Information security management method and system

Abstract

The invention discloses an information security management method and system. The method comprises the following steps: acquiring code audit data, Web application firewall data and vulnerability management data; performing feature extraction on the same batch of code audit data, Web application firewall data and vulnerability management data to obtain structured feature vectors, and fusing the feature vectors into a feature matrix; constructing and training an anomaly detection model, and inputting a feature matrix into the anomaly detection model to obtain an anomaly score; and according to the abnormal score and a set threshold value, generating a corresponding security risk level, and sending the security risk level to a security operation module for display or alarm. According to the invention, the data of different sources are fused through the anomaly monitoring model, so that the deviation caused by a single data set is reduced, the detected abnormal point is more representative, the risk of false alarm is reduced, the accuracy of anomaly monitoring is improved, and the efficiency of safety management is improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of information security management, and in particular relates to an information security management method and system. Background Art

[0002] With the development of the Internet, information security is a core issue in today's Internet and information technology fields. Traditional information security management usually uses independent security vulnerability management systems, Web Application Firewalls (WAFs), static code auditing tools, and security operation systems. These tools are independent of each other and cannot be efficiently integrated and coordinated, resulting in slow response to security incidents and poor risk management results. In the existing technology, there is a lack of a comprehensive platform that can effectively integrate these functions to achieve comprehensive information security management.

[0003] The Chinese invention patent with publication number CN116050840A discloses an information security risk management method and management system. The method is based on tools such as code audit tools, web application firewalls, and vulnerability and threat statistics data tools, and includes the following steps: obtaining the target tasks of information security risk management; determining the information security risk management scope corresponding to the target tasks based on the target tasks; establishing an information security risk management assurance mechanism based on the target tasks and the information security risk management scope, clarifying the assurance measures for information security risk management and establishing information security risk management principles; determining information security risk management capability information based on the information security risk management assurance mechanism, the assurance measures for information security risk management and the information security risk management principles; performing information security risk management operations based on the information security risk capability information, which is used to solve the problem that the existing technology cannot comprehensively and accurately guide organizations to carry out information security risk management work to effectively respond to the ever-changing network security risks.

[0004] Since the code auditing tools, web application firewalls, vulnerability and threat statistics tools and other tools run independently, there is a problem of data isolation, which in turn affects the accuracy of security evaluation in the operation and maintenance system. Due to the isolation of data, it is often necessary to process the data of each subsystem separately for security management, which affects the efficiency of security management. Summary of the invention

[0005] The present invention provides an information security management method and system, aiming to solve the problems of low security evaluation accuracy and low security management efficiency caused by data isolation in the prior art.

[0006] In order to solve the above technical problems, the management method proposed by the present invention comprises the following steps: Obtain code audit data, web application firewall data, and vulnerability management data; Perform feature extraction on the same batch of code audit data, Web application firewall data, and vulnerability management data to obtain structured feature vectors, and fuse the feature vectors into a feature matrix; Constructing and training an anomaly detection model, and inputting a feature matrix into the anomaly detection model to obtain an anomaly score; According to the anomaly score and the set threshold, a corresponding security risk level is generated and sent to the security operation module for display or alarm.

[0007] Preferably, the feature vectors include a code audit feature vector, a firewall feature vector and a vulnerability management feature vector, wherein: The code audit feature vector further includes vulnerability type, vulnerability severity, number of affected code lines, code complexity, and comment density; The firewall feature vector further includes the requested URL structure, source IP reputation, response status code frequency, and potential attack behavior; The vulnerability management feature vector further includes CVSS score, the impact scope of the vulnerability, whether it has been fixed, and the difficulty of exploiting the vulnerability.

[0008] Preferably, the processing flow of the anomaly detection model is: Preprocessing the input feature matrix, the preprocessing includes data cleaning, feature encoding and standardization, the feature encoding uses One-Hot Encoding or Label Encoding to encode the category data and convert the category data into numerical form; Establish an isolation forest model, set the initial parameters of the model, set the number of trees in the forest to 150, set the expected outlier ratio to 0.1, and use historical data to train the isolation forest model; Use the trained isolation forest model to perform anomaly detection on the preprocessed feature matrix and generate anomaly scores.

