A server security risk assessment system and method based on big data

Abstract

The present invention discloses a server security risk assessment system and method based on big data, which specifically include: obtaining server IP data and server port data, obtaining a master node server through threshold screening and calculation; configuring an isolated assessment environment for the master node server and performing backup and loading a monitoring application; establishing an assessment test account and a test virtual machine, performing a security risk pre-judgment test on the master node server to obtain a security risk pre-judgment test result, and obtaining an assessment result or continuing the assessment based on the security risk pre-judgment test result; if continuing the assessment, performing a first category security risk test on the master node server to obtain first feedback data and second feedback data; performing a backup and recovery on the master node server, and performing a second category security risk test on third feedback data, fourth feedback data and fifth feedback data; calculating to obtain a server security risk score, and obtaining a server security risk assessment result based on the server security risk score.

Description

Technical Field

[0001] The present invention relates to the technical field of network information security, and in particular to a server security risk assessment system and method based on big data. Background Art

[0002] In recent years, with the rapid development of information technologies such as cloud computing, artificial intelligence, and the Internet of Things, as well as the increasing popularity of Internet applications, the demand for data storage and processing in various industries has continued to increase. Among them, servers, as core devices for data storage and processing, have also seen a continuous increase in the number of applications year by year. As the cyber attack threats faced by servers become increasingly complex, server security risks have gradually become an issue that cannot be ignored.

[0003] At present, the Chinese invention patent with application number CN202410881093.7 discloses a server security risk identification method and system based on deep learning. The invention specifically includes: first, based on the server operation log data and network traffic data of all historical unit time periods, apply the K-means clustering algorithm to obtain multiple cluster centers, then for each center, determine the corresponding risk type according to the corresponding server security risk type labeling results of all belonging time periods, and then for various types, import the positive and negative sample data obtained based on the corresponding center and the non-corresponding center into the deep learning model for model training, and identify the confidence that the server security risk type labeling result of the current unit time period is the corresponding type, and finally, when it is found that a certain type corresponding to the maximum confidence is a risky type, start executing the alarm action and server security policy corresponding to the risky type to avoid false alarms or improper security policy execution. However, the deep learning model of the invention is only trained through inherent risk types, lacks the ability to reasonably deal with emerging risks and unknown risks, and its adaptability to the current ever-changing security risk environment needs to be improved. Summary of the invention

[0004] The technical problem solved by the present invention is that the existing technology is often trained according to specific inherent risk types and vulnerabilities, lacks the ability to reasonably deal with new and unknown risks, and is insufficiently adaptable to the current rapidly changing security risk environment.

[0005] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0006] A server security risk assessment method based on big data, comprising:

[0007] Step S1, obtaining the server log data and historical traffic data of the server to be evaluated within the evaluation time range and extracting the obtained server IP data and server port data, and obtaining the master node server through threshold screening calculation;

[0008] Step S2, configuring an isolated evaluation environment for the master node server, backing up the initial state of the master node server, isolating the operating environment of the master node server through inner container isolation processing, outer virtual LAN port policy setting and outer access control list setting, and loading a monitoring application on the master node server to obtain status monitoring data;

[0009] Step S3, establishing an assessment test account and a test virtual machine, performing a security risk pre-judgment test on the master node server, and continuing the server security risk assessment based on the security risk pre-judgment test result or stopping the server security risk assessment and outputting the server security risk assessment result as high risk;

[0010] Step S4, performing a first category security risk test on the master node server, sending preset malicious XSS script data and malicious SQL statement data through a test virtual machine that remains in a started state, and obtaining first feedback data and second feedback data respectively;

[0011] Step S5, performing a second category security risk test on the master node server, performing rollback based on the initial state backup of the master node server, starting all test virtual machines, sending query requests and computationally intensive task requests to the corresponding master node server, connecting flooding algorithm data streams and buffering test data packets, and obtaining third feedback data, fourth feedback data, and fifth feedback data respectively;

[0012] Step S6, calculate the server security risk score based on the security risk pre-judgment test results, the first feedback data, the second feedback data, the third feedback data, the fourth feedback data and the fifth feedback data, and obtain the server security risk assessment result based on the server security risk score: including high risk, medium risk and low risk.

[0013] As a preferred solution of the server security risk assessment method based on big data described in the present invention, wherein: the server log data includes access and response logs, application logs, error logs and database logs;

[0014] The historical traffic data includes traffic between servers, traffic between subnets, inbound traffic and outbound traffic;

[0015] Analyze and extract server log data and historical traffic data to obtain server IP data and server port data. Based on the server IP data, calculate the total IP traffic, abnormal traffic percentage and number of IP connections. Based on the server port data, calculate the port traffic percentage data and dynamic port association data.

[0016] The master node server is obtained by threshold screening of total IP traffic, abnormal traffic ratio, number of IP connections, port traffic ratio data and dynamic port association data.

