluation instruction;

[0013] A first result acquisition unit, configured to acquire a user data confidentiality parameter set corresponding to the application software data to be evaluated, and to acquire a first evaluation result corresponding to the user data confidentiality parameter set based on a pre-trained first classification model;

[0014] A second result acquisition unit, configured to acquire a user data integrity verification model corresponding to the application software data to be evaluated, and acquire a second evaluation result corresponding to the user data integrity verification model based on a pre-generated test user data set;

[0015] A third result acquisition unit, used to acquire an anti-attack capability parameter set corresponding to the application software data to be evaluated, and acquire a third evaluation result corresponding to the anti-attack capability parameter set based on a pre-trained second classification model;

[0016] A fourth result acquisition unit, configured to acquire an automatic recovery service capability test set corresponding to the application software data to be evaluated, and perform a recoverability test of the software to be evaluated based on the automatic recovery service capability test set to obtain a fourth evaluation result;

[0017] The security assessment result acquisition unit is used to determine the software information security assessment result corresponding to the application software data to be assessed based on the first assessment result, the second assessment result, the third assessment result, the fourth assessment result and a preset comprehensive assessment model.

[0018] In a third aspect, an embodiment of the present invention further provides a computer device, wherein the computer device includes a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other via the communication bus;

[0019] Memory, used to store computer programs;

[0020] The processor is used to implement the steps of software information security assessment based on artificial intelligence as described in the first aspect above when executing the program stored in the memory.

[0021] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the steps of the artificial intelligence-based software information security assessment as described in the first aspect above are implemented.

[0022] Embodiments of the present invention provide a software information security assessment method, apparatus and equipment based on artificial intelligence. The method includes: responding to an assessment instruction, obtaining application software data to be assessed corresponding to the assessment instruction; obtaining a user data confidentiality parameter set corresponding to the application software data to be assessed, and obtaining a first assessment result corresponding to the user data confidentiality parameter set based on a pre-trained first classification model; obtaining a user data integrity verification model corresponding to the application software data to be assessed, and obtaining a second assessment result corresponding to the user data integrity verification model based on a pre-generated test user data set; obtaining an anti-attack capability parameter set corresponding to the application software data to be assessed, and obtaining a third assessment result corresponding to the anti-attack capability parameter set based on a pre-trained second classification model; obtaining an automatic recovery service capability test set corresponding to the application software data to be assessed, and performing a recoverability test of the software to be assessed based on the automatic recovery service capability test set to obtain a fourth assessment result; and determining the software information security assessment result corresponding to the application software data to be assessed based on the first assessment result, the second assessment result, the third assessment result, the fourth assessment result and a preset comprehensive assessment model. The above-mentioned embodiments can quickly obtain the application software data to be evaluated, and perform automatic testing and evaluation from multiple dimensions such as user data confidentiality, user data integrity verification, anti-attack capability and automatic recovery service capability, so as to quickly and intelligently determine the final evaluation result. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying any creative work.

[0024] Figure 1 A schematic diagram of an application scenario of the software information security assessment method based on artificial intelligence provided by an embodiment of the present invention;

[0025] Figure 2 A flowchart of a software information security assessment method based on artificial intelligence provided by an embodiment of the present invention;

[0026] Figure 3 A sub-flow chart of a software information security assessment method based on artificial intelligence provided by an embodiment of the present invention;

[0027] Figure 4A sub-flow chart of a software information security assessment method based on artificial intelligence provided by an embodiment of the present invention;

[0028] Figure 5 A sub-flow chart of a software information security assessment method based on artificial intelligence provided by an embodiment of the present invention;

[0029] Figure 6 A sub-flow chart of a software information security assessment method based on artificial intelligence provided by an embodiment of the present invention;

[0030] Figure 7 A sub-flow chart of a software information security assessment method based on artificial intelligence provided by an embodiment of the present invention;

[0031] Figure 8 A schematic block diagram of a software information security assessment device based on artificial intelligence provided by an embodiment of the present invention;

[0032] Fig. 9 A schematic block diagram of a computer device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0033] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0034] It should be understood that when used in this specification and the appended claims, the terms "include" and "comprises" indicate the presence of described features, integers, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or combinations thereof.

[0035] It should also be understood that the terms used in the present specification are only for the purpose of describing specific embodiments and are not intended to limit the present invention. As used in the present specification and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include plural forms.

[0036] It should be further understood that the term "and / or" used in the present description and the appended claims refers to and includes any and all possible combinations of one or more of the associated listed items.

[0037] See also Figure 1 and Figure 2 , Figure 1A schematic diagram of an application scenario of the software information security assessment method based on artificial intelligence provided by an embodiment of the present invention; Figure 2 The method flow chart of the software information security assessment method based on artificial intelligence provided by the embodiment of the present invention. Figure 1-Figure 2 As shown, an embodiment of the present invention application provides a software information security assessment method based on artificial intelligence, which is applied to a server 10. The server 10 is communicatively connected to a user terminal 20, and the user terminal 20 can send data related to the application software to be assessed to the server for software information security assessment.