[0009] Preferably, the processing flow of the anomaly detection model is: Preprocessing the input feature matrix, the preprocessing includes data cleaning, feature encoding and standardization, the feature encoding uses One-Hot Encoding or Label Encoding to encode the category data and convert the category data into numerical form; For a sample in the preprocessed feature matrix, calculate the distance between the sample and other samples, obtain the nearest k neighbors, and calculate the reachable distance from the sample to the neighbors; Calculate the local reachability density of a sample according to the reachability distance; The ratio of the local reachable density of the sample to the local reachable density of other samples in the k nearest neighbors is calculated as the anomaly score.

[0010] Preferably, the calculation method of the reachable distance is:

[0011] In the formula, It is a sample The reachable distance, is a sample of calculations, is one of the k nearest neighbors of the sample, It is a sample The distance to its kth nearest neighbor, It is a sample The Euclidean distance between .

[0012] Preferably, the local reachable density is calculated as follows:

[0013] In the formula, is a sample of calculations, is one of the k nearest neighbors of the sample, It is a sample The reachable distance, Representation sample The k-neighborhood of .

[0014] Preferably, the data sent to the security operation module for display or alarm also includes code defect data, and the method for obtaining the code defect data is: Use static analysis tools to scan the code and obtain vulnerability type, vulnerability severity, affected code location, file location, code complexity data, and associated developers from the code scan; Analyze the data obtained by static analysis tools to assess the severity of the data and the priority of repair; Generate risk assessment and repair suggestions for vulnerabilities based on set security rules; Integrate the data, severity, repair priority, risk assessment and repair suggestions obtained by static analysis tools to generate code defect data.

[0015] Preferably, the data sent to the security operation module for display or alarm also includes Web application firewall alarm data, and the method for obtaining the Web application firewall alarm data is: When the Web application firewall detects a potential attack, it acquires attack data in real time, including attack source, attack payload, triggered rule code, attack time, and attack type; Associating the attack data with the security vulnerability library. If the attack data uses a vulnerability in the security vulnerability library, generating protection suggestions based on the security vulnerability library and the corresponding attack data. For attack data that includes protection suggestions, the attack data and the corresponding protection suggestions are integrated to generate Web application firewall alarm data. Otherwise, the attack data is used as Web application firewall alarm data.

[0016] Preferably, the data sent to the security operation module for display or warning also includes vulnerability warning data, and the method for obtaining the vulnerability warning data is: Obtain a vulnerability list from the vulnerability response platform, wherein the vulnerability information recorded in the vulnerability list includes vulnerability number, vulnerability score, vulnerability risk level and repair suggestion; Vulnerability information that meets the preset vulnerability risk level is used as vulnerability warning data.

[0017] Accordingly, the present invention also proposes an information security management system, which includes a security operation module, a static code audit module, a Web application firewall module, a security vulnerability management module and a security brain module, for implementing the above-mentioned information security management method, wherein: The security operation module is used to summarize and visualize the code audit data of the static code audit module, the vulnerability data obtained from the security vulnerability management module, summarize and display the operation status of the WAF module, and receive and display the alarm information output by the security brain module; The static code audit module is used to manage and update the security rules for code scanning, scan and analyze the code based on the security rules for code scanning to identify and locate code security vulnerabilities, and send the code security vulnerability information to the security brain module; The Web Application Firewall module is used to manage firewall security rules, update protection strategies, and monitor Web application traffic in real time. It identifies and intercepts attack behaviors based on firewall security rules and protection strategies, and sends recorded Web logs to the Security Brain module. The security vulnerability management module is used to obtain vulnerability information from the vulnerability management tool, conduct risk assessment on the obtained vulnerability information, determine the priority of vulnerability repair and generate a repair plan, and send the obtained vulnerability information and corresponding risk assessment results to the security brain module; The security brain module is used to receive data from the static code audit module, Web application firewall module and security vulnerability management module, and send it to the security operation module after calculation and processing.

