An integrated assessment and supervision platform for security operation and maintenance services

Abstract

The present invention discloses an integrated evaluation and supervision platform for safe operation and maintenance services, which belongs to the technical field of safe operation and maintenance services, and comprises a monitoring module, a monitoring and analysis module and an execution evaluation module; the monitoring module is used for operation and maintenance monitoring, and supplements monitoring points according to the acquired monitoring arrangement information; real-time monitoring is performed based on each monitoring point to obtain operation and maintenance monitoring data; real-time display is performed through a preset operation and maintenance monitoring model; the monitoring and analysis module is used for operation and maintenance analysis, and obtains operation and maintenance analysis results, and the operation and maintenance analysis results are input into the operation and maintenance monitoring model for display; the execution evaluation module is used for execution effect evaluation, and each operation and maintenance execution data is classified to obtain each unit classification data; the unit classification data is analyzed to obtain an execution evaluation value; an execution evaluation curve of each instruction attribute is generated; an execution effect evaluation is performed according to the execution evaluation curve to obtain a single execution evaluation result; and a corresponding comprehensive status value is evaluated based on each execution evaluation curve.

Description

Technical Field

[0001] The present invention belongs to the technical field of security operation and maintenance services, and specifically is an integrated assessment and supervision platform for security operation and maintenance services. Background Art

[0002] With the rapid development of information technology and the widespread application of the Internet, the information systems of enterprises and organizations are becoming increasingly complex, and the amount of data involved is also growing explosively. These systems not only carry the core business of the enterprise, but also involve a large amount of user privacy information and key data assets. Therefore, ensuring the safe and stable operation of information systems has become an important task that enterprises cannot ignore. However, traditional operation and maintenance management usually adopts a decentralized architecture, and the operation and maintenance of each system or component is the responsibility of different teams, resulting in low operation and maintenance efficiency, and it is difficult to form a global perspective for unified management and optimization. In particular, the operation and maintenance work of some enterprises is still highly dependent on manual operations, which not only increases the operation and maintenance costs, but also makes it difficult to cope with large-scale system operation and maintenance needs.

[0003] Based on this, in order to realize safe operation and maintenance services, the present invention provides an integrated evaluation and supervision platform for safe operation and maintenance services. Summary of the invention

[0004] In order to solve the problems existing in the above-mentioned solutions, the present invention provides an integrated assessment and supervision platform for security operation and maintenance services.

[0005] The purpose of the present invention can be achieved by the following technical solutions:

[0006] An integrated security operation and maintenance service assessment and supervision platform, including a monitoring module, a monitoring and analysis module, and an execution assessment module;

[0007] The monitoring module is used to perform operation and maintenance monitoring, obtain monitoring layout information, and supplement monitoring points according to the monitoring layout information;

[0008] Carry out real-time monitoring based on each monitoring point to obtain corresponding operation and maintenance monitoring data;

[0009] Establishing an operation and maintenance monitoring model; inputting the operation and maintenance monitoring data into the operation and maintenance monitoring model for real-time display.

[0010] Furthermore, the method for supplementing monitoring points according to the monitoring arrangement information includes:

[0011] According to the historical operation and maintenance data, the number of attacks corresponding to each monitoring point is counted, and the attack rate corresponding to each monitoring point is calculated based on the number of attacks, and marked as the hidden danger value;

[0012] Identify the monitoring attributes of each monitoring point according to the monitoring layout information, determine the protection target corresponding to each monitoring point according to the monitoring attributes, and set the corresponding protection value according to the protection target. The protection value range is [0, 100];

[0013] The obtained protection value and hidden danger value are marked as FH and HA respectively;

[0014] According to the formula Calculate the corresponding supplementary value;

[0015] Where: QA is the supplementary value;

[0016] The monitoring points whose supplementation values ​​are greater than the threshold value X1 are marked as analysis points, and the monitoring points are supplemented according to the analysis points.

