Data security detection method and device

Abstract

The invention relates to the technical field of data security, in particular to a data security detection method and device, and the method comprises the following steps: based on the operation state of data equipment, collecting the information of a network environment where the data equipment is located, detecting the type and number of access equipment, obtaining the number of abnormal software installed in the data equipment, and evaluating the risk level of the data equipment; and obtaining an equipment risk assessment result. According to the invention, by using the operation state of the data equipment, evaluating the risk level of the equipment, evaluating the type and file size of the data, calculating the importance score of the data, combining the risk level of the equipment, and adjusting the anomaly detection threshold, the safety early warning capability and the response speed are improved, so that the safety protection is more active and accurate; according to the method, the equipment risk and the data exception level are integrated, so that the overall data security level assessment is more comprehensive, a more scientific basis is provided for a subsequent security policy, and the quality and efficiency of data protection are improved.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a data security detection method and device. Background Art

[0002] The field of data security technology involves the development and implementation of methods and tools for protecting data from unauthorized access, misuse, leakage, destruction and loss. The field of data security includes data encryption, access control mechanisms, integrity verification, data privacy protection technology, and monitoring and response systems. In the context of the rapid development of digitalization and networking, the importance of data security technology has become increasingly prominent. The core goal of data security technology is to ensure the confidentiality, integrity and availability of data.

[0003] Data security detection methods refer to methods used to detect and identify potential data security threats or vulnerabilities. Their main purpose is to ensure that the confidentiality, integrity and availability of data are not violated. The methods detect abnormal behaviors and suspicious activities through real-time monitoring, log analysis and behavioral analysis, and effectively prevent and respond to various security attacks, such as malware infection, unauthorized access and data leakage. Data security detection not only helps organizations comply with legal and regulatory requirements, but is also an important means of protecting customer data and corporate intellectual property.

[0004] Traditional security detection methods use static security mechanisms, such as fixed access control and consistent security thresholds, which show obvious limitations in dynamically changing network environments. They lack targeted risk assessment and flexible adjustment mechanisms. Fixed thresholds cannot effectively respond to new or sudden security threats. In actual operations, data protection measures will lead to excessive obstruction of effective data access or failure to respond to actual security needs in a timely manner. In addition, the lack of the impact of data type and file size on security level leads to insufficient protection of important data or excessive protection of low-risk data, reducing detection efficiency and flexibility. Summary of the invention

[0005] The purpose of the present invention is to solve the shortcomings in the prior art and to propose a data security detection method and device.

[0006] In order to achieve the above object, the present invention adopts the following technical solution: a data security detection method, comprising the following steps:

[0007] S1: Based on the running status of the data device, collect the network environment information of the data device, detect the type and number of access devices, obtain the number of abnormal software installed on the data device, evaluate the risk level of the data device, and obtain the device risk assessment result;

[0008] S2: Based on the device risk assessment result, the importance score of the data is calculated according to the type and file size of the data to be detected, and the data anomaly detection threshold is adjusted in combination with the risk level of the data device, including the data access permission threshold and the access frequency threshold, to obtain the anomaly detection threshold adjustment result;

[0009] S3: Based on the abnormality detection threshold adjustment result, the access behavior of the detection data is compared with the adjusted abnormality detection threshold, the degree of deviation is calculated, and the abnormality level is determined according to the degree of deviation to obtain the abnormality level evaluation result;

[0010] S4: Based on the device risk assessment result and the abnormality level assessment result, the overall security level of the device data is assessed to obtain a data security detection assessment result.

[0011] The present invention is improved in that the steps of obtaining the equipment risk assessment result are:

[0012] S111: Based on the running status of the data device, collect network environment information of the data device, including the number of types of network security protocols, the number of known security vulnerabilities and the number of security attack records, count the types and number of devices connected to the data device, and obtain the number of abnormal software installed on the data device to obtain data device status association information;

[0013] S112: Based on the data device status association information, by formula:

[0014]

[0015] Calculate the risk level R of the data device, where ω s ,ω d and ω a is the weight coefficient, s R1 、s R2 and R3 Represents the number of network security protocols, the number of known security vulnerabilities, and the number of security attack records, respectively. R1 Represents the number of connected device types, d R2 Represents the total number of connected devices, a R represents the number of abnormal software installed on the device, and R represents the risk level of the data device;

[0016] S113: Based on the risk level R of the data device, the risk is compared with a preset risk level table to evaluate the data device risk and obtain a device risk evaluation result.