[0018] Compared with the prior art, the present invention has the following technical effects: 1. The information security management method proposed in the present invention fuses data from different sources through an anomaly monitoring model, which helps to reduce the deviation caused by a single data set, making the detected anomalies more representative, reducing the risk of false alarms, and improving the accuracy of anomaly monitoring. In addition, by integrating various subsystems, the data from each subsystem is fused and processed to avoid data isolation and improve the efficiency of security management.

[0019] 2. The information security management method proposed in the present invention can obtain a more complete security perspective by integrating static code auditing, WAF and vulnerability data. Static code auditing reveals potential code vulnerabilities, WAF logs reflect actual network attack attempts, and the vulnerability database provides an overall impact analysis of known vulnerabilities. This combination of multi-source data can more accurately identify potential security risks.

[0020] 3. The information security management method proposed in the present invention can issue an alarm before the potential risk accumulates to a certain level by setting a risk value threshold, which helps the enterprise security team to respond in time before the problem occurs.

[0021] 4. In the information security management method proposed in the present invention, since the WAF log and vulnerability data are dynamically updated, the system can realize real-time monitoring and risk assessment, and combine the static characteristics of static code auditing to realize an early warning mechanism that combines static and dynamic risks. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 It is a schematic diagram of the process of the safety management method of the present invention; Figure 2 It is a schematic diagram of the structure of the security management system described in an embodiment of the present invention. DETAILED DESCRIPTION

[0023] In order to make the objectives, technical solutions and advantages of the present invention more clear, the technical solutions of the present invention will be clearly and completely described below in combination with specific embodiments of the present application and with reference to the accompanying drawings.

[0024] Embodiment 1 An information security management method such as Figure 1 As shown, the steps include steps 1 to 4: Step 1: Obtain code audit data, Web Application Firewall (WAF) data, and vulnerability management data.

[0025] Specifically, code audit data mainly collects static analysis results from code scanning tools (such as SonarQube and Fortify) to extract the required data. Code audit data includes code vulnerability types (such as SQL injection, cross-site scripting, memory overflow, etc.), code vulnerability severity levels (such as high, medium, and low), affected files and lines, code complexity indicators (such as McCabe complexity), comment density and code line ratio, and developer information related to the vulnerability.

[0026] WAF data is extracted from WAF logs, including request URL, HTTP method, request header information, source IP address, IP geographic location, response status code (such as 403, 500, etc.), detected attack type (such as SQL injection, cross-site scripting attack) and request timestamp and frequency.

[0027] Vulnerability management data can be obtained from the public SRC (Security Response Center) vulnerability platform, including known vulnerability data (CVE, NVD, etc.), including vulnerability ID (such as CVE-xxxx-yyyy), vulnerability CVSS (Common Vulnerability Scoring System) score (quantifying risk from 0-10), vulnerability type and impact range, repair suggestions, and whether there are known exploit tools or patches. Common vulnerability management platforms include Alibaba Cloud's vulnerability platform, Baidu Security Emergency Response Center, 360SRC, etc. In one embodiment of the present invention, the latest vulnerability information is obtained from Alibaba Cloud's vulnerability platform through Alibaba Cloud's vulnerability management API.

[0028] Step 2: Extract features from the same batch of code audit data, Web application firewall data, and vulnerability management data to obtain structured feature vectors, and fuse the feature vectors into a feature matrix.

[0029] The feature vectors include code audit feature vectors, firewall feature vectors and vulnerability management feature vectors, where: The code audit feature vector further includes vulnerability type, vulnerability severity, number of affected code lines, code complexity, and comment density; The firewall feature vector further includes the requested URL structure, source IP reputation, response status code frequency, and potential attack behavior; The vulnerability management feature vector further includes CVSS score, the impact scope of the vulnerability, whether it has been fixed, and the difficulty of exploiting the vulnerability.

[0030] Each code audit result generates a feature vector, which contains features such as vulnerability type, severity, number of affected code lines, code complexity, etc. The following is an example of a feature vector extracted from code audit data: [Vulnerability type (SQL injection=1, XSS=0, buffer overflow=0), vulnerability severity=3, number of affected code lines=20, code complexity=15, comment density=0.5].