[0017] The monitoring and analysis module is used to perform operation and maintenance analysis, set a basic unit, and identify the operation and maintenance monitoring data in the operation and maintenance monitoring model in real time; perform real-time analysis on each operation and maintenance monitoring data through the basic unit to obtain a corresponding first analysis result;

[0018] Identify in real time the status data of the protection target corresponding to each monitoring point, analyze the status data, and obtain a corresponding second analysis result;

[0019] The first analysis result and the second analysis result are integrated into an operation and maintenance analysis result, and the operation and maintenance analysis result is input into an operation and maintenance monitoring model for display.

[0020] Furthermore, the method for analyzing the status data includes:

[0021] Establish a state abnormality model, the expression of the state abnormality model is: ;

[0022] Where: s is the input data, the input data is the state data of the corresponding protection target; the output data is the state abnormality value TR(s);

[0023] Analyze the state data of the corresponding protection target through the state anomaly model to obtain the corresponding state anomaly value;

[0024] When the status abnormality value is 1, the second analysis result is an operation and maintenance abnormality;

[0025] When the status abnormality value is 0, the second analysis result is that the operation and maintenance is normal.

[0026] The execution evaluation module is used to evaluate the execution effect, obtain operation and maintenance execution data, classify the operation and maintenance execution data, and obtain classification data of each unit;

[0027] Analyze the unit classification data to obtain corresponding execution evaluation values; identify the instruction attributes corresponding to each unit classification data; generate execution evaluation curves corresponding to each instruction attribute according to the execution evaluation values ​​corresponding to each unit classification data;

[0028] According to the execution evaluation curve, the execution effect of the corresponding instruction attributes is evaluated to obtain the corresponding single execution evaluation result;

[0029] Evaluate the corresponding comprehensive status value based on each execution evaluation curve;

[0030] The obtained comprehensive status value and each execution evaluation curve are input into the operation and maintenance monitoring model for display.

[0031] Furthermore, the method for classifying the operation and maintenance execution data includes:

[0032] Identify the instruction attribute corresponding to each operation and maintenance execution data, classify the operation and maintenance execution data with the same instruction attribute into one category, and obtain each initial classification data;

[0033] The unit time is set, the execution time corresponding to each operation and maintenance execution data is identified, the initial classification data is classified according to the unit time corresponding to the execution time, and the unit classification data corresponding to each unit time is obtained.

[0034] Furthermore, the method for analyzing the unit classification data includes:

[0035] Identify each operation and maintenance execution data in the unit classification data, evaluate each operation and maintenance execution data through a preset completion evaluation model, and obtain a completion value corresponding to each operation and maintenance execution data, where the completion value is 0 or 1;

[0036] Perform execution degree analysis on the operation and maintenance execution data with a completion value of 1 to obtain the execution rate corresponding to each operation and maintenance execution data;

[0037] Mark the execution rate of operation and maintenance execution data with a completion value of 0 as 0;

[0038] Identify the quantity of operation and maintenance execution data in the unit classification data, marked as a quantity value;

[0039] According to the formula Calculate the corresponding execution evaluation value;

[0040] Where: PD is the execution evaluation value; ηi represents the execution rate of the corresponding operation and maintenance execution data; i represents the corresponding operation and maintenance execution data, i=1, 2, ..., n, n is a positive integer; SL is the quantity value; GP(ηi) is the judgment function, .

[0041] Furthermore, the expression to complete the evaluation model is: ;

[0042] Where: q is the input data, and the input data is the operation and maintenance execution data; the output data is the completion value WR(q).

[0043] Furthermore, the method for evaluating the comprehensive status value based on each execution evaluation curve includes:

[0044] Fit each execution evaluation curve to obtain the corresponding execution evaluation function, and mark the execution evaluation function as PUj(t), where j represents the corresponding instruction attribute, j = 1, 2,..., m, and m is a positive integer;

[0045] According to the formula Calculate the corresponding comprehensive status value;

[0046] Where: WP is the comprehensive status value; λt represents the corresponding conversion value, and λt includes 0 or 1; bj is the proportionality coefficient, and the value range is 0 < bj ≤ 1; PM is the maximum execution sum value.