[0017] As a preferred solution of the server security risk assessment method based on big data described in the present invention, the calculation logic of the abnormal traffic proportion includes: calculating the average IP traffic within the evaluation time through the server IP data, calculating the standard deviation data group based on the server IP data and the IP average traffic within the evaluation time, comparing the standard deviation data group with the fluctuation threshold, judging the moment greater than the fluctuation threshold in the standard deviation data group as the abnormal traffic moment, summarizing the abnormal traffic moments to obtain the total abnormal traffic time, and calculating the abnormal traffic proportion through the total abnormal traffic time;

[0018] The logic of threshold screening for abnormal traffic ratio includes: calculating the IP characteristic value by weighted calculation of the total IP traffic, abnormal traffic ratio and the number of IP connections, comparing the IP characteristic value with the first master node threshold, and when the IP characteristic value is greater than the first master node threshold, determining that the server corresponding to the IP characteristic value is the master node server;

[0019] The calculation logic for threshold screening of port traffic proportion data includes: comparing the port traffic proportion of all servers with the second master node threshold, and when the port traffic proportion is greater than the second master node threshold, determining that the server corresponding to the port traffic proportion is the master node server;

[0020] The calculation logic for threshold screening of dynamic port association data includes: obtaining the pointing address of the dynamic port based on the dynamic port association data statistics, comparing the number of dynamic ports pointing to the same address with the third master node threshold, and when the number of dynamic ports pointing to the same address is greater than the third master node threshold, determining that the server corresponding to the pointing address is a master node server;

[0021] The calculation expression of abnormal traffic ratio and IP characteristic value is:

[0022] ;

[0023] ;

[0024] in, Indicates the proportion of abnormal traffic. represents the total time of abnormal traffic, T represents the evaluation time, Indicates the IP characteristic value. Indicates the total IP traffic weight. Indicates the total IP traffic. Indicates the total IP traffic reference volume. Indicates the weight of abnormal traffic proportion, Indicates the reference amount of abnormal traffic ratio. Indicates the weight of the number of IP connections. Indicates the number of IP connections. Indicates the reference quantity of IP connections.

[0025] As a preferred solution of the server security risk assessment method based on big data described in the present invention, the configuration of the isolated assessment environment includes: performing an initial state backup on the master node server, performing inner-layer containerized isolation processing on the master node server, performing outer-layer virtual LAN port policy setting and outer-layer access control list setting after completing the inner-layer containerized isolation processing, and completing the isolation of the operating environment of the master node server;

[0026] The monitoring application is loaded on the server that has completed the isolation evaluation environment configuration, and the master node server is monitored and recorded to obtain status monitoring data, which includes: network traffic monitoring data, process monitoring data and log monitoring data.

[0027] As a preferred solution of the server security risk assessment method based on big data described in the present invention, wherein: an assessment test account is established, the same number of test virtual machines as the number of master node servers are opened for the assessment test account, and each test virtual machine is connected to each master node server respectively;

[0028] The security risk pre-judgment test for the master node server includes: sending a connection status identification request to each master node server in turn through a test virtual machine, keeping the test virtual machine in a startup state when it is identified that the master node server corresponding to the test virtual machine has other terminal connections, shutting down the test virtual machine when it is identified that the master node server corresponding to the test virtual machine has no other terminal connections, repeating the operation until all master node servers are traversed, and obtaining a security risk pre-judgment test result based on the status monitoring data analysis;

[0029] The security risk pre-judgment test results include: identifying abnormal account features and truncating, identifying abnormal account features and alerting, and unidentified abnormal account features;

[0030] When the security risk pre-judgment test result outputs that no abnormal account features are identified, the server security risk assessment is stopped and the server security risk assessment result is output as high risk;

[0031] When the security risk pre-judgment test results are output as identifying abnormal account characteristics and truncation, identifying abnormal account characteristics and alarming, continue to conduct server security risk assessment.

[0032] As a preferred solution of the server security risk assessment method based on big data described in the present invention, wherein: a first category security risk test is performed on the master node server, preset malicious XSS script data is sent to the master node server respectively by keeping the test virtual machine in the startup state, and first feedback data is obtained based on the state monitoring data extraction;

[0033] By keeping the test virtual machines in the startup state, preset malicious SQL statement data is sent to the master node server respectively, and the second feedback data is obtained based on the state monitoring data extraction;

[0034] The first feedback data includes the total number of malicious XSS script data received by the master node server and stored in the database;

[0035] The second feedback data includes the total number of malicious SQL statement data received by the master node server and stored in the database.

[0036] As a preferred solution of the server security risk assessment method based on big data described in the present invention, wherein: the second category security risk test is performed on the master node server, the master node server is backed up and all test virtual machines are started;

[0037] The test virtual machine sends query requests and computationally intensive task requests to each corresponding master node server respectively, and obtains third feedback data based on state monitoring data extraction;

[0038] Perform DDOS test on the master node server by connecting the first-level intensity data stream, the second-level intensity data stream and the third-level intensity data stream generated by the flooding algorithm, and obtain fourth feedback data based on the state monitoring data extraction;

[0039] Performing a buffer overflow attack on the master node server through a test virtual machine, generating a corresponding buffer test data packet based on the buffer size of the master node server, including a first buffer test data packet, a second buffer test data packet and a third buffer test data packet, sending the buffer test data packet to the master node server, and obtaining fifth feedback data based on the state monitoring data extraction;

[0040] The third feedback data includes the query result data feedback rate and the CPU peak occupancy rate;

[0041] The fourth feedback data includes a data stream strength index and a corresponding packet loss rate and bandwidth utilization rate;

[0042] The fifth feedback data includes a buffer test data packet index and a corresponding average memory occupancy rate and an average CPU occupancy rate.