[0031] After WAF log data is aggregated, feature vectors are formed, such as request frequency, response code type, source IP reputation, etc. The following is an example of a feature vector extracted from Web Application Firewall data: [Request URL structure ( / login=1, / admin=0, / api=0), source IP reputation = 0.7, response status code (200=100 times, 403=10 times, 500=1 time), potential attack behavior (SQL injection=1, XSS=0)].

[0032] CVSS score, vulnerability type, repair status, exploitability, etc. in vulnerability management data can be used as features. The following is an example of feature vector extracted from vulnerability management data: [CVSS score = 8.7, impact range = whole system, has it been fixed = 0, difficulty of exploitation = 1].

[0033] All these features are fused into a unified feature matrix, where each row corresponds to a sample and each column is a specific feature. These samples can represent a code file, a log, or a vulnerability record, as shown below: [Vulnerability type (SQL injection=1, XSS=0, buffer overflow=0), vulnerability severity=3, affected code lines=20, code complexity=15, comment density=0.5, request URL structure( / login=1, / admin=0, / api=0), source IP reputation=0.7, response status code(200=100 times, 403=10 times, 500=1 time), potential attack behavior(SQL injection=1, XSS=0), CVSS score=8.7, impact range=whole system, whether fixed=0, vulnerability exploitation difficulty=1].

[0034] Step three: construct and train an anomaly detection model, and input a feature matrix into the anomaly detection model to obtain an anomaly score.

[0035] In one embodiment of the present invention, the anomaly detection model is an isolation forest algorithm model, and its processing flow is as follows: Preprocess the input feature matrix, including data cleaning, feature encoding and standardization. Data cleaning fills or cleans missing data. Feature encoding uses One-Hot Encoding or Label Encoding to encode category data and convert the category data into numerical form. Since the range of features is different (such as CVSS score from 0 to 10, code complexity from 0 to 20, and response code is a discrete value), we need to standardize the features. A common method is to use StandardScaler to transform each feature into a normal distribution with a mean of 0 and a standard deviation of 1. Standardization ensures that the weights of different features in the model are consistent. Establish an isolation forest model, set the initial parameters of the model, set the number of trees in the forest to 150, set the expected outlier ratio to 0.1, and use historical data to train the isolation forest model; Use the trained isolation forest model to detect anomalies on the preprocessed feature matrix and generate anomaly scores. After the model is trained, an anomaly score can be generated for each data point, usually in the range of [-1,1], where values ​​close to -1 indicate anomalies and values ​​close to 1 indicate normality. Therefore, different levels of alarm information can be set for output according to the size of the anomaly score output by the isolation forest.

[0036] In another embodiment of the present invention, the processing flow of the anomaly detection model is: Preprocess the input feature matrix, including data cleaning, feature encoding and standardization. Data cleaning fills or cleans missing data. Feature encoding uses One-Hot Encoding or Label Encoding to encode category data and convert the category data into numerical form. Since the range of features is different (such as CVSS score from 0 to 10, code complexity from 0 to 20, and response code is a discrete value), we need to standardize the features. A common method is to use StandardScaler to transform each feature into a normal distribution with a mean of 0 and a standard deviation of 1. Standardization ensures that the weights of different features in the model are consistent. For a sample in the preprocessed feature matrix, the distance between the sample and other samples is calculated, the nearest k neighbors are obtained, and the reachable distance from the sample to the neighbors is calculated; k here represents the domain size, which is a hyperparameter and usually needs to be set in advance. In this embodiment, the value of k can be set between 10-20, which is specifically set according to the requirements of calculation speed and calculation accuracy.

[0037] Calculate the local reachability density of a sample according to the reachability distance; The ratio of the local reachable density of the sample to the local reachable density of other samples in the k nearest neighbors is calculated as the anomaly score.

[0038] Specifically, the calculation method of the reachable distance is:

[0039] In the formula, It is a sample The reachable distance, is a sample of calculations, is one of the k nearest neighbors of the sample, It is a sample The distance to its kth nearest neighbor, It is a sample The Euclidean distance between .

[0040] The calculation method of the local reachable density is:

[0041] In the formula, is a sample of calculations, is one of the k nearest neighbors of the sample, It is a sample The reachable distance, Representation sample The k-neighborhood of .