[0017] The present invention is improved in that the method for calculating the importance score of data is:

[0018] S211: extracting data type identifier and file size information based on the data to be detected, and obtaining data importance association information;

[0019] S212: Based on the data importance association information, by formula:

[0020]

[0021] Calculate the importance score I of the data, where α I , β I and γ I is the adjustment factor, s I is the size of the file, f tI is the impact factor of the data type, and I is the importance score of the data.

[0022] The present invention is improved in that the step of obtaining the abnormality detection threshold adjustment result is:

[0023] S221: Based on the device risk assessment result and the importance score I of the data, collect the basic authority threshold T base and the basic access frequency threshold F base , get the threshold correlation data;

[0024] S222: Based on the threshold value associated data, by formula:

[0025] T adj =T base ×e ξTR+ηTI

[0026] Calculate the adjusted access permission threshold T adj , and by the formula:

[0027]

[0028] Calculate the adjusted access frequency threshold F adj , where ξ T , η T ,θ F and κ F is the adjustment factor, T base and F base are the basic permission threshold and basic access frequency threshold respectively, I is the importance score of the data, R is the risk level of the data device, and T adj and F adj are the adjusted access rights and access frequency thresholds, respectively, and e is the base of the natural logarithm;

[0029] S223: Based on the adjusted access permission threshold T adj and the adjusted access frequency threshold F adj , according to Tadj and F adj The value of is used to adjust the threshold and obtain the anomaly detection threshold adjustment result.

[0030] The present invention is improved in that the method for calculating the degree of deviation is:

[0031] S311: Based on the abnormality detection threshold adjustment result, collect data access records, where the data access records include the authority to access data and the access frequency;

[0032] S312: Based on the data access record, compare with the adjusted anomaly detection threshold, through the formula:

[0033] ΔT=α P ·log(1+max(0,T adj -T))

[0034] Calculate the authority deviation ΔT and use the formula:

[0035]

[0036] Calculate the frequency deviation ΔF, where T is the actual access authority to the data, F is the actual data access frequency, and T adj and F adj are the adjusted access permission and access frequency thresholds, ΔT and ΔF are the permission deviation and frequency deviation, α P and β P is the weight factor;

[0037] S313: Based on the authority deviation ΔT and the frequency deviation ΔF, the formula:

[0038] P=ΔT+λ P ΔF

[0039] Calculate the overall deviation degree P and obtain the deviation degree information, where ΔT and ΔF are authority deviation and frequency deviation respectively, λ P is the weight factor, and P is the overall deviation degree.

[0040] The present invention is improved in that the steps of obtaining the abnormality level assessment result are:

[0041] S321: Based on the overall deviation degree P, by formula:

[0042]

[0043] Calculate the data anomaly level L, where P is the overall deviation degree, L is the data anomaly level, σ L is the sensitivity adjustment parameter, μ L is the midpoint parameter, δ Lis the scale adjustment parameter, e is the base of the natural logarithm;

[0044] S322: Based on the data abnormality level L, according to the size of L, the abnormality degree of the data is evaluated to obtain an abnormality level evaluation result.

[0045] The present invention is improved in that the steps of obtaining the data security detection and evaluation results are:

[0046] S411: extracting the device risk level R and the data anomaly level L based on the device risk assessment result and the anomaly level assessment result, and obtaining device data security association information;

[0047] S412: Based on the device data security association information, by formula:

[0048]

[0049] Calculate the data security score Z, where R is the risk level of the device, L is the abnormal level of the data, Z is the data security score, γ Z and δ Z is the adjustment coefficient, e is the base of the natural logarithm;

[0050] S413: Based on the security score Z of the data, the data is compared with a preset security standard to evaluate the overall security level of the device data and obtain a data security detection and evaluation result.

[0051] A data security detection device, the data security detection device is used to execute the above data security detection method, the device comprises:

[0052] The equipment risk analysis module evaluates the risk level of data equipment based on the operating status of the data equipment, the network environment of the data equipment, the access equipment information and the number of abnormal software, and obtains the equipment risk assessment results;

[0053] The data importance analysis module calculates the importance score of the data based on the information of the data to be detected, according to the type and file size of the data to be detected, and obtains the data importance assessment result;

[0054] The detection threshold adjustment module adjusts the data anomaly detection threshold based on the device risk assessment result and the data importance assessment result to obtain an anomaly detection threshold adjustment result;

[0055] The data anomaly rating module detects the access behavior of the data based on the anomaly detection threshold adjustment result, compares it with the adjusted anomaly detection threshold, calculates the degree of deviation, evaluates the anomaly level, and obtains the anomaly level evaluation result;

[0056] The data security assessment module assesses the overall security level of the device data based on the device risk assessment result and the abnormality level assessment result to obtain a data security detection assessment result.