[0047] Compared with the prior art, the beneficial effects of the present invention are:

[0048] Through the mutual cooperation among the monitoring module, the monitoring and analysis module, and the execution evaluation module, the automatic execution of the operation and maintenance tasks is realized, significantly reducing manual operations and improving the operation and maintenance efficiency and accuracy; integrating functions such as monitoring, management, and alarm, facilitating the centralized management and monitoring of the entire system by operation and maintenance personnel, and quickly responding to and handling problems; and through the evaluation of parameter monitoring, protection target status, execution effect, etc., realizing security operation and maintenance management from the level and improving the security performance. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings required for use in the description of the embodiments or the prior art. Obviously, the drawings in the following description are only some embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other drawings can be obtained based on these drawings.

[0050] Figure 1 It is the principle block diagram of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0051] The following will clearly and completely describe the technical solutions of the present invention in combination with the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, rather than all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts belong to the scope of protection of the present invention.

[0052] Such as Figure 1As shown, a security operation and maintenance service integrated assessment and supervision platform includes a monitoring module, a monitoring and analysis module, and an execution assessment module;

[0053] The monitoring module is used to perform operation and maintenance monitoring and obtain monitoring layout information. The monitoring layout information is the distribution information of each monitoring point monitored by the applied operation and maintenance monitoring system, which is existing data; that is, the monitoring layout information is used to summarize the monitoring attributes of each monitoring point, including location, monitoring range, monitoring expectation, etc. The monitoring range is the type and range of data that can be monitored; the monitoring expectation is the monitoring target that the monitoring point is expected to achieve, such as the expectation that all data within the monitoring range of a certain protection target can be successfully monitored; the monitoring points are supplemented according to the monitoring layout information;

[0054] Through real-time monitoring at each monitoring point, corresponding operation and maintenance monitoring data can be obtained;

[0055] Based on the user's operation and maintenance display needs, an operation and maintenance monitoring model that meets the user's requirements is established; the obtained operation and maintenance monitoring data is input into the operation and maintenance monitoring model for real-time display.

[0056] In one embodiment, the method for supplementing monitoring points according to monitoring arrangement information includes:

[0057] According to the historical operation and maintenance data, the number of attacks corresponding to each monitoring point is counted, that is, whether it is a security attack is determined according to the operation and maintenance monitoring data corresponding to the monitoring point, and then the corresponding number of attacks is counted, and the attack rate corresponding to each monitoring point is calculated according to the number of attacks, and marked as the hidden danger value;

[0058] According to the monitoring layout information, the monitoring attributes of each monitoring point are identified, and the protection target corresponding to each monitoring point is determined according to the monitoring attributes. The protection target is the target that needs security protection, such as a database. According to the importance of the protection target to the user, the corresponding protection value is set. The protection value range is [0, 100]. The protection value of an unimportant protection target is 0. The user specifies a protection value of 100 for a protection target of a certain importance, and the protection value of other targets that are not less important than the protection value is also 100. The remaining protection values ​​are set according to the difference in importance. The importance can be determined based on the user loss after the protection target is successfully attacked. In actual applications, the platform generally uses its own sufficient professional resources to pre-set the protection value of each protection target, and then matches them later.

[0059] The obtained protection value and hidden danger value are marked as FH and HA respectively;

[0060] According to the formula Calculate the corresponding supplementary value;

[0061] Where: QA is the supplementary value;

[0062] The monitoring points whose supplementary values ​​are greater than the threshold value X1 are marked as analysis points, and a method that can bypass the monitoring of the analysis points is determined according to the prior art, and then the monitoring points that can be monitored are supplemented according to the corresponding method, that is, the monitoring points are supplemented according to the analysis points.