[0042] The calculation method of the abnormal score is:

[0043] In the formula, A sample for calculation The ratio of the local reachability density of to the local reachability density of other points in its k-neighborhood, A sample for calculation The local reachable density of For the sample One of the k nearest neighbors The local reachable density of Representation sample k-neighborhood. When it is close to 1, it means that the density of the point is similar to the density of the neighborhood and it is a normal point. When it is much larger than 1, it means that the local density of the point is lower than its neighborhood density and it is an outlier. The value sets different levels of alarm information to be output.

[0044] Step 4: Generate a corresponding security risk level based on the anomaly score and the set threshold, and send it to the security operation module for display or alarm.

[0045] In other embodiments of the present invention, the data sent to the security operation module for display or alarm also includes code defect data, and the method for obtaining the code defect data is: Use static analysis tools to scan the code and obtain vulnerability type, vulnerability severity, affected code location, file location, code complexity data, and associated developers from the code scan; Analyze the data obtained by static analysis tools to assess the severity of the data and the priority of repair; Generate risk assessment and repair suggestions for vulnerabilities based on set security rules; Integrate the data, severity, repair priority, risk assessment and repair suggestions obtained by static analysis tools to generate code defect data.

[0046] Specifically, the processing of the above code defect data is completed by the static code audit module. The functions of the static code audit module include: managing and updating the security rules of code scanning to ensure the accuracy and timeliness of the rules and adapt to the latest security threats; providing scheduled and manual scanning functions, in-depth analysis of the code, identifying and locating potential security vulnerabilities, and timely preventing security risks; generating detailed scanning result statistical reports to comprehensively display the security status of the code and help the development team make data-driven decisions; conducting centralized analysis of the discovered security defects, generating specific vulnerability items, and pushing them to the vulnerability management module for unified tracking and repair.

[0047] The implementation method of the static code audit module is as follows: vulnerability information obtained from code scanning, including vulnerability number, vulnerability type, number of affected code lines, associated developer information, etc.; attack IP, attack payload, triggered WAF rule code, etc. obtained from the WAF module; vulnerability repair status and historical vulnerability information obtained from the vulnerability management module; multi-source data analysis of the security brain to generate attack predictions, warnings, and decision-making suggestions. Analyze the obtained vulnerability data, evaluate the severity and repair priority of the vulnerability through the security brain model; aggregate the vulnerability data and generate a detailed statistical report, including vulnerability type distribution, risk assessment, repair suggestions, etc., to provide guidance for the development team and security team; generate targeted repair suggestions based on the analysis results of the security brain model, and push them to the vulnerability management module to optimize the repair process.

[0048] In other embodiments of the present invention, the data sent to the security operation module for display or alarm also includes Web application firewall alarm data, and the method for obtaining the Web application firewall alarm data is: When the Web application firewall detects a potential attack, it acquires attack data in real time, including attack source, attack payload, triggered rule code, attack time, and attack type; Associating the attack data with the security vulnerability library. If the attack data uses a vulnerability in the security vulnerability library, generating protection suggestions based on the security vulnerability library and the corresponding attack data. For attack data that includes protection suggestions, the attack data and the corresponding protection suggestions are integrated to generate Web application firewall alarm data. Otherwise, the attack data is used as Web application firewall alarm data.

[0049] Specifically, the processing of the above-mentioned Web application firewall alarm data is completed by the WAF module. The functions of the WAF module include: managing WAF security rules, flexibly configuring and updating protection strategies to respond to the latest security threats; managing and maintaining the list of domain names protected by WAF to ensure the security protection of key Web resources; real-time monitoring of Web application traffic, accurately identifying and intercepting various types of attack behaviors, and ensuring the safe operation of applications; performing detailed statistics and analysis on the collected attack data, supporting in-depth analysis by API and IP dimensions, and helping to identify potential attack sources and patterns; when an attack is detected, immediately sending an alarm notification to ensure that the security team can take countermeasures quickly.