[0057] Compared with the prior art, the advantages and positive effects of the present invention are:

[0058] In the present invention, by utilizing the running status of data equipment and evaluating the risk level of the equipment, it allows for more targeted identification of security threats, making risk assessment more specific, and by evaluating the type and file size of data, calculating the importance score of the data, and combining the risk level of the equipment, adjusting the anomaly detection threshold, dynamic management of data security is achieved. The monitoring of data access behavior is made more in line with actual security needs, the security early warning capability and response speed are improved, the security protection is made more proactive and accurate, the equipment risk and data anomaly level are integrated, the overall data security level assessment is made more comprehensive, a more scientific basis is provided for subsequent security strategies, and the quality and efficiency of data protection are improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] Figure 1 is a flow chart of the method of the present invention;

[0060] Figure 2 A flow chart for obtaining equipment risk assessment results for the present invention;

[0061] Figure 3 A flow chart for calculating the importance score of data for the present invention;

[0062] Figure 4 A flowchart of obtaining anomaly detection threshold adjustment results for the present invention;

[0063] Figure 5 A flow chart for calculating the degree of deviation for the present invention;

[0064] Figure 6 A flow chart for obtaining anomaly level assessment results of the present invention;

[0065] Figure 7 The present invention is a flowchart for obtaining data security detection and evaluation results. DETAILED DESCRIPTION

[0066] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0067] In the description of the present invention, it should be understood that the terms "length", "width", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", etc., indicating positions or positional relationships, are based on the positions or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present invention. In addition, in the description of the present invention, the meaning of "multiple" is two or more, unless otherwise clearly and specifically defined.

[0068] See also Figure 1 The present invention provides a technical solution: a data security detection method, comprising the following steps:

[0069] S1: Based on the running status of the data device, collect the network environment information of the data device, detect the type and number of access devices, obtain the number of abnormal software installed on the data device, evaluate the risk level of the data device, and obtain the device risk assessment result;

[0070] S2: Based on the equipment risk assessment results, the importance score of the data is calculated according to the type and file size of the data to be detected. Combined with the risk level of the data device, the data anomaly detection threshold is adjusted, including the data access permission threshold and access frequency threshold, to obtain the anomaly detection threshold adjustment result;

[0071] S3: Based on the anomaly detection threshold adjustment result, the access behavior of the detection data is compared with the adjusted anomaly detection threshold, the degree of deviation is calculated, and the anomaly level is determined according to the degree of deviation to obtain the anomaly level assessment result;

[0072] S4: Based on the equipment risk assessment results and the abnormality level assessment results, the overall security level of the equipment data is assessed to obtain the data security detection assessment results;

[0073] The device risk assessment results include the network connection risk score, device hardware risk score and software risk information. The anomaly detection threshold adjustment results include the adjusted access permission level and access frequency limit information. The anomaly level assessment results include the abnormal behavior type, deviation value classification and anomaly level identification. The data security detection assessment results include the data security level and the overall security level.

[0074] See also Figure 2 , the steps to obtain the equipment risk assessment results are:

[0075] S111: Based on the running status of the data device, collect network environment information of the data device, including the number of types of network security protocols, the number of known security vulnerabilities and the number of security attack records, count the types and number of devices connected to the data device, and obtain the number of abnormal software installed on the data device to obtain data device status association information;

[0076] S112: Based on the data device status association information, the formula is:

[0077]

[0078] Calculate the risk level R of the data device, where ω s ,ω d and ω a is the weight coefficient, s R1 、s R2 and R3 Represents the number of network security protocols, the number of known security vulnerabilities, and the number of security attack records, respectively. R1 Represents the number of connected device types, d R2 Represents the total number of connected devices, a R represents the number of abnormal software installed on the device, and R represents the risk level of the data device;

[0079] S113: Based on the risk level R of the data device, the risk is compared with a preset risk level table to evaluate the data device risk and obtain a device risk evaluation result.