[0063] The monitoring and analysis module is used to perform operation and maintenance analysis, and a basic unit is set up. The basic unit is established based on the existing operation and maintenance safety analysis technology, and is used to perform direct safety analysis on the operation and maintenance monitoring data to determine whether there are abnormal conditions such as parameter exceeding the standard;

[0064] Identify the operation and maintenance monitoring data in the operation and maintenance monitoring model in real time; perform real-time analysis on each operation and maintenance monitoring data through the basic unit to obtain a corresponding first analysis result;

[0065] Real-time identification of the status data of the protection target corresponding to each monitoring point, the status data refers to whether it is subject to unauthorized access, copying, tampering and other related factors, and the status items of each protection target are preset for data collection; the obtained status data are analyzed to obtain the corresponding second analysis result;

[0066] The first analysis result and the second analysis result are integrated into an operation and maintenance analysis result, and the operation and maintenance analysis result is input into an operation and maintenance monitoring model for display.

[0067] In one embodiment, a method for analyzing status data includes:

[0068] Establish a state anomaly model. The state anomaly model is used to analyze the state data corresponding to each protection target and determine whether the state data is abnormal data. That is, unauthorized access, copying, tampering and other phenomena are considered abnormal data. Based on feature recognition technology, corresponding judgments can be made. The expression of the state anomaly model is: ; In the formula: s is the input data, the input data is the state data of the corresponding protection target; the output data is the state abnormality value TR(s);

[0069] Analyze the state data of the corresponding protection target through the state anomaly model to obtain the corresponding state anomaly value;

[0070] When the status abnormality value is 1, the second analysis result is an operation and maintenance abnormality;

[0071] When the status abnormality value is 0, the second analysis result is that the operation and maintenance is normal.

[0072] The execution evaluation module is used to evaluate the execution effect, that is, to evaluate the execution effect of each operation and maintenance safety instruction in the operation and maintenance management process, and obtain the operation and maintenance execution data, which includes the operation and maintenance safety instructions generated for security risks, the instruction execution results and other related data; classify each operation and maintenance execution data to obtain the classification data of each unit;

[0073] Analyze the unit classification data to obtain the corresponding execution evaluation value;

[0074] Generate an execution evaluation curve corresponding to each instruction attribute according to the execution evaluation value corresponding to each unit classification data; the horizontal axis of the execution evaluation curve is the independent variable representing each unit classification data, which is sorted according to the unit time sequence corresponding to the unit classification data, and the vertical axis is the execution evaluation value;

[0075] According to the execution evaluation curve, the execution effect of the corresponding instruction attribute is evaluated to obtain the corresponding single execution evaluation result, that is, qualified or unqualified; and the corresponding comprehensive status value is evaluated based on each execution evaluation curve;

[0076] The obtained comprehensive status value and each execution evaluation curve are input into the operation and maintenance monitoring model for display.

[0077] In one embodiment, a method for classifying operation and maintenance execution data includes:

[0078] Identify the instruction attribute corresponding to each operation and maintenance execution data, that is, the instruction attribute is the operation and maintenance problem for which the operation and maintenance security instruction is generated; classify the operation and maintenance execution data with the same instruction attribute into one category to obtain each initial classification data;

[0079] Set the unit time, such as one hour, half a day, one day, etc., according to the number of operation and maintenance safety instructions that the user may have; identify the execution time corresponding to each operation and maintenance execution data, classify the initial classification data according to the unit time corresponding to the execution time, and obtain the unit classification data corresponding to each unit time.