[0050] The implementation method of the WAF module is: real-time acquisition of attack IP, attack payload, triggered WAF rule code, attack time, attack type and other data; obtain known vulnerability numbers and risk levels from the vulnerability management module to confirm whether there are vulnerabilities related to attack behavior; obtain code vulnerability information from the static code audit module to analyze whether the attack exploits security defects in the code. Perform pattern recognition on the attack data obtained in real time, analyze the historical behavior of the attack IP and the characteristics of the attack payload, and comprehensively analyze the data through the security brain model to generate security decision-making recommendations; through the security brain model analysis, confirm whether the attack is aimed at known vulnerabilities or unfixed code defects, and generate corresponding protection and repair recommendations. According to the analysis results of the security brain, dynamically adjust the WAF rules to enhance the protection capabilities against new attacks, and push the update results to the security operation module.

[0051] In other embodiments of the present invention, the data sent to the security operation module for display or warning also includes vulnerability warning data, and the method for obtaining the vulnerability warning data is: Obtain a vulnerability list from the vulnerability response platform, wherein the vulnerability information recorded in the vulnerability list includes vulnerability number, vulnerability score, vulnerability risk level and repair suggestion; Vulnerability information that meets the preset vulnerability risk level is used as vulnerability warning data.

[0052] Specifically, the processing of the above-mentioned vulnerability alert data is completed by the security vulnerability management module. The functions of the security vulnerability management module include: visualizing the vulnerability list obtained from Alibaba Cloud, vulnerability scanners, and manually discovered through vulnerability public opinion, and classifying and managing them by type to facilitate rapid identification and processing; instantly pushing vulnerability information and work orders through Feishu to ensure that relevant personnel receive vulnerability notifications in time and take action; summarizing and generating comprehensive vulnerability statistical reports to provide in-depth analysis and evaluation of security status; displaying vulnerability public opinion information from multiple channels to help assess the scope and severity of the vulnerability and support rapid response and decision-making.

[0053] The implementation method of the security vulnerability management module is as follows: obtain the latest vulnerability information from Alibaba Cloud's vulnerability management API, including vulnerability number, vulnerability risk level, repair suggestions, etc.; obtain attack IP, attack payload, triggered WAF rule code, etc. from the WAF module; obtain code vulnerability information from the static code audit module, including vulnerability number, vulnerability type, affected code line, etc.; analyze multi-source data of the security brain to generate attack predictions, warnings, and decision-making suggestions. Conduct risk assessment on the obtained vulnerability data, combine attack data and code vulnerability information, determine the priority of vulnerability repair, and generate a repair plan; conduct multi-dimensional analysis of vulnerability data, including historical vulnerability comparison and public opinion analysis, to determine the potential impact range of the vulnerability and the timeliness of repair; associate vulnerabilities with attacks: through the security brain algorithm model, confirm whether the vulnerability has been exploited and has an impact, and automatically generate a repair work order and push it to relevant personnel.

[0054] Embodiment 2 An information security management system, such as Figure 2 As shown, the system includes a security operation module, a static code audit module, a Web application firewall module, a security vulnerability management module and a security brain module, which are used to implement the information security management method as described in Example 1.

[0055] The security operation module is used to summarize and visualize the code audit data of the static code audit module, the vulnerability data obtained from the security vulnerability management module, summarize and display the operation status of the WAF module, and receive and display the alarm information output by the security brain module. Specifically, the functions of the security operation module include: summarizing and visually displaying the code audit data of the static code audit module to help identify and analyze potential security risks in the code; centrally collecting and displaying the vulnerability data obtained from the security vulnerability management module, providing detailed vulnerability analysis and risk assessment, and supporting rapid decision-making; summarizing and displaying the operation status of the WAF module, providing real-time Web application protection information, and ensuring the continuous security of key applications; integrating and displaying security alarm data from various modules to help the security team quickly identify, respond to and handle potential security threats; summarizing and displaying the inspection results of the security system to ensure the stability and availability of various security policies and systems, and support daily security optimization; security situation awareness: comprehensive security risk analysis generated by the security brain, including early warning, attack prediction and decision-making recommendation display.