[0080] formula:

[0081]

[0082] Parameter details and how to obtain them:

[0083] s R1 : Represents the number of security protocols on the network. The parameter is obtained through the management interface of the network device, usually through automatic scanning and statistics by network security software.

[0084] s R2 : Represents the number of known security vulnerabilities. The data can be obtained through vulnerability tracking services connected to major security databases and systems, such as the CVE database.

[0085] s R3 : Represents the number of recent security attack records. The parameter is recorded and counted by the network monitoring system, including unsuccessful attack attempts.

[0086] d R1: Represents the number of device types connected to the data device. The parameter is obtained from the device registration and authentication logs and is calculated by counting the access records of different devices.

[0087] d R2 : Represents the total number of devices connected to the data device. Obtained by directly counting all connected devices.

[0088] a R : Indicates the number of abnormal software installed on the device. Obtained through the scanning results of security software. Abnormal software includes but is not limited to uncertified third-party software, known malware, etc.

[0089] Calculation example:

[0090] Set the following values:

[0091] s R1 =5: The number of security protocols used in the network.

[0092] s R2 =10: Number of known security vulnerabilities.

[0093] s R3 =3: Number of recorded security attack events.

[0094] d R1 =2: Number of connected device types.

[0095] d R2 =100: Total number of connected devices.

[0096] a R =5: The number of abnormal software installed on the device.

[0097] Weight setting: ω s =0.5,ω d =0.3,ω a =0.2.

[0098] The calculation is as follows, using natural logarithms:

[0099]

[0100] The calculation result is R=2.373, and the value represents the overall risk level of the data device, where a lower value indicates a lower risk and a higher value indicates a higher risk for the device.

[0101] See also Figure 3 , the method to calculate the importance score of the data is:

[0102] S211: extracting data type identifier and file size information based on the data to be detected, and obtaining data importance association information;

[0103] S212: Based on the data importance association information, the formula is:

[0104]

[0105] Calculate the importance score I of the data, where α I , β I and γ I is the adjustment factor, s I is the size of the file, f tI is the impact factor of the data type, and I is the importance score of the data.

[0106] formula:

[0107]

[0108] Parameter details and how to obtain them:

[0109] s I : The size of the file in bytes. The parameter is obtained by querying the file attributes provided by the file system, usually the size value directly listed in the file attributes.

[0110] f tI : The impact factor of the data type. The data type is automatically identified by the file extension or content type. The impact factor of the data type is obtained from a preset rating table based on the business or security relevance of the data type. The rating table is pre-set based on the business importance or sensitivity of different data types.

[0111] α I : A parameter that adjusts the strength of the impact of file size on the score. The parameter is a design choice that adjusts how the size factor weighs in the final score.

[0112] β I : Balance factor, used to adjust the range of the overall score to ensure that the score value is within a reasonable range. This parameter is also a design decision and is set according to the expected distribution of the score results.

[0113] γ I : A parameter used to smooth the impact of small files on the score. This parameter is added to the logarithmic function to avoid score fluctuations caused by extremely small file sizes. It is an adjustment value set according to actual needs.

[0114] Calculation example:

[0115] Set the parameters as follows:

[0116] The data type is text file, and its type influence factor f tI =0.8, file size s I =2048 bytes, parameter αI =0.5,β I =2,γ I =10.

[0117] The calculation process is as follows:

[0118]

[0119] The calculation steps are as follows:

[0120] Calculate the impact of resizing the file:

[0121]

[0122] 45.24 0.5 ≈6.73

[0123] Calculate the numerator part of I:

[0124] 0.8×6.73=5.384

[0125] The denominator is 2, so:

[0126]

[0127] The logarithmic part is calculated using natural logarithm:

[0128] log(2058)≈7.63

[0129] The I value is:

[0130] 2.692×7.63≈20.54

[0131] The calculation result I=20.54 represents the importance score of the text file. The score is based on the type and size of the file, taking into account the impact of the type and the adjustment of the file size. A higher score means that the file has a higher importance to the business or security environment and should be given priority for protection and security measures.