[0043] As a preferred solution of a server security risk assessment method based on big data described in the present invention, wherein: a server security risk score is calculated based on the security risk pre-judgment test result, the first feedback data, the second feedback data, the third feedback data, the fourth feedback data and the fifth feedback data, and a server security risk assessment result is obtained based on a comparison interval table of the server security risk score and the risk level;

[0044] The server security risk assessment results include high risk, medium risk and low risk;

[0045] The logic of obtaining the server security risk assessment result based on the server security risk score and the risk level comparison interval table includes: when the server security risk score belongs to the first interval in the risk level comparison interval table, outputting the server security risk assessment result as low risk;

[0046] When the server security risk score belongs to the second interval in the risk level comparison interval table, the output server security risk assessment result is medium risk;

[0047] When the server security risk score belongs to the third interval in the risk level comparison interval table, the server security risk assessment result is output as high risk;

[0048] The calculation expression of the server security risk score is:

[0049] ;

[0050] in, Indicates the server security risk score. Indicates the score weight of the security risk pre-judgment test result, Indicates the score of the security risk pre-judgment test result. represents the logarithmic function with base 10, represents the first feedback data weight, Indicates the total number of malicious XSS scripts received by the master node server and stored in the database. represents the second feedback data weight, Indicates the total number of malicious SQL statements received by the master node server and stored in the database. represents the third feedback data weight, Indicates the query result data feedback rate, Indicates the peak CPU usage. represents the fourth feedback data weight, m ​​represents the data stream strength index, Indicates the packet loss rate, Indicates bandwidth utilization. represents the fifth feedback data weight, n represents the buffer test data packet index, Indicates the average memory usage, Indicates the average CPU usage.

[0051] A server security risk assessment system based on big data, comprising: a data acquisition module, a server management module, a security risk assessment module and a system terminal module;

[0052] The data collection module includes a log data collection unit, a flow data collection unit and a data extraction unit;

[0053] The log data collection unit is used to obtain the access and response logs, application logs, error logs and database logs of the server to be evaluated within the evaluation time range;

[0054] The traffic data collection unit is used to collect traffic data between servers, traffic between subnets, inbound traffic, and outbound traffic;

[0055] The data extraction unit is used to extract server IP data and server port data from server log data and historical traffic data, and calculate the total IP traffic, abnormal traffic ratio, IP connection number, port traffic ratio data and dynamic port association data;

[0056] The server management module includes a master node server unit, an isolation configuration unit, a backup unit and a monitoring unit;

[0057] The master node server unit is used to perform threshold screening calculation based on server IP data and server port data to determine the master node server;

[0058] The isolation configuration unit is used to configure an isolation evaluation environment for the master node server through inner-layer containerized isolation processing, outer-layer virtual LAN port policy settings, and outer-layer access control list settings;

[0059] The backup unit is used to perform initial status backup of the master node server;

[0060] The monitoring unit is used to load the monitoring application to the master node server and record the status monitoring data;

[0061] The safety risk assessment module includes a pre-judgment test unit, a safety risk test unit and an assessment result output unit;

[0062] The pre-judgment test unit is used to establish an assessment test account and a test virtual machine, determine the start and stop of the test virtual machine based on the terminal connection status of the master node server, obtain the security risk pre-judgment test result based on the monitoring data of the master node server, continue the server security risk assessment based on the security risk pre-judgment test result, or stop the server security risk assessment and output the server security risk assessment result as high risk;

[0063] The security risk testing unit is used to perform the first category test and the second category test on the master node server, obtain the first feedback data and the second feedback data by sending preset malicious XSS script data and malicious SQL statement data through the test virtual machine that keeps the startup state, perform rollback based on the initial state backup of the master node server, start all the test virtual machines, send query requests and computing-intensive task requests to the master node server, connect the flooding algorithm data stream and the buffer test data packet, and obtain the third feedback data, the fourth feedback data and the fifth feedback data;

[0064] The assessment result output unit is used to calculate the server security risk score based on the security risk pre-judgment test result, the first feedback data, the second feedback data, the third feedback data, the fourth feedback data and the fifth feedback data, and obtain the server security risk assessment result based on the server security risk score;

[0065] The system terminal module includes a human-computer interaction unit and a display unit;

[0066] The human-computer interaction unit is used to receive user operation instructions, allowing the user to set parameters of the data acquisition module, the server management module and the security risk assessment module;

[0067] The display unit is used to provide a display interface for users, and to display the real-time progress and output results of the server security risk assessment to customers through a visual interface.

[0068] The beneficial effects of the present invention are as follows: big data analysis is performed based on the historical logs and historical traffic of the server, and threshold screening is used to avoid considering the direction of the transmission link and establishing a complete structural topology diagram. The main node servers with large transmission traffic and many port associations are screened out for testing to replace the security risk testing of all servers, thereby effectively reducing the computational complexity. The main node server is isolated from other servers by configuring an isolated evaluation environment, which is beneficial to preventing the spread of attacks and ensuring the stability of the test environment. Pre-judgment testing of security risks on the main node server is beneficial to examining the basic security performance of the server and improving evaluation efficiency. Replacing vulnerability detection with comprehensive simulated attacks is beneficial to dynamically evaluating the actual security performance of the server and discovering potential risks and unknown vulnerabilities of the server. By calculating the security risk score of the server, it is beneficial to quantify the degree of security risk of the server and obtain accurate and intuitive server security risk assessment results. BRIEF DESCRIPTION OF THE DRAWINGS

[0069] Figure 1 A basic flow chart of a server security risk assessment method based on big data provided by an embodiment of the present invention;

[0070] Figure 2A schematic diagram of the framework of a server security risk assessment system based on big data provided for one embodiment of the present invention. DETAILED DESCRIPTION

[0071] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings. It is obvious that the described embodiments are only part of the embodiments of the present invention, but not all of the embodiments.