[0038] like Figure 2 As shown, the method includes steps S110 to S160.

[0039] S110 . In response to an evaluation instruction, obtain application software data to be evaluated corresponding to the evaluation instruction.

[0040] In this embodiment, when the application software developer completes the development of the application software, a complete application software installation package data is obtained. The server provides an upload entry for the application software installation package data to the user terminal. Through this upload entry, the application software installation package data can be sent from the user terminal to the server as an encrypted data packet, and when the application software installation package data is added to the upload entry, it triggers the generation of an evaluation instruction. A trusted execution environment (TEE, the full name is Trusted Execution Environment) can be set up in the server. After the server receives the application software installation package data corresponding to the evaluation instruction, it is stored in the trusted execution environment for decompression and installation, and then subsequent software information security evaluation is performed. In addition, the server's trusted execution environment stores a secret key for decrypting the application software installation package data. After the application software installation package data is decrypted based on the secret key in the trusted execution environment, it is automatically installed to obtain the application software data to be evaluated.

[0041] It should be noted that after the application software installation package data is decrypted and automatically installed in the trusted execution environment, the corresponding application software data to be evaluated is also stored in the trusted execution environment to ensure the data security of the server when performing software information security evaluation.

[0042] S120: Obtain a user data confidentiality parameter set corresponding to the application software data to be evaluated, and obtain a first evaluation result corresponding to the user data confidentiality parameter set based on a pre-trained first classification model.

[0043] In this embodiment, after the application software data to be evaluated is obtained in the trusted execution environment of the server, it can be parsed to obtain the user data confidentiality parameter set included therein. For example, the user data usage notification information, user data encryption model and data sharing protocol obtained from the application software data to be evaluated can constitute the user data confidentiality initial parameter set, and then the user data confidentiality initial parameter set is subjected to keyword extraction to obtain multiple keywords and their specific values ​​to constitute the user data confidentiality parameter set. Afterwards, each user data confidentiality parameter in the user data confidentiality parameter set (for example, one user data confidentiality parameter corresponds to one keyword and its specific value) constitutes a first comprehensive input parameter, and is input into the first classification model to obtain the first evaluation result corresponding to the user data confidentiality parameter set. It can be seen that by inputting the user data confidentiality parameter set into the first classification model, the first dimension evaluation result related to the application software data to be evaluated can be quickly obtained.

[0044] In one embodiment, if Figure 3 As shown, step S120 includes:

[0045] S121, acquiring user data usage notification information, user data encryption model and data sharing protocol from the application software data to be evaluated based on the keyword recognition model to form the user data confidentiality parameter set;

[0046] S122, obtaining a data collection scope, a data storage area, and a data sharing scope of the user data usage notification information based on keyword recognition, and determining parameter mapping values ​​corresponding to the data collection scope, the data storage area, and the data sharing scope, respectively, based on a first preset mapping relationship, to form a first parameter set;

[0047] S123, obtaining a user data encryption model name and a corresponding user data encryption model data packet in the user data encryption model based on keyword recognition, determining a model mapping value corresponding to the user data encryption model name based on a second preset mapping relationship, determining a model data check value based on an empty data packet judgment result of the user data encryption model data packet, and forming a second parameter set with the model mapping value and the model data check value;

[0048] S124, obtaining a sharing protocol name and corresponding sharing protocol text data in the data sharing protocol based on keyword recognition, determining a protocol mapping value corresponding to the sharing protocol name based on a third preset mapping relationship, determining a protocol data check value based on an empty file judgment result of the sharing protocol text data, and forming a third parameter set with the protocol mapping value and the protocol data check value;

[0049] S125. Combining the first parameter set, the second parameter set and the third parameter set into a first comprehensive input parameter, inputting the first comprehensive input parameter into the first classification model, and obtaining the first evaluation result.

[0050] In this embodiment, after the application software data to be evaluated is obtained in the trusted execution environment of the server, the user data usage notification information, the user data encryption model and the data sharing agreement can also be obtained therefrom to form the user data confidentiality parameter set. The acquisition of the above information or data can be performed by identifying the file names corresponding to the data files in the application software data to be evaluated. For example, if there is a first file storing the user data usage notification information, its file name can also correspond to the Chinese names (or corresponding English names) of the usage notification information. Similarly, the user data encryption model is obtained from the second file whose file name is related to the encryption model, and the data sharing agreement is obtained from the third file whose file name is related to the data sharing agreement.

[0051] Afterwards, the keyword recognition model can also be used to extract information such as the data collection scope, data storage area, and data sharing scope from the user data usage notification information, and then determine the parameter mapping values ​​corresponding to the data collection scope, data storage area, and data sharing scope based on the first preset mapping relationship. For example, if the data collection scope includes a unique device identification code and application list information, then the first parameter mapping value corresponding to the data collection scope is determined to be 2 based on the first preset mapping relationship; if the data collection scope includes a unique device identification code, application list information, and location information, then the first parameter mapping value corresponding to the data collection scope is determined to be 3 based on the first preset mapping relationship. Similarly, the second parameter mapping value corresponding to the data storage area and the third parameter mapping value corresponding to the data sharing scope can also be determined based on the above method, and finally the first parameter set is composed of the first parameter mapping value to the third parameter mapping value.