[0132] See also Figure 4 , the steps to obtain the anomaly detection threshold adjustment result are:

[0133] S221: Based on the device risk assessment results and the data importance score I, collect the basic permission threshold T base and the basic access frequency threshold F base , get the threshold correlation data;

[0134] S222: Based on the threshold correlation data, the formula is:

[0135]

[0136] Calculate the adjusted access permission threshold Tadj , and by the formula:

[0137]

[0138] Calculate the adjusted access frequency threshold F adj , where ξ T , η T ,θ F and κ F is the adjustment factor, T base and F base are the basic permission threshold and basic access frequency threshold respectively, I is the importance score of the data, R is the risk level of the data device, and T adj and F adj are the adjusted access rights and access frequency thresholds, respectively, and e is the base of the natural logarithm;

[0139] S223: Based on the adjusted access permission threshold T adj and the adjusted access frequency threshold F adj , according to T adj and F adj The value of is used to adjust the threshold and obtain the anomaly detection threshold adjustment result.

[0140] formula:

[0141]

[0142] and

[0143]

[0144] Parameter details and how to obtain them:

[0145] T base and F base :The basic threshold is usually set according to the default security policy of the device or system. For example, the database will have a default access frequency limit to prevent excessive queries, and the value can be directly obtained from the system's security profile or database management settings.

[0146] I: The importance score of the data, calculated by the previous method.

[0147] R: Risk level of the data device, calculated using the previous method.

[0148] ξ T and η T : Adjustment coefficient, used to adjust the impact of risk level and data importance on the permission threshold. The coefficient is derived from the analysis of historical security incidents and data leakage incidents, and its purpose is to flexibly reflect the security situation in the threshold calculation.

[0149] θF and κ F : The adjustment factor is used to influence the calculation of the access frequency threshold, which is adjusted based on data access patterns and security requirements to ensure that the system is not at risk due to frequent access.

[0150] Calculation example:

[0151] Set the parameters as follows:

[0152] T base =100, indicating the default permission threshold.

[0153] F base =50, indicating the default access frequency threshold.

[0154] I=80, indicating a higher data importance score.

[0155] R=30, indicating that the device has certain security risks.

[0156] ξ T =0.01,η T =0.002,θ F =0.02,κ F =0.1, the adjustment factor provides a subtle adjustment to the risk level and importance.

[0157] Calculation of adjustment of access rights threshold:

[0158] T adj =100×e (0 .01×30+0 .002×80)

[0159] =100×e 0.46

[0160] ≈100×1.584

[0161] =158.4

[0162] Adjustment calculation of access frequency threshold:

[0163]

[0164] Calculation result T adj ≈158.4 and F adj ≈11.96, which represent the adjusted access permission threshold and access frequency threshold respectively. High T adj Indicates that the system requires strict access control due to higher risk and importance. adj Indicates that the access frequency is strictly limited to prevent security issues caused by frequent access. This reflects the adjustment of security policies under given risk and importance scores.

[0165] See also Figure 5 , the method to calculate the degree of deviation is:

[0166] S311: Based on the abnormal detection threshold adjustment result, collect data access records, where the data access records include the authority to access the data and the access frequency;

[0167] S312: Based on the data access record, the data is compared with the adjusted anomaly detection threshold, using the formula:

[0168] ΔT=α P ·log(1+max(0,T adj -T))

[0169] Calculate the authority deviation ΔT and use the formula:

[0170]

[0171] Calculate the frequency deviation ΔF, where T is the actual access authority to the data, F is the actual data access frequency, and T adj and F adj are the adjusted access permission and access frequency thresholds, ΔT and ΔF are the permission deviation and frequency deviation, α P and β P is the weight factor;

[0172] S313: Based on the authority deviation ΔT and the frequency deviation ΔF, the formula:

[0173] P=ΔT+λ P ΔF

[0174] Calculate the overall deviation degree P and obtain the deviation degree information, where ΔT and ΔF are authority deviation and frequency deviation respectively, λ P is the weight factor, and P is the overall deviation degree.

[0175] formula:

[0176] ΔT=α P ·log(1+max(0,T adj -T))

[0177] and

[0178]

[0179] and

[0180] P=ΔT+λ P ΔF

[0181] Parameter details and how to obtain them:

[0182] T: The actual access rights to data, which are monitored and recorded in real time by security monitoring tools. The parameter reflects the permission level of the user or application when it actually accesses the data.

[0183] F: Actual data access frequency, obtained in real time through monitoring tools, recording the number of data accesses in each time unit.

[0184] T adj and F adj : The adjusted access permission threshold and access frequency threshold are calculated using the previous method.

[0185] α P , β P and λ P : Weight factors are used to adjust the influence of different types of deviations in the total deviation assessment. The value of the factor is usually optimized based on historical data and risk assessment models to ensure that it effectively reflects actual security needs and policies.