[0072] Example 1, reference Figure 1 , is an embodiment of the present invention, and provides a server security risk assessment method based on big data, comprising:

[0073] Step S1, obtaining the server log data and historical traffic data of the server to be evaluated within the evaluation time range and extracting the obtained server IP data and server port data, and obtaining the master node server through threshold screening calculation;

[0074] Step S2, configuring an isolated evaluation environment for the master node server, backing up the initial state of the master node server, isolating the operating environment of the master node server through inner container isolation processing, outer virtual LAN port policy setting and outer access control list setting, and loading a monitoring application on the master node server to obtain status monitoring data;

[0075] Step S3, establishing an assessment test account and a test virtual machine, performing a security risk pre-judgment test on the master node server, continuing the server security risk assessment based on the security risk pre-judgment test result, or stopping the server security risk assessment and outputting the server security risk assessment result as high risk;

[0076] Step S4, performing a first category security risk test on the master node server, sending preset malicious XSS script data and malicious SQL statement data through a test virtual machine that remains in a started state, and obtaining first feedback data and second feedback data respectively;

[0077] Step S5, performing a second category security risk test on the master node server, performing rollback based on the initial state backup of the master node server, starting all test virtual machines, sending query requests and computationally intensive task requests to the corresponding master node server, connecting flooding algorithm data streams and buffering test data packets, and obtaining third feedback data, fourth feedback data, and fifth feedback data respectively;

[0078] Step S6, calculate the server security risk score based on the security risk pre-judgment test results, the first feedback data, the second feedback data, the third feedback data, the fourth feedback data and the fifth feedback data, and obtain the server security risk assessment result based on the server security risk score: including high risk, medium risk and low risk.

[0079] In this embodiment, the server log data includes access and response logs, application logs, error logs and database logs;

[0080] The historical traffic data includes traffic between servers, traffic between subnets, inbound traffic and outbound traffic;

[0081] Analyze and extract server log data and historical traffic data to obtain server IP data and server port data. Based on the server IP data, calculate the total IP traffic, abnormal traffic percentage and number of IP connections. Based on the server port data, calculate the port traffic percentage data and dynamic port association data.

[0082] The master node server is obtained by threshold screening of total IP traffic, abnormal traffic ratio, number of IP connections, port traffic ratio data and dynamic port association data.

[0083] Among them, servers with large transmission traffic and many port associations are obtained through threshold screening, which avoids considering the direction of the transmission link and establishing a complete structural topology diagram, reduces the complexity of data processing, and is conducive to quickly screening out the main node servers required for security risk assessment from the servers.

[0084] In this embodiment, the calculation logic of the abnormal traffic proportion includes: calculating the average IP traffic within the evaluation time through the server IP data, calculating the standard deviation data group based on the server IP data and the average IP traffic within the evaluation time, comparing the standard deviation data group with the fluctuation threshold, judging the moment greater than the fluctuation threshold in the standard deviation data group as the abnormal traffic moment, summarizing the abnormal traffic moments to obtain the total abnormal traffic time, and calculating the abnormal traffic proportion through the total abnormal traffic time;

[0085] The logic of threshold screening for abnormal traffic ratio includes: calculating the IP characteristic value by weighted calculation of the total IP traffic, abnormal traffic ratio and the number of IP connections, comparing the IP characteristic value with the first master node threshold, and when the IP characteristic value is greater than the first master node threshold, determining that the server corresponding to the IP characteristic value is the master node server;

[0086] The calculation logic for threshold screening of port traffic proportion data includes: comparing the port traffic proportion of all servers with the second master node threshold, and when the port traffic proportion is greater than the second master node threshold, determining that the server corresponding to the port traffic proportion is the master node server;

[0087] The calculation logic for threshold screening of dynamic port association data includes: obtaining the pointing address of the dynamic port based on the dynamic port association data statistics, comparing the number of dynamic ports pointing to the same address with the third master node threshold, and when the number of dynamic ports pointing to the same address is greater than the third master node threshold, determining that the server corresponding to the pointing address is a master node server;

[0088] The calculation expressions for abnormal traffic ratio and IP characteristic value are as follows:

[0089] ;

[0090] ;

[0091] in, Indicates the proportion of abnormal traffic. represents the total time of abnormal traffic, T represents the evaluation time, Indicates the IP characteristic value. Indicates the total IP traffic weight. Indicates the total IP traffic. Indicates the total IP traffic reference volume. Indicates the weight of abnormal traffic proportion, Indicates the reference amount of abnormal traffic ratio. Indicates the weight of the number of IP connections. Indicates the number of IP connections. Indicates the reference quantity of IP connections.