[0052] The keyword recognition model can also be used to determine the model mapping value corresponding to the user data encryption model from the user data encryption model name and the corresponding user data encryption model data packet in the user data encryption model based on the second preset mapping relationship (for example, if the user data encryption model uses an asymmetric encryption model, the model mapping value corresponding to the user data encryption model is determined to be 1 based on the second preset mapping relationship); when the user data encryption model data packet is an empty data packet, the model data check value is determined to be 0, and when the user data encryption model data packet is not an empty data packet, the model data check value is determined to be 1. Finally, the model mapping value and the model data check value form the second parameter set.

[0053] The keyword recognition model can also be used to determine the protocol mapping value corresponding to the sharing protocol name based on the third preset mapping relationship from the sharing protocol name and the corresponding sharing protocol text data in the data sharing protocol (for example, if the sharing protocol name is a three-party data sharing protocol, the protocol mapping value corresponding to the three-party data sharing protocol is determined to be 0 based on the third preset mapping relationship); when the sharing protocol text data is an empty file, the protocol data check value is determined to be 0, and when the sharing protocol text data is not an empty file, the protocol data check value is determined to be 1. Finally, the third parameter set is composed of the protocol mapping value and the protocol data check value.

[0054] After the first parameter set, the second parameter set and the third parameter set corresponding to the user data confidentiality parameter set have been obtained, the three parameter sets are used in the order of the first parameter set, the second parameter set and the third parameter set to form a first comprehensive input parameter and input it into the first classification model. For example, the first classification model can specifically adopt a random forest model to obtain the first evaluation result. It can be seen that through the above method, the first dimension evaluation result related to the confidentiality of user data in the application software data to be evaluated is obtained.

[0055] S130: Acquire a user data integrity verification model corresponding to the application software data to be evaluated, and acquire a second evaluation result corresponding to the user data integrity verification model based on a pre-generated test user data set.

[0056] In this embodiment, after the application software data to be evaluated is obtained in the trusted execution environment of the server, it can also be parsed to obtain the user data integrity verification model included therein. Then, the test user data set pre-generated locally on the server is input into the user data integrity verification model to obtain the second evaluation result.

[0057] For example, when a test user data set is pre-generated in the trusted execution environment of the server, two types of test user data can be mainly generated, one of which is test user data with missing values ​​in some data fields, and the other is test user data with complete values ​​in all data fields and no abnormal values, and the data proportions of the above two types of test user data are also known. At this time, the test user data set is input into the user data integrity verification model, and the data integrity of each test user data can be verified to obtain the data integrity verification results corresponding to each test user data, and then the second evaluation result is determined in combination with the above multiple data integrity verification results. It can be seen that by inputting the test user data set into the user data integrity verification model, the second dimension evaluation result related to the application software data to be evaluated can be quickly obtained.

[0058] In one embodiment, if Figure 4As shown, step S130 includes:

[0059] S131, obtaining a first data proportion value corresponding to incomplete type test user data in the test user data set;

[0060] S132, inputting the test user data set into the user data integrity verification model to perform data integrity verification, and obtaining a data integrity verification result set; wherein each test user data in the test user data set corresponds to one of the data integrity verification results in the data integrity verification result set;

[0061] S133, obtaining a second data proportion value corresponding to the incomplete type data in the data integrity check result set;

[0062] S134: If it is determined that the second data proportion value is equal to the first data proportion value, taking the first preset value as the second evaluation result;

[0063] S135: If it is determined that the second data proportion value is not equal to the first data proportion value, a second preset value is used as the second evaluation result.

[0064] In this embodiment, the test user data set generated in the trusted execution environment of the server can first perform data volume statistics on two types of incomplete test user data and complete test user data, and determine the first data proportion value based on the ratio of the total number of data items of the incomplete test user data to the total number of data items of the test user data set.

[0065] Afterwards, the test user data set is input into the user data integrity verification model for data integrity verification, and a data integrity verification result corresponding to each test user data in the test user data set is obtained. For example, if the test user data is complete type data, the corresponding data integrity verification result is verification passed (more specifically, the verification value 1 can be used to indicate the result of data integrity verification passed), and if the test user data is incomplete type data, the corresponding data integrity verification result is verification failed (more specifically, the verification value 0 can be used to indicate the result of data integrity verification failed). Moreover, the total number of data items in the test user data set is also known, and the total number of first results of the data integrity verification result corresponding to the incomplete type data is also known. The second data proportion value is determined by the ratio of the total number of first results to the total number of data items in the test user data set.

