A data asset security monitoring method

Abstract

The present invention discloses a data asset security monitoring method, which belongs to the field of network security technology, and includes the following steps: performing data asset detection, parsing returned data packets, and building a data asset information library; building an attack tree model based on the data asset information library, and calculating the risk value of each attack path in the attack tree model through a decision tree algorithm; and formulating a data asset monitoring strategy according to the risk value. The data asset security monitoring method provided by the present invention can realize data risk assessment for the power system, and at the same time realize the attack path risk assessment of the attack tree model network, and formulate a data asset monitoring strategy according to the risk assessment results, which can effectively solve the lag of data protection.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to a data asset security monitoring method. Background Art

[0002] In recent years, due to the rapid development of information technology and changes in the international environment, network security incidents have emerged one after another, and the security situation has become increasingly severe. Network attacks on power protection systems can pose a serious threat to people's production and life, as well as economic development, social stability, and national security.

[0003] Taking into account the stability of the power protection system, generally, the network security protection upgrade will not be performed within the system after the system is running. The vulnerabilities in the system cannot be dealt with in time, and the vulnerability library and virus library in the antivirus software cannot be updated in time. The existing boundary protection equipment, such as industrial firewalls, intrusion detection systems, industrial isolation network gates, etc., cannot completely isolate malicious attacks. Once they invade the system, the long-standing unprocessed risk points in the system will be easily exploited, leading to serious consequences.

[0004] In order to improve the network security level of the power protection system and solve the lag problem of existing protection methods, it is necessary to monitor the data asset security of the power protection system to timely discover and deal with risk points in the system before an attack occurs. Traditional network risk assessment methods are not fully applicable to power protection systems, and cannot predict the most risky attack paths and provide targeted protection. Summary of the invention

[0005] In order to solve the above technical problems, the present invention proposes a data asset security monitoring method to solve the problems of lag and inability to predict the most risky attack path existing in the existing protection methods of the above-mentioned prior art.

[0006] To achieve the above object, the present invention provides a data asset security monitoring method, comprising the following steps:

[0007] Conduct data asset detection, parse returned data packets, and build a data asset information database;

[0008] Building an attack tree model based on the data asset information library, and calculating the risk value of each attack path in the attack tree model through a decision tree algorithm;

[0009] Develop a data asset monitoring strategy based on the risk value.

[0010] Preferably, the method for constructing an attack tree model based on the data asset information library includes:

[0011] The data assets that need to be protected are taken as the root nodes of the tree;

[0012] Gather a data asset repository of information on system architecture, data flows, security measures, and potential vulnerabilities;

[0013] Determine an attack path based on the root node and the data asset information library;

[0014] The root node, attack path and attack means are represented by a graphical method to obtain the attack tree model.

[0015] Preferably, the attack means include but are not limited to data packet theft, identity theft and data tampering.

[0016] Preferably, the method for calculating the risk value of each attack path in the attack tree model includes:

[0017] Collect historical data and extract data features of historical data;

[0018] Building a decision tree model based on the data features of the historical data;

[0019] Calculate the success rate of each attack path based on the decision tree model, and evaluate the impact according to the potential impact of the attack path;

[0020] A risk value is calculated based on the success rate and the impact level.

[0021] Preferably, the method for constructing a decision tree model comprises:

[0022] The success rate and impact of the attack path are used as target variables;

[0023] Extracting data features that affect the target variable from the data features of the historical data to obtain a training set;

[0024] The initial decision tree model is trained using the training set to obtain a trained decision tree model.

[0025] Preferably, the method for extracting data features of historical data includes:

[0026] Perform zero mean processing on historical data to obtain a preprocessed data set;

[0027] Calculating the covariance matrix of the preprocessed data set, and solving the eigenvalues ​​and corresponding eigenvectors from the covariance matrix;

[0028] Sort the eigenvectors according to the size of the eigenvalues, and select the eigenvectors corresponding to the first n largest eigenvalues ​​as the principal components;

[0029] Project the historical data into a low-dimensional space composed of principal components to identify the data features of the historical data.

[0030] Preferably, the impact degree includes: the impact degree of obtaining sensitive information by intercepting data packets; the impact degree of attacking by stealing identity information; and the impact degree of modifying data without authorization.

[0031] Preferably, the risk value is calculated as follows:

[0032] G=S*I

[0033] In the formula, G represents the risk value, S represents the success rate, and I represents the impact degree.