[0092] In this embodiment, the configuration of the isolated evaluation environment includes: performing an initial state backup on the master node server, performing inner containerized isolation processing on the master node server, and performing outer virtual LAN port policy setting and outer access control list setting after completing the inner containerized isolation processing, thereby completing the isolation of the operating environment of the master node server;

[0093] The monitoring application is loaded on the server that has completed the isolation evaluation environment configuration, and the master node server is monitored and recorded to obtain status monitoring data, which includes: network traffic monitoring data, process monitoring data and log monitoring data.

[0094] Among them, by configuring an isolated evaluation environment to isolate the master node server from other servers, it is helpful to prevent the spread of attacks and ensure the stability of the test environment.

[0095] In this embodiment, an evaluation test account is established, and the same number of test virtual machines as the master node servers are opened for the evaluation test account, and each test virtual machine is connected to each master node server respectively;

[0096] The security risk pre-judgment test for the master node server includes: sending a connection status identification request to each master node server in turn through a test virtual machine, keeping the test virtual machine in a startup state when it is identified that the master node server corresponding to the test virtual machine has other terminal connections, shutting down the test virtual machine when it is identified that the master node server corresponding to the test virtual machine has no other terminal connections, repeating the operation until all master node servers are traversed, and obtaining a security risk pre-judgment test result based on the status monitoring data analysis;

[0097] The security risk pre-judgment test results include: identifying abnormal account features and truncating, identifying abnormal account features and alerting, and unidentified abnormal account features;

[0098] When the security risk pre-judgment test result outputs that no abnormal account features are identified, the server security risk assessment is stopped and the server security risk assessment result is output as high risk;

[0099] When the security risk pre-judgment test results are output as identifying abnormal account characteristics and truncation, identifying abnormal account characteristics and alarming, continue to conduct server security risk assessment.

[0100] Among them, when conducting a security risk pre-judgment test on the master node server, a single account opens a large number of virtual machines and opens and closes them according to the server's connection status, which is a classic attack account feature. Continuing the server security risk assessment based on the security risk pre-judgment test results, or directly stopping the server security risk assessment and outputting the assessment result as high risk, is conducive to examining the basic security performance of the server and improving the assessment efficiency.

[0101] In this embodiment, a first category security risk test is performed on the master node server, and preset malicious XSS script data is sent to the master node server by keeping the test virtual machine in the startup state, and the first feedback data is obtained based on the state monitoring data extraction;

[0102] By keeping the test virtual machines in the startup state, preset malicious SQL statement data is sent to the master node server respectively, and the second feedback data is obtained based on the state monitoring data extraction;

[0103] The first feedback data includes the total number of malicious XSS script data received by the master node server and stored in the database;

[0104] The second feedback data includes the total number of malicious SQL statement data received by the master node server and stored in the database.

[0105] In this embodiment, the second category security risk test is performed on the master node server, the master node server is backed up and all test virtual machines are started;

[0106] The test virtual machine sends query requests and computationally intensive task requests to each corresponding master node server respectively, and obtains third feedback data based on state monitoring data extraction;

[0107] Perform DDOS test on the master node server by connecting the first-level intensity data stream, the second-level intensity data stream and the third-level intensity data stream generated by the flooding algorithm, and obtain fourth feedback data based on the state monitoring data extraction;

[0108] Performing a buffer overflow attack on the master node server through a test virtual machine, generating a corresponding buffer test data packet based on the buffer size of the master node server, including a first buffer test data packet, a second buffer test data packet and a third buffer test data packet, sending the buffer test data packet to the master node server, and obtaining fifth feedback data based on the state monitoring data extraction;

[0109] The third feedback data includes the query result data feedback rate and the CPU peak occupancy rate;

[0110] The fourth feedback data includes a data stream strength index and a corresponding packet loss rate and bandwidth utilization rate;

[0111] The fifth feedback data includes a buffer test data packet index and a corresponding average memory occupancy rate and an average CPU occupancy rate.

[0112] Among them, the second category of security risk testing simulates attacks on the server itself, and the first category of security risk testing simulates attacks on accounts connected to the server. Replacing vulnerability detection with comprehensive simulated attacks is conducive to dynamically evaluating the actual security performance of the server and discovering potential risks and unknown vulnerabilities of the server.

[0113] In this embodiment, a server security risk score is calculated based on the security risk pre-judgment test result, the first feedback data, the second feedback data, the third feedback data, the fourth feedback data, and the fifth feedback data, and a server security risk assessment result is obtained based on the server security risk score and the risk level comparison interval table;

[0114] The server security risk assessment results include high risk, medium risk and low risk;

[0115] The calculation expression of the server security risk score is:

[0116] ;

[0117] in, Indicates the server security risk score. Indicates the score weight of the security risk pre-judgment test result, Indicates the score of the security risk pre-judgment test result. represents the logarithmic function with base 10, represents the first feedback data weight, Indicates the total number of malicious XSS scripts received by the master node server and stored in the database. represents the second feedback data weight, Indicates the total number of malicious SQL statements received by the master node server and stored in the database. represents the third feedback data weight, Indicates the query result data feedback rate, Indicates the peak CPU usage. represents the fourth feedback data weight, m ​​represents the data stream strength index, Indicates the packet loss rate, Indicates bandwidth utilization. represents the fifth feedback data weight, n represents the buffer test data packet index, Indicates the average memory usage, Indicates the average CPU usage.