[0066] When the first data proportion value is equal to the second data proportion value, it means that the user data integrity verification model can correctly verify all the test user data corresponding to the incomplete type in the test user data set, and the first preset value (such as 1) is used as the second evaluation result. When the first data proportion value is not equal to the second data proportion value, it means that the user data integrity verification model cannot correctly verify all the test user data corresponding to the incomplete type in the test user data set, and the second preset value (such as 0) is used as the second evaluation result. It can be seen that through the above method, the second dimension evaluation result related to the user data integrity verification in the application software data to be evaluated is obtained.

[0067] S140, obtaining an anti-attack capability parameter set corresponding to the application software data to be evaluated, and obtaining a third evaluation result corresponding to the anti-attack capability parameter set based on a pre-trained second classification model.

[0068] In this embodiment, after the application software data to be evaluated is obtained in the trusted execution environment of the server, it can also be parsed to obtain the anti-attack capability parameter set included therein. For example, the security development toolkit installation information, injection attack protection strategy deployment information, cross-site scripting attack protection strategy deployment information, and cross-site request forgery protection strategy deployment information obtained from the application software data to be evaluated can constitute the anti-attack capability parameter set, and then the information in the anti-attack capability parameter set is tested to see if the data is null value information, thereby obtaining the third evaluation result. It can be seen that by inputting the anti-attack capability parameter set into the second classification model, the third dimension evaluation result related to the application software data to be evaluated can be quickly obtained.

[0069] In one embodiment, if Figure 5 As shown, step S140 includes:

[0070] S141, obtaining security development toolkit installation information from the application software data to be evaluated, injection attack protection strategy deployment information, cross-site scripting attack protection strategy deployment information and cross-site request forgery protection strategy deployment information to form the anti-attack capability parameter set;

[0071] S142, obtaining installation and deployment detection results corresponding to the security development toolkit installation information, injection attack protection policy deployment information, cross-site scripting attack protection policy deployment information, and cross-site request forgery protection policy deployment information, respectively, to form an installation and deployment detection result set;

[0072] S143: Input the installation and deployment detection result set into the second classification model to obtain the third evaluation result.

[0073] In this embodiment, the application software data to be evaluated includes multiple folders, among which a folder stores security development toolkit installation information (such as security development toolkit installation information stored in SDK files), injection attack protection policy deployment information (such as injection attack protection policy deployment information stored in SQL script files), cross-site scripting attack protection policy deployment information (such as injection attack protection policy deployment information stored in XSS files) and cross-site request forgery protection policy deployment information (such as cross-site request forgery protection policy deployment information stored in CSRF files). Therefore, the security development toolkit installation information, injection attack protection policy deployment information, cross-site scripting attack protection policy deployment information and cross-site request forgery protection policy deployment information are located and obtained based on the folder name or file suffix name, and it is determined whether the above four types of information are null value information to respectively determine the installation and deployment detection results, thereby forming the installation and deployment detection result set. For example, if the security development toolkit installation information is located based on the folder name or file suffix name and is not an empty value, the corresponding first installation and deployment detection result is a first preset value (such as 1); when the security development toolkit installation information is an empty value, the corresponding first installation and deployment detection result is a second preset value (such as 0); the second installation and deployment detection result corresponding to the injection attack protection policy deployment information, the third installation and deployment detection result corresponding to the cross-site scripting attack protection policy deployment information, and the fourth installation and deployment detection result corresponding to the cross-site request forgery protection policy deployment information are also the process of obtaining the first installation and deployment detection result of the reference security development toolkit installation information.

[0074] Finally, the second comprehensive input parameter is formed in the order of the first installation and deployment detection result to the fourth installation and deployment detection result and input into the second classification model. For example, the second classification model can specifically adopt a random forest model to obtain the second evaluation result. It can be seen that through the above method, the third dimension evaluation result related to the anti-attack capability performance in the application software data to be evaluated is obtained.

[0075] S150: Obtain an automatic recovery service capability test set corresponding to the application software data to be evaluated, and perform a recoverability test of the software to be evaluated based on the automatic recovery service capability test set to obtain a fourth evaluation result.

[0076] In this embodiment, after the application software data to be evaluated is obtained in the trusted execution environment of the server, an automatic recovery service capability test set can also be generated in real time in the trusted execution environment of the server. The scenario of the software being attacked is simulated by the automatic recovery service capability test set, and then the recovery time required for the software to be evaluated to restore normal service and the total number of recovery strategies executed in restoring normal service are detected, thereby forming the recoverability test results of the evaluated software. Finally, the recoverability test results are compared with the preset standard recovery indicators to obtain the fourth evaluation result. It can be seen that by simulating the scenario of the software being attacked by the automatic recovery service capability test set, the fourth dimension evaluation result related to the application software data to be evaluated can be quickly obtained.