[0080] In one embodiment, a method for analyzing unit classification data includes:

[0081] Each operation and maintenance execution data in the identification unit classification data is evaluated through the preset completion evaluation model to obtain the completion value corresponding to each operation and maintenance execution data, and the completion value is 0 or 1; the expression of the completion evaluation model is ; In the formula: q is the input data, the input data is the operation and maintenance execution data; the output data is the completion value WR(q); the execution completion requirement is whether the instruction execution result meets the minimum execution requirement;

[0082] Perform execution degree analysis on the operation and maintenance execution data with a completion value of 1 to obtain the execution rate corresponding to each operation and maintenance execution data; the execution rate is the degree of completion of the instruction target, which can be evaluated based on the execution results;

[0083] Mark the execution rate of operation and maintenance execution data with a completion value of 0 as 0;

[0084] Identify the quantity of operation and maintenance execution data within the classification data of the identification unit, and mark it as the quantity value;

[0085] According to the formula Calculate the corresponding execution evaluation value;

[0086] In the formula: PD is the execution evaluation value; ηi represents the execution rate of the corresponding operation and maintenance execution data; i represents the corresponding operation and maintenance execution data, i = 1, 2, ……, n, where n is a positive integer; SL is the quantity value; GP(ηi) is the judgment function, .

[0087] In one embodiment, the method for evaluating the execution effect of the corresponding instruction attribute according to the execution evaluation curve is: compare each execution evaluation value in the execution evaluation curve with the preset value, and regard the situation with a value lower than the preset value as unqualified.

[0088] In one embodiment, when evaluating the execution effect of the corresponding instruction attribute according to the execution evaluation curve, it can also be evaluated based on other existing evaluation methods, such as when the slope change exceeds the limit value, or it remains at a low level for a long time, etc.

[0089] In one embodiment, the evaluation method of the comprehensive status value includes:

[0090] Fit each execution evaluation curve to obtain the corresponding execution evaluation function, and mark the execution evaluation function as PUj(t), where t is the independent variable, j represents the corresponding instruction attribute, j = 1, 2, ……, m, and m is a positive integer;

[0091] According to the formula Calculate the corresponding comprehensive status value;

[0092] In the formula: WP is the comprehensive status value; λt represents the corresponding conversion value. When PUj(t) = 0, λt = 0, that is, when the same unit time corresponds to PUj(t) = 0, λt = 0, otherwise λt = 1; bj is the proportionality coefficient, which is set according to the safety importance of the instruction attribute, and the value range is 0 < bj ≤ 1; PM is the sum of the maximum values of each execution evaluation function, marked as the maximum execution sum value.

[0093] The above formulas are all calculated by removing the dimension and taking their numerical values. The formulas are obtained by collecting a large amount of data for software simulation to get a formula closest to the actual situation. The preset parameters and preset thresholds in the formulas are set by those skilled in the art according to the actual situation or obtained by simulating a large amount of data.

[0094] The above embodiments are only used to illustrate the technical method of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical method of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical method of the present invention.