[0034] Compared with the prior art, the present invention has the following advantages and technical effects:

[0035] The present invention discloses a data asset security monitoring method, which belongs to the field of network security technology, and includes the following steps: performing data asset detection, parsing returned data packets, and constructing a data asset information library; constructing an attack tree model based on the data asset information library, and calculating the risk value of each attack path in the attack tree model through a decision tree algorithm; and formulating a data asset monitoring strategy according to the risk value. The data asset security monitoring method provided by the present invention can realize data risk assessment for the power system, and at the same time realize the risk assessment of the attack path of the attack tree model network, and formulate a data asset monitoring strategy according to the risk assessment results, which can effectively solve the lag of data protection. And by calculating the risk value, the attack path with the highest risk can be predicted, providing basic conditions for further formulating protection strategies. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] The drawings constituting a part of the present application are used to provide a further understanding of the present application. The illustrative embodiments and descriptions of the present application are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0037] Figure 1 The figure is a flow chart of a method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0038] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0039] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here. Example

[0040] like Figure 1 As shown, this embodiment provides a data asset security monitoring method, including the following steps:

[0041] Conduct data asset detection, parse returned data packets, and build a data asset information database;

[0042] Building an attack tree model based on the data asset information library, and calculating the risk value of each attack path in the attack tree model through a decision tree algorithm;

[0043] Develop a data asset monitoring strategy based on the risk value.

[0044] Furthermore, the method for constructing an attack tree model based on the data asset information library includes:

[0045] Use the data assets that need to be protected as the root node of the tree: First, you need to identify and define the data assets that need to be protected and use them as the root node of the attack tree. This root node represents the security goal of the entire system, and all analysis is carried out around this goal.

[0046] Collect data asset information about system architecture, data flow, security measures and potential vulnerabilities: In this step, it is necessary to comprehensively collect and analyze the system architecture, data flow, implemented security measures and possible security vulnerabilities. This includes but is not limited to network topology, application interaction methods, data storage and transmission methods, user access rights, etc.

[0047] Determine the attack path based on the root node and data asset information base: Based on the collected information, analyze the possible attack vectors and the vulnerabilities that the attacker may exploit. The attack path is a series of steps that the attacker must go through in order to achieve the goal. This requires a deep understanding of the system's weaknesses and accurate predictions of the attacker's possible behavior patterns.

[0048] Representation by graphical method: Use graphical tools to represent the attack tree model and obtain the attack tree model. This includes the root node, various attack paths, and possible attack methods. Graphical representation helps to intuitively display the structure of the attack tree, so that non-professionals can also understand the security risks of the system.

[0049] And it is also possible to further refine the attack means, that is, further refine the possible attack means on the attack path. These means can be technical, such as exploiting software vulnerabilities and conducting denial of service attacks, etc.; they can also be non-technical, such as social engineering attacks. Evaluate the potential impact and possibility of each attack means.

[0050] Furthermore, the attack methods include but are not limited to data packet theft, identity theft and data tampering.

[0051] Furthermore, the method for calculating the risk value of each attack path in the attack tree model includes:

[0052] Collect historical data and extract data features of historical data;

[0053] Building a decision tree model based on the data features of the historical data;

[0054] Calculate the success rate of each attack path based on the decision tree model, and evaluate the impact according to the potential impact of the attack path;

[0055] A risk value is calculated based on the success rate and the impact level.

[0056] Furthermore, the method for constructing a decision tree model includes:

[0057] First, the success rate and impact of the attack path are clearly defined as target variables. The success rate refers to the probability that the attacker will successfully carry out the attack, while the impact refers to the degree of damage to the system after the attack is successful. These two variables can be determined through historical data and expert evaluation.

[0058] Extract key data features that affect the target variable from historical data. These features may include but are not limited to attack type, attack method, system vulnerability, effectiveness of security measures, user behavior patterns, etc. By analyzing these features, we can better understand the success rate and impact of the attack path.

[0059] The extracted data features and target variables are combined into a training set. The training set is a data set used to train the decision tree model. It contains a large number of instances, each of which contains features and corresponding target variable values.

[0060] Use the training set to train the initial decision tree model. Decision tree is a commonly used machine learning algorithm that predicts the value of the target variable by building a tree structure. During the training process, the model learns how to predict the success rate and impact of the attack path based on the input features.

[0061] After training is completed, the model is evaluated and optimized. Evaluation can be performed through methods such as cross-validation and confusion matrix to ensure the prediction accuracy and generalization ability of the model. Optimization can improve the performance of the model by adjusting model parameters and selecting different decision tree algorithms.

[0062] Apply the trained decision tree model to actual security risk assessment. The model can help predict the success rate and impact of different attack paths, thus providing a basis for the formulation of security strategies. At the same time, through feedback from actual applications, the model is continuously adjusted and optimized to make it more accurate and effective.