[0077] In one embodiment, if Figure 6 As shown, step S150 includes:

[0078] S151, obtaining the application software type corresponding to the application software data to be evaluated, and obtaining the corresponding automatic recovery service capability test set from a preset recovery service capability test set based on the application software type;

[0079] S152, automatically starting the application software to be evaluated corresponding to the application software data to be evaluated, and performing an automatic recovery service capability test on the application software to be evaluated based on the automatic recovery service capability test set to obtain a recovery duration and a total number of recovery strategy executions;

[0080] S153: If it is determined that the recovery time does not exceed the preset recovery time, and it is determined that the total number of executions of the recovery strategy does not exceed the preset total number of executions of the strategy, the first preset value is used as the fourth evaluation result;

[0081] S154: If it is determined that the recovery time exceeds the preset recovery time, or if it is determined that the total number of recovery strategy executions exceeds the preset total number of strategy executions, the second preset value is used as the fourth evaluation result.

[0082] In this embodiment, for example, after the application software type corresponding to the application software data to be evaluated is determined in the trusted execution environment of the server (such as instant messaging software, drawing software, system security protection software and other software types), the automatic recovery service capability test set corresponding to the application software type can be obtained in the preset recovery service capability test set to simulate the scenario of the software being attacked. At this time, it is necessary to first start the application software to be evaluated corresponding to the application software data to be evaluated in the trusted execution environment, and then simulate the attack on it with the automatic recovery service capability test set, and then detect the recovery time required for the software to be evaluated to restore normal service and the total number of recovery strategy executions. Finally, when it is determined that the recovery time does not exceed the preset recovery time, and when it is determined that the total number of recovery strategy executions does not exceed the preset total number of strategy executions, it means that the automatic recovery service capability of the application software to be evaluated is better, and the first preset value is used as the fourth evaluation result; when it is determined that the recovery time exceeds the preset recovery time, or when it is determined that the total number of recovery strategy executions exceeds the preset total number of strategy executions, it means that the automatic recovery service capability of the application software to be evaluated is weak, and the second preset value is used as the fourth evaluation result. It can be seen that through the above method, the fourth dimension evaluation results related to the automatic recovery service capability performance in the application software data to be evaluated are obtained.

[0083] S160. Determine a software information security assessment result corresponding to the application software data to be assessed based on the first assessment result, the second assessment result, the third assessment result, the fourth assessment result and a preset comprehensive assessment model.

[0084] In this embodiment, after at least the above four evaluation results are obtained in the server, the four evaluation results can be input into the preset comprehensive evaluation model for calculation to obtain the software information security evaluation result corresponding to the application software data to be evaluated. For example, the preset comprehensive evaluation model is a weighted summation model, and the weight values ​​are respectively preset for the above four evaluation results in the weighted summation model (this weight value can be flexibly adjusted according to actual needs), and the above four evaluation results are input into the weighted summation model for weighted summation to obtain the software information security evaluation result. Of course, the preset comprehensive evaluation model is only one embodiment, and other models can also be used to determine the software information security evaluation result corresponding to the above evaluation result.

[0085] In one embodiment, before step S160, the method further includes:

[0086] Obtaining an access control data set corresponding to the application software data to be evaluated, and determining a fifth evaluation result corresponding to the access control data set based on a pre-imported access control policy knowledge graph;

[0087] Obtain a historical attacked data set corresponding to the application software data to be evaluated, determine an attacked prediction result corresponding to the historical attacked data set based on a pre-trained prediction model, and determine a sixth evaluation result based on a null value judgment result corresponding to the attacked prediction result.

[0088] In this embodiment, of course, the access control data set used to limit the access rights of various types of users can also be obtained from the application software data to be evaluated, and the access roles and access rights included in the access control data set are evaluated in combination with the pre-imported access control policy knowledge graph to obtain the fifth evaluation result. For example, the access roles include administrators, ordinary users, and authorized users, and the access rights corresponding to each of the above access roles are consistent with the access rights obtained by querying the access control policy knowledge graph, then the first preset value is used as the fifth evaluation result; if the access rights corresponding to one of the above access roles are inconsistent with the access rights obtained by querying the access control policy knowledge graph, then the second preset value is used as the fifth evaluation result.

[0089] Similarly, if a historical attacked data set corresponding to the application software data to be evaluated can be obtained, the historical attacked data in the historical attacked data set can be comprehensively analyzed, for example, the attack type, attack occurrence time and corresponding attack duration included in each historical attacked data set can be obtained, and input into a prediction model (such as a BP neural network) as input data to obtain an attack prediction result corresponding to the historical attacked data set, and determine a sixth evaluation result based on a null value judgment result corresponding to the attacked prediction result (when the attacked prediction result corresponds to a null value, the second preset value is used as the sixth evaluation result, and when the attacked prediction result does not correspond to a null value, the first preset value is used as the sixth evaluation result).

[0090] In one embodiment, if Figure 7 As shown, step S160 includes:

[0091] S161, obtaining an evaluation result input vector consisting of the first evaluation result, the second evaluation result, the third evaluation result, the fourth evaluation result, the fifth evaluation result and the sixth evaluation result;

[0092] S162. Acquire a deep neural network corresponding to the preset comprehensive evaluation model, and obtain the software information security evaluation result corresponding to the application software data to be evaluated.