[0118] The logic of obtaining the server security risk assessment result based on the server security risk score and the risk level comparison interval table includes: when the server security risk score belongs to the first interval in the risk level comparison interval table, outputting the server security risk assessment result as low risk;

[0119] When the server security risk score belongs to the second interval in the risk level comparison interval table, the output server security risk assessment result is medium risk;

[0120] When the server security risk score belongs to the third interval in the risk level comparison interval table, the server security risk assessment result is output as high risk;

[0121] Among them, calculating the security risk score of the server is helpful to quantify the degree of security risk of the server and obtain accurate and intuitive server security risk assessment results.

[0122] Example 2, reference Figure 2 , as another embodiment of the present invention, provides a server security risk assessment system based on big data, including: a data acquisition module, a server management module, a security risk assessment module and a system terminal module.

[0123] The data collection module includes a log data collection unit, a flow data collection unit and a data extraction unit;

[0124] The log data collection unit is used to obtain the access and response logs, application logs, error logs and database logs of the server to be evaluated within the evaluation time range;

[0125] The traffic data collection unit is used to collect traffic data between servers, traffic between subnets, inbound traffic, and outbound traffic;

[0126] The data extraction unit is used to extract server IP data and server port data from server log data and historical traffic data, and calculate the total IP traffic, abnormal traffic ratio, IP connection number, port traffic ratio data and dynamic port association data;

[0127] The server management module includes a master node server unit, an isolation configuration unit, a backup unit and a monitoring unit;

[0128] The master node server unit is used to perform threshold screening calculation based on server IP data and server port data to determine the master node server;

[0129] The isolation configuration unit is used to configure an isolation evaluation environment for the master node server through inner-layer containerized isolation processing, outer-layer virtual LAN port policy settings, and outer-layer access control list settings;

[0130] The backup unit is used to perform initial status backup of the master node server;

[0131] The monitoring unit is used to load the monitoring application to the master node server and record the status monitoring data;

[0132] The safety risk assessment module includes a pre-judgment test unit, a safety risk test unit and an assessment result output unit;

[0133] The pre-judgment test unit is used to establish an assessment test account and a test virtual machine, determine the start and stop of the test virtual machine based on the terminal connection status of the master node server, obtain the security risk pre-judgment test result based on the monitoring data of the master node server, continue the server security risk assessment based on the security risk pre-judgment test result, or stop the server security risk assessment and output the server security risk assessment result as high risk;

[0134] The security risk testing unit is used to perform the first category test and the second category test on the master node server, obtain the first feedback data and the second feedback data by sending preset malicious XSS script data and malicious SQL statement data through the test virtual machine that keeps the startup state, perform rollback based on the initial state backup of the master node server, start all the test virtual machines, send query requests and computing-intensive task requests to the master node server, connect the flooding algorithm data stream and the buffer test data packet, and obtain the third feedback data, the fourth feedback data and the fifth feedback data;

[0135] The assessment result output unit is used to calculate the server security risk score based on the security risk pre-judgment test result, the first feedback data, the second feedback data, the third feedback data, the fourth feedback data and the fifth feedback data, and obtain the server security risk assessment result based on the server security risk score;

[0136] The system terminal module includes a human-computer interaction unit and a display unit;

[0137] The human-computer interaction unit is used to receive user operation instructions, allowing the user to set parameters of the data acquisition module, the server management module and the security risk assessment module;

[0138] The display unit is used to provide a display interface for users, and displays the real-time progress and output results of the server security risk assessment to customers through a visual interface.

[0139] It should be understood by those skilled in the art that the embodiments of the present invention may provide methods, systems or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media containing computer-usable program codes. Among them, the storage medium may be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (Static Random Access Memory, referred to as SRAM), electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, referred to as EEPROM), erasable programmable read-only memory (Erasable Programmable Read Only Memory, referred to as EPROM), programmable read-only memory (Programmable Red-Only Memory, referred to as PROM), read-only memory (Read-Only Memory, referred to as ROM), magnetic memory, flash memory, magnetic disk or optical disk. These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0140] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A server security risk assessment method based on big data, characterized in that: include: Step S1, obtaining the server log data and historical traffic data of the server to be evaluated within the evaluation time range and extracting the obtained server IP data and server port data, and obtaining the master node server through threshold screening calculation; Step S2, configuring an isolated evaluation environment for the master node server, backing up the initial state of the master node server, isolating the operating environment of the master node server through inner container isolation processing, outer virtual LAN port policy setting and outer access control list setting, and loading a monitoring application on the master node server to obtain status monitoring data; Step S3, establishing an assessment test account and a test virtual machine, performing a security risk pre-judgment test on the master node server, and continuing the server security risk assessment based on the security risk pre-judgment test result or stopping the server security risk assessment and outputting the server security risk assessment result as high risk; Step S4, performing a first category security risk test on the master node server, sending preset malicious XSS script data and malicious SQL statement data through a test virtual machine that remains in a started state, and obtaining first feedback data and second feedback data respectively; Step S5, performing a second category security risk test on the master node server, performing rollback based on the initial state backup of the master node server, starting all test virtual machines, sending query requests and computationally intensive task requests to the corresponding master node server, connecting flooding algorithm data streams and buffering test data packets, and obtaining third feedback data, fourth feedback data, and fifth feedback data respectively; Step S6, calculate the server security risk score based on the security risk pre-judgment test results, the first feedback data, the second feedback data, the third feedback data, the fourth feedback data and the fifth feedback data, and obtain the server security risk assessment result based on the server security risk score, and the server security risk assessment result includes high risk, medium risk and low risk.