[0056] The static code audit module is used to manage and update the security rules for code scanning, scan and analyze the code based on the security rules for code scanning to identify and locate code security vulnerabilities, and send the code security vulnerability information to the security brain module. Specifically, the functions of the static code audit module include: managing and updating the security rules for code scanning to ensure the accuracy and timeliness of the rules and adapt to the latest security threats; providing scheduled and manual scanning functions, in-depth analysis of the code, identifying and locating potential security vulnerabilities, and timely preventing security risks; generating detailed scanning result statistical reports to fully display the security status of the code and help the development team make data-driven decisions; conducting centralized analysis of the discovered security defects, generating specific vulnerability items, and pushing them to the vulnerability management module for unified tracking and repair.

[0057] The Web Application Firewall module is used to manage the security rules of the firewall, update the protection strategy, monitor the traffic of the Web application in real time, identify and intercept the attack behavior according to the security rules and protection strategy of the firewall, and send the recorded Web logs to the Security Brain module. Specifically, the functions of the WAF module include: managing the security rules of the WAF, flexibly configuring and updating the protection strategy to deal with the latest security threats; managing and maintaining the list of domain names protected by the WAF to ensure the security protection of key Web resources; real-time monitoring of the traffic of Web applications, accurately identifying and intercepting various types of attack behaviors, and ensuring the safe operation of the application; detailed statistics and analysis of the collected attack data, supporting in-depth analysis by API and IP dimensions, and helping to identify potential attack sources and patterns; when an attack is detected, an alarm notification is immediately sent to ensure that the security team can take countermeasures quickly.

[0058] The security vulnerability management module is used to obtain vulnerability information from vulnerability management tools, conduct risk assessment on the obtained vulnerability information, determine the priority of vulnerability repair and generate a repair plan, and send the obtained vulnerability information and the corresponding risk assessment results to the security brain module. Specifically, the functions of the security vulnerability management module include: visualizing the list of vulnerabilities obtained from Alibaba Cloud, vulnerability scanners, and manually discovered through vulnerability public opinion, and classifying and managing them by type for rapid identification and processing; instantly push vulnerability information and work orders through Feishu to ensure that relevant personnel receive vulnerability notifications in a timely manner and take action; summarize and generate comprehensive vulnerability statistical reports to provide in-depth analysis and evaluation of security status; display vulnerability public opinion information from multiple channels to help evaluate the scope and severity of the vulnerability, and support rapid response and decision-making.

[0059] The security brain module is used to receive data from the static code audit module, Web application firewall module and security vulnerability management module, and send it to the security operation module after calculation and processing.

[0060] The above is only a preferred embodiment of the present invention. It should be pointed out that a person skilled in the art can make several modifications and improvements without departing from the inventive concept of the present invention, which all belong to the protection scope of the present invention.

Claims

1. An information security management method, characterized in that: The following steps are involved: Obtain code audit data, web application firewall data, and vulnerability management data; Perform feature extraction on the same batch of code audit data, Web application firewall data, and vulnerability management data to obtain structured feature vectors, and fuse the feature vectors into a feature matrix; Constructing and training an anomaly detection model, and inputting a feature matrix into the anomaly detection model to obtain an anomaly score; According to the anomaly score and the set threshold, a corresponding security risk level is generated and sent to the security operation module for display or alarm; The feature vectors include code audit feature vectors, firewall feature vectors, and vulnerability management feature vectors: The code audit feature vector further includes vulnerability type, vulnerability severity, number of affected code lines, code complexity, and comment density; The firewall feature vector further includes the requested URL structure, source IP reputation, response status code frequency, and potential attack behavior; The vulnerability management feature vector further includes CVSS score, the impact scope of the vulnerability, whether it has been fixed, and the difficulty of exploiting the vulnerability.

2. An information security management method according to claim 1, characterized in that: The processing flow of the anomaly detection model is as follows: Preprocessing the input feature matrix, the preprocessing includes data cleaning, feature encoding and standardization, the feature encoding uses One-Hot Encoding or Label Encoding to encode the category data and convert the category data into numerical form; Establish an isolation forest model, set the initial parameters of the model, set the number of trees in the forest to 150, set the expected outlier ratio to 0.1, and use historical data to train the isolation forest model; Use the trained isolation forest model to perform anomaly detection on the preprocessed feature matrix and generate anomaly scores.