[0093] In this embodiment, a deep neural network can be specifically used as a preset comprehensive evaluation model, and an evaluation result input vector composed of the first evaluation result, the second evaluation result, the third evaluation result, the fourth evaluation result, the fifth evaluation result and the sixth evaluation result can be input into the deep neural network to quickly obtain the software information security evaluation result and display it as a visual display data.

[0094] It can be seen that the implementation of the above method embodiment can quickly obtain the application software data to be evaluated, and automatically test and evaluate from multiple dimensions such as user data confidentiality, user data integrity verification, anti-attack capability and automatic recovery service capability, so as to quickly and intelligently determine the final evaluation result.

[0095] The embodiment of the present invention also provides a software information security assessment device based on artificial intelligence, such as Figure 1 and Figure 8 As shown, the software information security assessment device based on artificial intelligence is used to execute any embodiment of the software information security assessment method based on artificial intelligence. Figure 8 , Figure 8 A schematic block diagram of an artificial intelligence-based software information security assessment device provided in an embodiment of the present invention.

[0096] like Figure 8 As shown, the software information security assessment device 100 based on artificial intelligence includes:

[0097] The to-be-evaluated application software data acquisition unit 110 is used to acquire the to-be-evaluated application software data corresponding to the evaluation instruction in response to the evaluation instruction;

[0098] A first result acquisition unit 120 is used to acquire a user data confidentiality parameter set corresponding to the application software data to be evaluated, and acquire a first evaluation result corresponding to the user data confidentiality parameter set based on a pre-trained first classification model;

[0099] The second result acquisition unit 130 is used to acquire a user data integrity verification model corresponding to the application software data to be evaluated, and acquire a second evaluation result corresponding to the user data integrity verification model based on a pre-generated test user data set;

[0100] A third result acquisition unit 140 is used to acquire an anti-attack capability parameter set corresponding to the application software data to be evaluated, and acquire a third evaluation result corresponding to the anti-attack capability parameter set based on a pre-trained second classification model;

[0101] The fourth result acquisition unit 150 is used to acquire an automatic recovery service capability test set corresponding to the application software data to be evaluated, and perform a recoverability test of the software to be evaluated based on the automatic recovery service capability test set to obtain a fourth evaluation result;

[0102] The security assessment result acquisition unit 160 is used to determine the software information security assessment result corresponding to the application software data to be assessed based on the first assessment result, the second assessment result, the third assessment result, the fourth assessment result and a preset comprehensive assessment model.

[0103] It should be noted that technical personnel in the relevant field can clearly understand that the specific implementation process of the above-mentioned artificial intelligence-based software information security assessment device 100 and each unit can refer to the corresponding description in the aforementioned method embodiment, and for the convenience and conciseness of the description, it will not be repeated here.

[0104] It can be seen that the implementation of the above-mentioned device embodiment can quickly obtain the application software data to be evaluated, and automatically test and evaluate from multiple dimensions such as user data confidentiality, user data integrity verification, anti-attack capability and automatic recovery service capability, so as to quickly and intelligently determine the final evaluation result.

[0105] The above-mentioned software information security assessment device based on artificial intelligence can be implemented in the form of a computer program, and the computer program can be used in Fig. 9 Runs on the computer device shown.

[0106] See also Fig. 9 , Fig. 9 is a schematic block diagram of a computer device provided by an embodiment of the present invention. The computer device may be a controller for executing a software information security assessment method based on artificial intelligence to intelligently control a gas stove.

[0107] See also Fig. 9 The computer device 500 includes a processor 502 , a memory and a network interface 505 connected via a communication bus 501 , wherein the memory may include a storage medium 503 and an internal memory 504 .

[0108] The storage medium 503 may store an operating system 5031 and a computer program 5032. When the computer program 5032 is executed, the processor 502 may execute a software information security assessment method based on artificial intelligence, wherein the storage medium 503 may be a volatile storage medium or a non-volatile storage medium.

[0109] The processor 502 is used to provide computing and control capabilities to support the operation of the entire computer device 500 .

[0110] The internal memory 504 provides an environment for the operation of the computer program 5032 in the storage medium 503. When the computer program 5032 is executed by the processor 502, the processor 502 can execute the software information security assessment method based on artificial intelligence.

[0111] The network interface 505 is used for network communication, such as providing data information transmission, etc. Those skilled in the art will understand that Fig. 9 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present invention, and does not constitute a limitation on the computer device 500 to which the solution of the present invention is applied. The specific computer device 500 may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0112] The processor 502 is used to run a computer program 5032 stored in the memory to implement the corresponding functions in the above-mentioned artificial intelligence-based software information security assessment method.

[0113] Those skilled in the art will understand that Fig. 9 The embodiments of the computer device shown in the figure do not constitute a limitation on the specific composition of the computer device. In other embodiments, the computer device may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently. For example, in some embodiments, the computer device may only include a memory and a processor. In such embodiments, the structure and function of the memory and the processor are the same as those of the embodiment of the present invention. Fig. 9 The embodiments shown are consistent and will not be described again here.