2. A server security risk assessment method based on big data as claimed in claim 1, characterized in that: The server log data includes access and response logs, application logs, error logs and database logs; The historical traffic data includes traffic between servers, traffic between subnets, inbound traffic and outbound traffic; Analyze and extract server log data and historical traffic data to obtain server IP data and server port data. Based on the server IP data, calculate the total IP traffic, abnormal traffic percentage and number of IP connections. Based on the server port data, calculate the port traffic percentage data and dynamic port association data. The master node server is obtained by threshold screening of total IP traffic, abnormal traffic ratio, number of IP connections, port traffic ratio data and dynamic port association data.

3. A server security risk assessment method based on big data as claimed in claim 2, characterized in that: The calculation logic of the abnormal traffic proportion includes: calculating the average IP traffic within the evaluation time through the server IP data, calculating the standard deviation data group based on the server IP data and the average IP traffic within the evaluation time, comparing the standard deviation data group with the fluctuation threshold, judging the moment greater than the fluctuation threshold in the standard deviation data group as the abnormal traffic moment, summarizing the abnormal traffic moments to obtain the total abnormal traffic time, and calculating the abnormal traffic proportion through the total abnormal traffic time; The logic of threshold screening for abnormal traffic ratio includes: calculating the IP characteristic value by weighted calculation of the total IP traffic, abnormal traffic ratio and the number of IP connections, comparing the IP characteristic value with the first master node threshold, and when the IP characteristic value is greater than the first master node threshold, determining that the server corresponding to the IP characteristic value is the master node server; The calculation logic for threshold screening of port traffic proportion data includes: comparing the port traffic proportion of all servers with the second master node threshold, and when the port traffic proportion is greater than the second master node threshold, determining that the server corresponding to the port traffic proportion is the master node server; The calculation logic for threshold screening of dynamic port association data includes: obtaining the pointing address of the dynamic port based on the dynamic port association data statistics, comparing the number of dynamic ports pointing to the same address with the third master node threshold, and when the number of dynamic ports pointing to the same address is greater than the third master node threshold, determining that the server corresponding to the pointing address is a master node server; The calculation expression of abnormal traffic ratio and IP characteristic value is: ； ； in, Indicates the abnormal traffic ratio. represents the total time of abnormal traffic, T represents the evaluation time, Indicates the IP characteristic value. Indicates the total IP traffic weight. Indicates the total IP traffic. Indicates the total IP traffic reference volume. Indicates the weight of abnormal traffic proportion, Indicates the reference amount of abnormal traffic ratio. Indicates the weight of the number of IP connections. Indicates the number of IP connections. Indicates the reference quantity of IP connections.

4. The server security risk assessment method based on big data as claimed in claim 1, characterized in that: The configuration of the isolated evaluation environment includes: performing an initial state backup of the master node server, performing an inner layer containerized isolation process on the master node server, performing an outer layer virtual LAN port policy setting and an outer layer access control list setting after completing the inner layer containerized isolation process, and completing the isolation of the operating environment of the master node server; The monitoring application is loaded on the server that has completed the isolation evaluation environment configuration, and the master node server is monitored and recorded to obtain status monitoring data, which includes: network traffic monitoring data, process monitoring data and log monitoring data.

5. The server security risk assessment method based on big data as claimed in claim 1, characterized in that: Create an evaluation test account, open the same number of test virtual machines as the master node servers for the evaluation test account, and connect each test virtual machine to each master node server respectively; The security risk pre-judgment test for the master node server includes: sending a connection status identification request to each master node server in turn through a test virtual machine, keeping the test virtual machine in a startup state when it is identified that the master node server corresponding to the test virtual machine has other terminal connections, shutting down the test virtual machine when it is identified that the master node server corresponding to the test virtual machine has no other terminal connections, repeating the operation until all master node servers are traversed, and obtaining a security risk pre-judgment test result based on the status monitoring data analysis; The security risk pre-judgment test results include: identifying abnormal account features and truncating, identifying abnormal account features and alerting, and unidentified abnormal account features; When the security risk pre-judgment test result outputs that no abnormal account features are identified, the server security risk assessment is stopped and the server security risk assessment result is output as high risk; When the security risk pre-judgment test results are output as identifying abnormal account characteristics and truncation, identifying abnormal account characteristics and alarming, continue to conduct server security risk assessment.

6. A server security risk assessment method based on big data as claimed in claim 1, characterized in that: Perform a first category security risk test on the master node server, send preset malicious XSS script data to the master node server through the test virtual machine that remains in the startup state, and obtain first feedback data based on the state monitoring data extraction; By keeping the test virtual machines in the startup state, preset malicious SQL statement data is sent to the master node server respectively, and the second feedback data is obtained based on the state monitoring data extraction; The first feedback data includes the total number of malicious XSS script data received by the master node server and stored in the database; The second feedback data includes the total number of malicious SQL statement data received by the master node server and stored in the database.