[0186] Calculation example:

[0187] Setting parameters:

[0188] T adj =150 (adjusted access permission threshold), F adj =120 (adjusted access frequency threshold), T = 130 (actual access rights), F = 140 (actual access frequency), α P =0.5,β P =0.3,λ P =1.2.

[0189] Calculation process:

[0190] Calculate the authority deviation ΔT, using the natural logarithm:

[0191] ΔT=α P ·log(1+max(0,T adj -T))

[0192] The specific calculation is:

[0193] max(0,150-130)=20

[0194] log(1+20)=log(21)≈3.0445

[0195] ΔT=0.5·3.0445≈1.52225

[0196] Calculate the frequency deviation ΔF:

[0197] The specific calculation is:

[0198] max(0,140-120)=20

[0199]

[0200] ΔF=0.3·4.4721≈1.34163

[0201] Calculate the total deviation P:

[0202] P=ΔT+λ P ΔF

[0203] =1.52225+1.2·1.34163

[0204] ≈1.52225+1.60996

[0205] ≈3.13221

[0206] The total deviation obtained, P ≈ 3.13221, indicates that there is a significant deviation from the set threshold in terms of access rights and access frequency. The value indicates a potential security risk. A high P value may indicate that the data access behavior deviates from the normal pattern and there is unauthorized access or other abnormal behavior.

[0207] See also Figure 6 , the steps to obtain the abnormal level assessment results are:

[0208] S321: Based on the overall deviation degree P, by formula:

[0209]

[0210] Calculate the data anomaly level L, where P is the overall deviation degree, L is the data anomaly level, σ L is the sensitivity adjustment parameter, μ L is the midpoint parameter, δ L is the scale adjustment parameter, e is the base of the natural logarithm;

[0211] S322: Based on the data anomaly level L, according to the size of L, the degree of anomaly of the data is evaluated to obtain an anomaly level evaluation result.

[0212] formula:

[0213]

[0214] Parameter details and how to obtain them:

[0215] P: Overall deviation degree, calculated by the previous method.

[0216] σ L: Sensitivity adjustment parameter, which determines the response speed of abnormal level L to the change of P. The parameter is set according to the expected safety response sensitivity.

[0217] μ L : Midpoint parameter, which defines the point at which the abnormality level L will grow significantly. It is set according to the median or mean of the data distribution to adapt to different monitoring environments.

[0218] δ L : Scale adjustment parameter, used to adjust the effective range of P value, affecting the overall change curve of L. This parameter is set based on the standard deviation or coefficient of variation of the deviation data to adjust the applicability of the model.

[0219] Calculation example:

[0220] Set the parameter value to:

[0221] σ L =0.5, reflecting medium sensitivity, μ L =50, median value of deviation data, δ L =10, which is set according to the coefficient of variation of the deviation, indicating the degree of dispersion of the deviation; P=60, indicating the current total deviation value.

[0222] The calculation is as follows:

[0223] Calculate P relative to μ L Adjustment value:

[0224]

[0225] Calculate the anomaly level L:

[0226]

[0227] The calculated abnormality level L≈0.623 indicates that the current deviation value shows a moderate degree of abnormality relative to the set safety threshold. The value reflects that there is a significant potential risk in a given security monitoring environment.

[0228] See also Figure 7 , the steps to obtain the data security detection and evaluation results are:

[0229] S411: Based on the equipment risk assessment result and the abnormality level assessment result, extract the equipment risk level R and the data abnormality level L to obtain equipment data security related information;

[0230] S412: Based on the device data security association information, the formula is:

[0231]

[0232] Calculate the data security score Z, where R is the risk level of the device, L is the abnormal level of the data, Z is the data security score, γ Z and δ Z is the adjustment coefficient, e is the base of the natural logarithm;

[0233] S413: Based on the data security score Z, the data is compared with the preset security standard to evaluate the overall security level of the device data and obtain the data security detection and evaluation result.

[0234] formula:

[0235]

[0236] Parameter details and how to obtain them:

[0237] R: Risk level of the equipment, calculated using the previous method.

[0238] L: The abnormality level of the data, calculated by the previous method.

[0239] γ Z : Adjustment coefficient, used to adjust the impact of logarithmic operations. Helps adjust the contribution of R and L to the safety score Z, ensuring that the safety score is sensitive and reasonably reflects the risk and abnormality level, and is preset according to computing needs.