[0063] Furthermore, the method for extracting data features of historical data includes:

[0064] 1. Data preprocessing: Zero mean processing is performed on historical data, which means adjusting the data so that the mean of each dimension is 0. The specific operation is to subtract the mean of the corresponding dimension from each data point. The purpose of this centralization is to eliminate the mean of the data and ensure that the focus of PCA analysis is on the degree of dispersion of the data.

[0065] 2. Calculate the covariance matrix: Calculate the covariance matrix of the data set, which measures the correlation between different dimensions of the data. The covariance matrix helps to understand whether there is a linear relationship between the dimensions of the data, and is the basis for finding the principal components. The covariance of a dimension with itself is its variance, and the covariance between dimensions that are not in the same dimension indicates the strength of their linear relationship.

[0066] 3. Solve eigenvalues ​​and eigenvectors: Solve eigenvalues ​​and corresponding eigenvectors from the covariance matrix. Eigenvectors define new coordinate axes, and eigenvalues ​​indicate the degree of data dispersion on these new coordinate axes. The larger the eigenvalue, the greater the data variance in the direction of the corresponding eigenvector, that is, the data is more dispersed in this direction.

[0067] 4. Select the principal components and construct the projection matrix:

[0068] Select principal components: Sort the eigenvectors by eigenvalue and select the eigenvectors corresponding to the first n largest eigenvalues ​​as principal components. These principal components can retain the information in the data set to the greatest extent.

[0069] Construct projection matrix: Construct a projection matrix based on the selected eigenvectors. This matrix will be used to project the original data into a low-dimensional space.

[0070] 5. Apply the projection matrix for dimensionality reduction: Project the historical data into a low-dimensional space composed of principal components to obtain the data expression after dimensionality reduction, which is the data feature of the historical data. This step involves transforming the original data set using the projection matrix. The result is the mapping of the historical data in the new low-dimensional coordinate system, which obtains the data feature of the historical data.

[0071] Furthermore, the impact degree includes: the impact degree of obtaining sensitive information by intercepting data packets; the impact degree of attacking by stealing identity information; and the impact degree of modifying data without authorization.

[0072] Furthermore, the calculation expression of the risk value is:

[0073] G=S*I

[0074] In the formula, G represents the risk value, S represents the success rate, and I represents the impact degree.

[0075] The above are only preferred specific implementations of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A data asset security monitoring method, characterized in that: The following steps are involved: Conduct data asset detection, parse returned data packets, and build a data asset information database; Building an attack tree model based on the data asset information library, and calculating the risk value of each attack path in the attack tree model through a decision tree algorithm; The method for constructing an attack tree model based on the data asset information library includes: The data assets that need to be protected are taken as the root nodes of the tree; Gather a data asset repository of information on system architecture, data flows, security measures, and potential vulnerabilities; Determine an attack path based on the root node and the data asset information library; The root node, attack path and attack means are represented by a graphical method to obtain an attack tree model; The method for calculating the risk value of each attack path in the attack tree model includes: Collect historical data and extract data features of historical data; Building a decision tree model based on the data features of the historical data; Calculate the success rate of each attack path based on the decision tree model, and evaluate the impact according to the potential impact of the attack path; Calculating a risk value based on the success rate and impact level; The method for constructing a decision tree model comprises: The success rate and impact of the attack path are used as target variables; Extracting data features that affect the target variable from the data features of the historical data to obtain a training set; Training the initial decision tree model using the training set to obtain a trained decision tree model; Methods for extracting data features of historical data include: Perform zero mean processing on historical data to obtain a preprocessed data set; Calculating the covariance matrix of the preprocessed data set, and solving the eigenvalues ​​and corresponding eigenvectors from the covariance matrix; Sort the eigenvectors according to the size of the eigenvalues, and select the eigenvectors corresponding to the first n largest eigenvalues ​​as the principal components; Project the historical data into a low-dimensional space composed of principal components to obtain the data features of the historical data; Develop a data asset monitoring strategy based on the risk value.

2. The data asset security monitoring method according to claim 1, characterized in that: The attack methods include but are not limited to data packet theft, identity theft and data tampering.

3. The data asset security monitoring method according to claim 1, characterized in that: The impact levels include: the impact level of obtaining sensitive information by intercepting data packets; the impact level of attacking by stealing identity information; and the impact level of modifying data without authorization.

4. The data asset security monitoring method according to claim 1, characterized in that: The calculation expression of the risk value is: G=S*I; where G represents the risk value, S represents the success rate, and I represents the degree of impact.

Images