[0114] It should be understood that in the embodiment of the present invention, the processor 502 may be a central processing unit (CPU), and the processor 502 may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Among them, the general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0115] In another embodiment of the present invention, a computer-readable storage medium is provided. The computer-readable storage medium may be a volatile or non-volatile computer-readable storage medium. The computer-readable storage medium stores a computer program, wherein when the computer program is executed by a processor, the steps included in the above-mentioned artificial intelligence-based software information security assessment method are implemented.

[0116] Those skilled in the art can clearly understand that, for the convenience and simplicity of description, the specific working process of the above-described equipment, devices and units can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here. Those of ordinary skill in the art can appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented with electronic hardware, computer software or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to the function. Whether these functions are executed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the present invention.

[0117] In the several embodiments provided by the present invention, it should be understood that the disclosed equipment, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. Units with the same function may also be combined into one unit. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interfaces, devices or units, or may be an electrical, mechanical or other form of connection.

[0118] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the embodiments of the present invention.

[0119] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0120] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a computer-readable storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned computer-readable storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), disk or optical disk and other media that can store program codes.

[0121] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed by the present invention, and these modifications or replacements should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A software information security assessment method based on artificial intelligence, characterized in that: include: In response to the evaluation instruction, acquiring the application software data to be evaluated corresponding to the evaluation instruction; Obtaining a user data confidentiality parameter set corresponding to the application software data to be evaluated, and obtaining a first evaluation result corresponding to the user data confidentiality parameter set based on a pre-trained first classification model; Acquire a user data integrity verification model corresponding to the application software data to be evaluated, and acquire a second evaluation result corresponding to the user data integrity verification model based on a pre-generated test user data set; Acquire an anti-attack capability parameter set corresponding to the application software data to be evaluated, and acquire a third evaluation result corresponding to the anti-attack capability parameter set based on a pre-trained second classification model; Acquire an automatic recovery service capability test set corresponding to the application software data to be evaluated, and perform a recoverability test of the software to be evaluated based on the automatic recovery service capability test set to obtain a fourth evaluation result; Determine a software information security assessment result corresponding to the application software data to be assessed based on the first assessment result, the second assessment result, the third assessment result, the fourth assessment result and a preset comprehensive assessment model; The step of obtaining an automatic recovery service capability test set corresponding to the application software data to be evaluated, and performing a recoverability test of the software to be evaluated based on the automatic recovery service capability test set to obtain a fourth evaluation result includes: Acquire the application software type corresponding to the application software data to be evaluated, and acquire the corresponding automatic recovery service capability test set from a preset recovery service capability test set based on the application software type; Automatically start the application software to be evaluated corresponding to the application software data to be evaluated, and perform an automatic recovery service capability test on the application software to be evaluated based on the automatic recovery service capability test set to obtain a recovery duration and a total number of recovery strategy executions; If it is determined that the recovery time does not exceed the preset recovery time, and it is determined that the total number of executions of the recovery strategy does not exceed the preset total number of executions of the strategy, the first preset value is used as the fourth evaluation result; If it is determined that the recovery time exceeds the preset recovery time, or if it is determined that the total number of recovery strategy executions exceeds the preset total number of strategy executions, the second preset value is used as the fourth evaluation result.

2. The method according to claim 1, characterized in that Before determining the software information security assessment result corresponding to the application software data to be assessed based on the first assessment result, the second assessment result, the first assessment result, the fourth assessment result and the preset comprehensive assessment model, the method further includes: Obtaining an access control data set corresponding to the application software data to be evaluated, and determining a fifth evaluation result corresponding to the access control data set based on a pre-imported access control policy knowledge graph; Obtain a historical attacked data set corresponding to the application software data to be evaluated, determine an attacked prediction result corresponding to the historical attacked data set based on a pre-trained prediction model, and determine a sixth evaluation result based on a null value judgment result corresponding to the attacked prediction result.

3. The method according to claim 2, characterized in that The determining, based on the first evaluation result, the second evaluation result, the third evaluation result, the fourth evaluation result and a preset comprehensive evaluation model, a software information security evaluation result corresponding to the application software data to be evaluated includes: Obtaining an evaluation result input vector consisting of the first evaluation result, the second evaluation result, the third evaluation result, the fourth evaluation result, the fifth evaluation result, and the sixth evaluation result; A deep neural network corresponding to the preset comprehensive evaluation model is obtained to obtain the software information security evaluation result corresponding to the application software data to be evaluated.