[0240] δ Z : Adjustment coefficient, used to determine the relative importance of L in the overall safety score. The parameter adjusts the impact of L to ensure that abnormal behavior is properly considered when assessing safety and can be preset by experts.

[0241] Calculation Example

[0242] Set the parameters as follows:

[0243] R=30 represents a medium level of security threat.

[0244] L=0.2: indicates that lower abnormal behavior is detected.

[0245] γ Z =0.1: Select a lower adjustment factor to smooth the impact of the logarithmic function.

[0246] δ Z =500: Sets a medium weighting factor to ensure appropriate influence of L.

[0247] Calculation process:

[0248]

[0249] Compute the sum within the logarithmic terms:

[0250] 1+R+δ Z L = 1 + 30 + 500 0.2 = 131

[0251] Compute the logarithm, taking the natural logarithm:

[0252] log(131)≈4.8752

[0253] Calculate the exponential part:

[0254] -γ Z ·log(131)=-0.1·4.8752≈-0.48752

[0255] Calculate the safety score Z:

[0256]

[0257] The calculated security score Z≈0.619 indicates that under the current device risks and data anomalies, the overall security of the data is at a medium level. The score reflects the existence of certain security risks and the need to take appropriate security measures to reduce potential threats.

[0258] A data security detection device, the data security detection device is used to execute the above data security detection method, the device comprises:

[0259] The equipment risk analysis module evaluates the risk level of data equipment based on the operating status of the data equipment, the network environment of the data equipment, the access equipment information and the number of abnormal software, and obtains the equipment risk assessment results;

[0260] The data importance analysis module calculates the importance score of the data based on the information of the data to be detected, according to the type and file size of the data to be detected, and obtains the data importance assessment result;

[0261] The detection threshold adjustment module adjusts the data anomaly detection threshold based on the equipment risk assessment result and the data importance assessment result to obtain the anomaly detection threshold adjustment result;

[0262] The data anomaly rating module detects the access behavior of the data based on the anomaly detection threshold adjustment result, compares it with the adjusted anomaly detection threshold, calculates the degree of deviation, evaluates the anomaly level, and obtains the anomaly level evaluation result;

[0263] The data security assessment module evaluates the overall security level of device data based on the device risk assessment results and the abnormality level assessment results, and obtains the data security detection assessment results.

[0264] The above are only preferred embodiments of the present invention and are not intended to limit the present invention in other forms. Any technician familiar with the profession may use the technical contents disclosed above to change or modify them into equivalent embodiments with equivalent changes and apply them to other fields. However, any simple modification, equivalent change and modification made to the above embodiments based on the technical essence of the present invention without departing from the technical solution of the present invention still falls within the protection scope of the technical solution of the present invention.

Claims

1. A data security detection method, It is characterized in that The following steps are involved: Based on the running status of data devices, collect the network environment information of data devices, detect the type and number of access devices, obtain the number of abnormal software installed on data devices, evaluate the risk level of data devices, and obtain the device risk assessment results; Based on the device risk assessment result, according to the type and file size of the data to be detected, the importance score of the data is calculated, and combined with the risk level of the data device, the data anomaly detection threshold is adjusted, including the data access permission threshold and the access frequency threshold, to obtain the anomaly detection threshold adjustment result; Based on the abnormality detection threshold adjustment result, the access behavior of the detection data is compared with the adjusted abnormality detection threshold, the degree of deviation is calculated, and the abnormality level is determined according to the degree of deviation to obtain the abnormality level evaluation result; Based on the equipment risk assessment results and the abnormality level assessment results, the overall security level of the equipment data is assessed to obtain a data security detection assessment result.

2. The data security detection method according to claim 1, It is characterized in that The steps for obtaining the equipment risk assessment results are as follows: Based on the running status of the data device, collect the network environment information of the data device, including the number of types of network security protocols, the number of known security vulnerabilities and the number of security attack records, count the types and number of devices connected to the data device, and obtain the number of abnormal software installed on the data device to obtain the data device status association information; Based on the data device status association information, through the formula: Calculate the risk level R of the data device, where ω s ,ω d and ω a is the weight coefficient, s R1 、s R2 and R3 Represents the number of network security protocols, the number of known security vulnerabilities, and the number of security attack records, respectively. R1 Represents the number of connected device types, d R2 Represents the total number of connected devices, a R represents the number of abnormal software installed on the device, and R represents the risk level of the data device; Based on the risk level R of the data device, it is compared with a preset risk level table to evaluate the data device risk and obtain a device risk evaluation result.