7. The server security risk assessment method based on big data as claimed in claim 1, characterized in that: Conduct the second category security risk test on the master node server, back up the master node server and start all test virtual machines; The test virtual machine sends query requests and computationally intensive task requests to each corresponding master node server respectively, and obtains third feedback data based on state monitoring data extraction; Perform DDOS test on the master node server by connecting the first-level intensity data stream, the second-level intensity data stream and the third-level intensity data stream generated by the flooding algorithm, and obtain fourth feedback data based on the state monitoring data extraction; Performing a buffer overflow attack on the master node server through a test virtual machine, generating a corresponding buffer test data packet based on the buffer size of the master node server, including a first buffer test data packet, a second buffer test data packet and a third buffer test data packet, sending the buffer test data packet to the master node server, and obtaining fifth feedback data based on the state monitoring data extraction; The third feedback data includes the query result data feedback rate and the CPU peak occupancy rate; The fourth feedback data includes a data stream strength index and a corresponding packet loss rate and bandwidth utilization rate; The fifth feedback data includes a buffer test data packet index and a corresponding average memory occupancy rate and an average CPU occupancy rate.

8. The server security risk assessment method based on big data as claimed in claim 1, characterized in that: A server security risk score is calculated based on the security risk pre-judgment test result, the first feedback data, the second feedback data, the third feedback data, the fourth feedback data, and the fifth feedback data, and a server security risk assessment result is obtained based on the server security risk score and the risk level comparison interval table; The server security risk assessment results include high risk, medium risk and low risk; The logic of obtaining the server security risk assessment result based on the server security risk score and the risk level comparison interval table includes: when the server security risk score belongs to the first interval in the risk level comparison interval table, outputting the server security risk assessment result as low risk; When the server security risk score belongs to the second interval in the risk level comparison interval table, the output server security risk assessment result is medium risk; When the server security risk score belongs to the third interval in the risk level comparison interval table, the server security risk assessment result is output as high risk; The calculation expression of the server security risk score is: ； in, Indicates the server security risk score. Indicates the score weight of the security risk pre-judgment test result, Indicates the score of the security risk pre-judgment test result. represents the logarithmic function with base 10, represents the first feedback data weight, Indicates the total number of malicious XSS scripts received by the master node server and stored in the database. represents the second feedback data weight, Indicates the total number of malicious SQL statements received by the master node server and stored in the database. represents the third feedback data weight, Indicates the query result data feedback rate, Indicates the peak CPU usage. represents the fourth feedback data weight, m ​​represents the data stream strength index, Indicates the packet loss rate, Indicates bandwidth utilization. represents the fifth feedback data weight, n represents the buffer test data packet index, Indicates the average memory usage, Indicates the average CPU usage.

9. A server security risk assessment system based on big data, characterized in that: include: Data acquisition module, server management module, security risk assessment module and system terminal module; The data collection module includes a log data collection unit, a flow data collection unit and a data extraction unit; The log data collection unit is used to obtain the access and response logs, application logs, error logs and database logs of the server to be evaluated within the evaluation time range; The traffic data collection unit is used to collect traffic data between servers, traffic between subnets, inbound traffic, and outbound traffic; The data extraction unit is used to extract server IP data and server port data from server log data and historical traffic data, and calculate the total IP traffic, abnormal traffic ratio, IP connection number, port traffic ratio data and dynamic port association data; The server management module includes a master node server unit, an isolation configuration unit, a backup unit and a monitoring unit; The master node server unit is used to perform threshold screening calculation based on server IP data and server port data to determine the master node server; The isolation configuration unit is used to configure an isolation evaluation environment for the master node server through inner-layer containerized isolation processing, outer-layer virtual LAN port policy settings, and outer-layer access control list settings; The backup unit is used to perform initial status backup of the master node server; The monitoring unit is used to load the monitoring application to the master node server and record the status monitoring data; The safety risk assessment module includes a pre-judgment test unit, a safety risk test unit and an assessment result output unit; The pre-judgment test unit is used to establish an assessment test account and a test virtual machine, determine the start and stop of the test virtual machine based on the terminal connection status of the master node server, obtain the security risk pre-judgment test result based on the monitoring data of the master node server, continue the server security risk assessment based on the security risk pre-judgment test result, or stop the server security risk assessment and output the server security risk assessment result as high risk; The security risk testing unit is used to perform the first category test and the second category test on the master node server, obtain the first feedback data and the second feedback data by sending preset malicious XSS script data and malicious SQL statement data through the test virtual machine that keeps the startup state, perform rollback based on the initial state backup of the master node server, start all the test virtual machines, send query requests and computing-intensive task requests to the master node server, connect the flooding algorithm data stream and the buffer test data packet, and obtain the third feedback data, the fourth feedback data and the fifth feedback data; The assessment result output unit is used to calculate the server security risk score based on the security risk pre-judgment test result, the first feedback data, the second feedback data, the third feedback data, the fourth feedback data and the fifth feedback data, and obtain the server security risk assessment result based on the server security risk score; The system terminal module includes a human-computer interaction unit and a display unit; The human-computer interaction unit is used to receive user operation instructions, allowing the user to set parameters of the data acquisition module, the server management module and the security risk assessment module; The display unit is used to provide a display interface for users, and displays the real-time progress and output results of the server security risk assessment to customers through a visual interface.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the server security risk assessment method based on big data is implemented as described in any one of claims 1-8.

Images