4. The method according to claim 1, characterized in that: The step of obtaining a user data confidentiality parameter set corresponding to the application software data to be evaluated, and obtaining a first evaluation result corresponding to the user data confidentiality parameter set based on a pre-trained first classification model, includes: Based on the keyword recognition model, user data usage notification information, user data encryption model and data sharing protocol are obtained from the application software data to be evaluated to form the user data confidentiality parameter set; Acquire the data collection scope, data storage area and data sharing scope of the user data usage notification information based on keyword recognition, and determine parameter mapping values ​​corresponding to the data collection scope, the data storage area and the data sharing scope respectively based on a first preset mapping relationship to form a first parameter set; Based on keyword recognition, a user data encryption model name and a corresponding user data encryption model data packet in the user data encryption model are obtained; based on a second preset mapping relationship, a model mapping value corresponding to the user data encryption model name is determined; based on an empty data packet judgment result of the user data encryption model data packet, a model data check value is determined; and a second parameter set is formed by the model mapping value and the model data check value; Based on keyword recognition, a sharing protocol name and corresponding sharing protocol text data in the data sharing protocol are obtained; based on a third preset mapping relationship, a protocol mapping value corresponding to the sharing protocol name is determined; based on an empty file judgment result of the sharing protocol text data, a protocol data check value is determined; and a third parameter set is composed of the protocol mapping value and the protocol data check value; The first parameter set, the second parameter set and the third parameter set form a first comprehensive input parameter, and the first comprehensive input parameter is input into the first classification model to obtain the first evaluation result.

5. The method according to claim 1, characterized in that The obtaining, based on a pre-generated test user data set, a second evaluation result corresponding to the user data integrity verification model comprises: Obtaining a first data proportion value corresponding to incomplete type test user data in the test user data set; Inputting the test user data set into the user data integrity verification model to perform data integrity verification to obtain a data integrity verification result set; wherein each test user data in the test user data set corresponds to one of the data integrity verification results in the data integrity verification result set; Obtain a second data proportion value corresponding to the incomplete type data in the data integrity check result set; If it is determined that the second data proportion value is equal to the first data proportion value, the first preset value is used as the second evaluation result; If it is determined that the second data proportion value is not equal to the first data proportion value, a second preset value is used as the second evaluation result.

6. The method according to claim 1, characterized in that The step of obtaining an anti-attack capability parameter set corresponding to the application software data to be evaluated, and obtaining a third evaluation result corresponding to the anti-attack capability parameter set based on a pre-trained second classification model, includes: Acquire security development toolkit installation information, injection attack protection strategy deployment information, cross-site scripting attack protection strategy deployment information and cross-site request forgery protection strategy deployment information from the application software data to be evaluated, so as to form the anti-attack capability parameter set; Obtaining installation and deployment detection results corresponding to the security development toolkit installation information, injection attack protection policy deployment information, cross-site scripting attack protection policy deployment information, and cross-site request forgery protection policy deployment information, respectively, to form an installation and deployment detection result set; The installation and deployment detection result set is input into the second classification model to obtain the third evaluation result.

7. A software information security assessment device based on artificial intelligence, characterized in that: include: The to-be-evaluated application software data acquisition unit is used to, in response to the evaluation instruction, acquire the to-be-evaluated application software data corresponding to the evaluation instruction; A first result acquisition unit, configured to acquire a user data confidentiality parameter set corresponding to the application software data to be evaluated, and to acquire a first evaluation result corresponding to the user data confidentiality parameter set based on a pre-trained first classification model; A second result acquisition unit, configured to acquire a user data integrity verification model corresponding to the application software data to be evaluated, and acquire a second evaluation result corresponding to the user data integrity verification model based on a pre-generated test user data set; A third result acquisition unit, used to acquire an anti-attack capability parameter set corresponding to the application software data to be evaluated, and acquire a third evaluation result corresponding to the anti-attack capability parameter set based on a pre-trained second classification model; A fourth result acquisition unit, configured to acquire an automatic recovery service capability test set corresponding to the application software data to be evaluated, and perform a recoverability test of the software to be evaluated based on the automatic recovery service capability test set to obtain a fourth evaluation result; A security assessment result acquisition unit, configured to determine a software information security assessment result corresponding to the application software data to be assessed based on the first assessment result, the second assessment result, the third assessment result, the fourth assessment result and a preset comprehensive assessment model; The step of obtaining an automatic recovery service capability test set corresponding to the application software data to be evaluated, and performing a recoverability test of the software to be evaluated based on the automatic recovery service capability test set to obtain a fourth evaluation result includes: Acquire the application software type corresponding to the application software data to be evaluated, and acquire the corresponding automatic recovery service capability test set from a preset recovery service capability test set based on the application software type; Automatically start the application software to be evaluated corresponding to the application software data to be evaluated, and perform an automatic recovery service capability test on the application software to be evaluated based on the automatic recovery service capability test set to obtain a recovery duration and a total number of recovery strategy executions; If it is determined that the recovery time does not exceed the preset recovery time, and it is determined that the total number of executions of the recovery strategy does not exceed the preset total number of executions of the strategy, the first preset value is used as the fourth evaluation result; If it is determined that the recovery time exceeds the preset recovery time, or if it is determined that the total number of recovery strategy executions exceeds the preset total number of strategy executions, the second preset value is used as the fourth evaluation result.

8. A computer device, characterized in that: The computer device includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus; Memory, used to store computer programs; The processor is used to implement the steps of the software information security assessment method based on artificial intelligence described in any one of claims 1 to 6 when executing the program stored in the memory.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the software information security assessment method based on artificial intelligence as described in any one of claims 1 to 6 are implemented.

Images