3. The data security detection method according to claim 1, It is characterized in that The method for calculating the importance score of data is: Based on the data to be detected, extract the data type identifier and file size information to obtain data importance association information; Based on the data importance association information, the formula is: Calculate the importance score I of the data, where α I , β I and γ I is the adjustment factor, s I is the size of the file, f tI is the impact factor of the data type, and I is the importance score of the data.

4. The data security detection method according to claim 3, It is characterized in that The steps for obtaining the abnormal detection threshold adjustment result are: Based on the device risk assessment results and the importance score I of the data, the basic permission threshold T is collected. base and the basic access frequency threshold F base , get the threshold correlation data; Based on the threshold correlation data, through the formula: Calculate the adjusted access permission threshold T adj , and by the formula: Calculate the adjusted access frequency threshold F adj , where ξ T , η T ,θ F and κ F is the adjustment factor, T base and F base are the basic permission threshold and basic access frequency threshold respectively, I is the importance score of the data, R is the risk level of the data device, and T adj and F adj are the adjusted access rights and access frequency thresholds, respectively, and e is the base of the natural logarithm; Based on the adjusted access permission threshold T adj and the adjusted access frequency threshold F adj , according to T adj and F adj The value of is used to adjust the threshold and obtain the anomaly detection threshold adjustment result.

5. The data security detection method according to claim 1, It is characterized in that The method for calculating the degree of deviation is: Based on the abnormal detection threshold adjustment result, collecting data access records, the data access records including the authority to access the data and the access frequency; Based on the data access record, the adjusted anomaly detection threshold is compared with the formula: ΔT=a P ·log(1+max(0,T adj -T)) Calculate the authority deviation ΔT and use the formula: Calculate the frequency deviation ΔF, where T is the actual access authority to the data, F is the actual data access frequency, and T adj and F adj are the adjusted access permission and access frequency thresholds, ΔT and ΔF are the permission deviation and frequency deviation, α P and β P is the weight factor; Based on the authority deviation ΔT and the frequency deviation ΔF, by the formula: P=ΔT+λ P ·ΔF Calculate the overall deviation degree P and obtain the deviation degree information, where ΔT and ΔF are authority deviation and frequency deviation respectively, λ P is the weight factor, and P is the overall deviation degree.

6. The data security detection method according to claim 5, It is characterized in that The steps for obtaining the abnormality level assessment result are: Based on the overall deviation degree P, by the formula: Calculate the data anomaly level L, where P is the overall deviation degree, L is the data anomaly level, σ L is the sensitivity adjustment parameter, μ L is the midpoint parameter, δ L is the scale adjustment parameter, e is the base of the natural logarithm; Based on the data anomaly level L, the degree of data anomaly is evaluated according to the size of L to obtain an anomaly level evaluation result.

7. The data security detection method according to claim 1, It is characterized in that The steps for obtaining the data security detection and evaluation results are as follows: Based on the equipment risk assessment result and the abnormality level assessment result, extract the equipment risk level R and the data abnormality level L to obtain equipment data security association information; Based on the device data security association information, the formula is: Calculate the data security score Z, where R is the risk level of the device, L is the abnormal level of the data, Z is the data security score, γ Z and δ Z is the adjustment coefficient, e is the base of the natural logarithm; Based on the security score Z of the data, it is compared with the preset security standard to evaluate the overall security level of the device data and obtain the data security detection and evaluation result.

8. A data security detection device, It is characterized in that According to any one of claims 1 to 7, the data security detection method comprises: The equipment risk analysis module evaluates the risk level of data equipment based on the operating status of the data equipment, the network environment of the data equipment, the access equipment information and the number of abnormal software, and obtains the equipment risk assessment results; The data importance analysis module calculates the importance score of the data based on the information of the data to be detected, according to the type and file size of the data to be detected, and obtains the data importance assessment result; The detection threshold adjustment module adjusts the data anomaly detection threshold based on the device risk assessment result and the data importance assessment result to obtain an anomaly detection threshold adjustment result; The data anomaly rating module detects the access behavior of the data based on the anomaly detection threshold adjustment result, compares it with the adjusted anomaly detection threshold, calculates the degree of deviation, evaluates the anomaly level, and obtains the anomaly level evaluation result; The data security assessment module assesses the overall security level of the device data based on the device risk assessment result and the abnormality level assessment result to obtain a data security detection assessment result.

Images