3. The information security management method according to claim 1, characterized in that: The processing flow of the anomaly detection model is as follows: Preprocessing the input feature matrix, the preprocessing includes data cleaning, feature encoding and standardization, the feature encoding uses One-Hot Encoding or Label Encoding to encode the category data and convert the category data into numerical form; For a sample in the preprocessed feature matrix, calculate the distance between the sample and other samples, obtain the nearest k neighbors, and calculate the reachable distance from the sample to the neighbors; Calculate the local reachability density of a sample according to the reachability distance; The ratio of the local reachable density of the sample to the local reachable density of other samples in the k nearest neighbors is calculated as the anomaly score.

4. An information security management method according to claim 3, characterized in that: The calculation method of the reachable distance is: In the formula, It is a sample The reachable distance, is a sample of calculations, is one of the k nearest neighbors of the sample, It is a sample The distance to its kth nearest neighbor, It is a sample The Euclidean distance between .

5. The information security management method according to claim 3, characterized in that: The calculation method of the local reachable density is: In the formula, is a sample of calculations, is one of the k nearest neighbors of the sample, It is a sample The reachable distance, Representation sample The k-neighborhood of .

6. The information security management method according to claim 1, characterized in that: The data sent to the security operation module for display or alarm also includes code defect data, and the method for obtaining the code defect data is: Use static analysis tools to scan the code and obtain vulnerability type, vulnerability severity, affected code location, file location, code complexity data, and associated developers from the code scan; Analyze the data obtained by static analysis tools to assess the severity of the data and the priority of repair; Generate risk assessment and repair suggestions for vulnerabilities based on set security rules; Integrate the data, severity, repair priority, risk assessment and repair suggestions obtained by static analysis tools to generate code defect data.

7. The information security management method according to claim 1, characterized in that: The data sent to the security operation module for display or alarm also includes Web application firewall alarm data. The method for obtaining the Web application firewall alarm data is: When the Web application firewall detects a potential attack, it acquires attack data in real time, including attack source, attack payload, triggered rule code, attack time, and attack type; Associating the attack data with the security vulnerability library. If the attack data uses a vulnerability in the security vulnerability library, generating protection suggestions based on the security vulnerability library and the corresponding attack data. For attack data that includes protection suggestions, the attack data and the corresponding protection suggestions are integrated to generate Web application firewall alarm data. Otherwise, the attack data is used as Web application firewall alarm data.

8. An information security management method according to claim 1, characterized in that: The data sent to the security operation module for display or alarm also includes vulnerability alarm data, and the method for obtaining the vulnerability alarm data is: Obtain a vulnerability list from the vulnerability response platform, wherein the vulnerability information recorded in the vulnerability list includes vulnerability number, vulnerability score, vulnerability risk level and repair suggestion; Vulnerability information that meets the preset vulnerability risk level is used as vulnerability warning data.

9. An information security management system, characterized in that: The system includes a security operation module, a static code audit module, a Web application firewall module, a security vulnerability management module and a security brain module, which are used to implement the information security management method according to any one of claims 1 to 8, wherein: The security operation module is used to summarize and visualize the code audit data of the static code audit module, the vulnerability data obtained from the security vulnerability management module, summarize and display the operation status of the WAF module, and receive and display the alarm information output by the security brain module; The static code audit module is used to manage and update the security rules for code scanning, scan and analyze the code based on the security rules for code scanning to identify and locate code security vulnerabilities, and send the code security vulnerability information to the security brain module; The Web Application Firewall module is used to manage firewall security rules, update protection strategies, and monitor Web application traffic in real time. It identifies and intercepts attack behaviors based on firewall security rules and protection strategies, and sends recorded Web logs to the Security Brain module. The security vulnerability management module is used to obtain vulnerability information from the vulnerability management tool, conduct risk assessment on the obtained vulnerability information, determine the priority of vulnerability repair and generate a repair plan, and send the obtained vulnerability information and corresponding risk assessment results to the security brain module; The security brain module is used to receive data from the static code audit module, Web application firewall module and security vulnerability management module, and send it to the security operation module after calculation and processing.

Images