Claims

1. A security operation and maintenance service integrated assessment and supervision platform, characterized in that: It includes a monitoring module, a monitoring and analysis module, and an execution evaluation module; The monitoring module is used to conduct operation and maintenance monitoring, obtain monitoring layout information, and supplement monitoring points according to the monitoring layout information; Based on each monitoring point, real-time monitoring is carried out to obtain corresponding operation and maintenance monitoring data; An operation and maintenance monitoring model is established; the operation and maintenance monitoring data is input into the operation and maintenance monitoring model for real-time display; The monitoring and analysis module is used to conduct operation and maintenance analysis, set basic units, and real-time identify the operation and maintenance monitoring data in the operation and maintenance monitoring model; through the basic units, real-time analysis is carried out on each operation and maintenance monitoring data to obtain corresponding first analysis results; Real-time identify the status data of the protection targets corresponding to each monitoring point, analyze the status data, and obtain corresponding second analysis results; Integrate the first analysis result and the second analysis result into an operation and maintenance analysis result, and input the operation and maintenance analysis result into the operation and maintenance monitoring model for display; The execution evaluation module is used to conduct execution effect evaluation, obtain operation and maintenance execution data, classify the operation and maintenance execution data, and obtain classified data for each unit; Analyze the classified data for each unit to obtain corresponding execution evaluation values; identify the instruction attributes corresponding to the classified data for each unit; generate execution evaluation curves corresponding to each instruction attribute according to the execution evaluation values corresponding to the classified data for each unit; Conduct execution effect evaluation on the corresponding instruction attributes according to the execution evaluation curves to obtain corresponding single execution evaluation results; Evaluate the corresponding comprehensive status value based on each execution evaluation curve; Input the obtained comprehensive status value and each execution evaluation curve into the operation and maintenance monitoring model for display; The method for analyzing the classified data for each unit includes: Identify each operation and maintenance execution data in the classified data for each unit, evaluate each operation and maintenance execution data through a preset completion evaluation model to obtain the completion value corresponding to each operation and maintenance execution data, and the completion value is 0 or 1; Conduct execution degree analysis on the operation and maintenance execution data with a completion value of 1 to obtain the execution rate corresponding to each operation and maintenance execution data; Mark the execution rate of the operation and maintenance execution data with a completion value of 0 as 0; Identify the number of operation and maintenance execution data within the classified data for each unit and mark it as the quantity value; According to the formula Calculate the corresponding execution evaluation value; Where: PD is the execution evaluation value; ηi represents the execution rate of the corresponding operation and maintenance execution data; i represents the corresponding operation and maintenance execution data, i=1, 2, ..., n, n is a positive integer; SL is the quantity value; GP(ηi) is the judgment function, ; The method for evaluating the comprehensive status value based on each execution evaluation curve includes: Fit each execution evaluation curve to obtain a corresponding execution evaluation function, and mark the execution evaluation function as PUj(t), where j represents the corresponding instruction attribute, j = 1, 2,..., m, and m is a positive integer; According to the formula Calculate the corresponding comprehensive state value; In the formula: WP is the comprehensive status value; λt represents the corresponding conversion value, and λt includes 0 or 1; bj is a proportionality coefficient, and the value range is 0 < bj ≤ 1; PM is the sum of the maximum values of each execution evaluation function, marked as the maximum execution sum value.

2. According to claim 1, a security operation and maintenance service integrated assessment and supervision platform is characterized in that: The method for supplementing monitoring points according to the monitoring layout information includes: Count the number of attacks corresponding to each monitoring point according to historical operation and maintenance data, calculate the attack rate corresponding to each monitoring point according to the number of attacks, and mark it as the hidden danger value; Identify the monitoring attributes of each monitoring point according to the monitoring layout information, determine the protection targets corresponding to each monitoring point according to the monitoring attributes, and set corresponding protection values, and the value range of the protection value is [0, 100]; The obtained protection value and hidden danger value are marked as FH and HA respectively; According to the formula Calculate the corresponding supplementary value; Where: QA is the supplementary value; The monitoring points whose supplementation values ​​are greater than the threshold value X1 are marked as analysis points, and the monitoring points are supplemented according to the analysis points.

3. According to claim 1, a security operation and maintenance service integrated assessment and supervision platform is characterized in that: Methods for analyzing status data include: Establish a state abnormality model, the expression of the state abnormality model is: ; Where: s is the input data, the input data is the state data of the corresponding protection target; the output data is the state abnormality value TR(s); Analyze the state data of the corresponding protection target through the state anomaly model to obtain the corresponding state anomaly value; When the status abnormality value is 1, the second analysis result is an operation and maintenance abnormality; When the status abnormality value is 0, the second analysis result is that the operation and maintenance is normal.

4. According to claim 1, a security operation and maintenance service integrated assessment and supervision platform is characterized in that: Methods for classifying operation and maintenance execution data include: Identify the instruction attribute corresponding to each operation and maintenance execution data, classify the operation and maintenance execution data with the same instruction attribute into one category, and obtain each initial classification data; The unit time is set, the execution time corresponding to each operation and maintenance execution data is identified, the initial classification data is classified according to the unit time corresponding to the execution time, and the unit classification data corresponding to each unit time is obtained.

5. According to claim 1, a security operation and maintenance service integrated assessment and supervision platform is characterized in that: The expression to complete the evaluation model is: ; In the formula: q is the input data, the input data is the operation and maintenance execution data; the output data is the completion value WR(q).

Images