A security assessment information processing method and system

Abstract

The present invention discloses a security assessment information processing method and system, which specifically relates to the field of information assessment technology, and is used to solve the problem of potential hidden dangers in the accuracy of existing security assessment results. Information entropy is used to analyze the complexity of assessment data, and the uncertainty and complexity in the data verification process are quantified. The application of formal verification tools and model detection technology ensures the integrity and consistency of the assessment logic, and comprehensively analyzes the complexity required to verify the authenticity of assessment data and the potential degree of logical conflicts in the security assessment process, so that the credibility of the security assessment report is scientifically and systematically evaluated. By obtaining the frequency of non-compliance with the credibility of historical security assessment reports and the degree of geographical dispersion of backup data, the security assessment cycle is dynamically adjusted, the utilization efficiency of assessment resources is improved, the waste of resources caused by excessive assessment is avoided, and the continuous security and stability of the system are ensured.

Description

Technical Field

[0001] The present invention relates to the field of information evaluation technology, and more specifically, to a security evaluation information processing method and system. Background Art

[0002] Information security level protection assessment, also known as information security level protection assessment, is an activity conducted by a qualified assessment organization to test and assess the security level protection status of information systems in accordance with the national information security level protection regulations. It aims to assess the security of information systems and assign corresponding security levels based on the assessment results.

[0003] When conducting security assessments on the data backup functions of critical infrastructure such as power grid systems, transportation systems, and water resource management systems, predetermined rules and standards are usually followed. Although this method helps to systematically identify known security risks, if there are potential risks in the accuracy of the security assessment results, it may lead to failure to fully identify and prevent complex security risks, and may lead to the omission of key security vulnerabilities. In the event of an attack or system failure, it may not be able to recover effectively. In severe cases, it may even cause the entire system to collapse and cause service interruptions.

[0004] In order to solve the above problems, a technical solution is now provided. Summary of the invention

[0005] In order to overcome the above-mentioned defects of the prior art, an embodiment of the present invention provides a method and system for processing information of security assessment to solve the problems raised in the above-mentioned background technology.

[0006] To achieve the above object, the present invention provides the following technical solutions:

[0007] A method for processing information of security assessment includes the following steps:

[0008] Conduct security assessment on data backup functions according to the pre-defined rules and standards, and generate security assessment reports;

[0009] Analyze the complexity of assessment data through information entropy and evaluate the complexity required to verify the authenticity of assessment data during the security assessment process;

[0010] Use formal verification tools to model the evaluation logic, apply model checking technology to analyze rule behavior, and use graph theory to evaluate the potential degree of logical conflicts in the security evaluation process;

[0011] By comprehensively analyzing the complexity required to verify the authenticity of the assessment data during the security assessment process and the potential degree of logical conflicts, we can determine whether the credibility of the security assessment report meets the standards.

[0012] When the credibility of the security assessment report meets the requirements, the security assessment report is output;

[0013] Obtain the frequency of historical medium-level security assessment reports that fail to meet the credibility standards; obtain the degree of geographical dispersion of backup data; adjust the security assessment cycle based on the degree of geographical dispersion of backup data and the frequency of historical medium-level security assessment reports that fail to meet the credibility standards.

[0014] In a preferred embodiment, according to the predetermined rules and standards of the security assessment, the data backup function is evaluated for security protection, and a security assessment report is generated, including the following steps:

[0015] Formulate detailed evaluation criteria and rules according to national laws and industry standards;

[0016] Collect information about the data backup system, including configuration, policies, and historical operation records, and perform preliminary analysis;

[0017] Conduct on-site inspections of backup data storage locations and evaluate physical security measures; test the recovery capabilities of backup systems by simulating attacks and failures;

[0018] Comprehensively analyze various evaluation data and generate security evaluation reports.

[0019] In a preferred embodiment, the complexity of the evaluation data is analyzed by information entropy to evaluate the complexity required to verify the authenticity of the evaluation data during the security evaluation process, specifically:

[0020] Collect backup data, process missing values, duplicate values, and outliers, and discretize the backup data;

[0021] The backup data includes timestamp, file size, file type and source address;

[0022] Statistics on the frequency of each backup data: , count each value Frequency of occurrence ;

[0023] Calculate the probability of taking each type of backup data: ;in, is the probability of taking value; is the total number of observations; is the index of the value;

[0024] Calculate backup data Information entropy: ;in, To backup data The information entropy of It is backup data The total number of values ​​of ;

[0025] Determine the weight coefficient for each backup data , calculate the weighted comprehensive entropy value of the evaluation: ;in, is the weighted comprehensive entropy value for evaluation, They are the quantity and number of the backup data respectively.

[0026] In a preferred embodiment, the evaluation logic is modeled by a formal verification tool, the rule behavior is analyzed by applying the model checking technology, and the potential degree of logic conflict in the security evaluation process is evaluated by using the graph theory, specifically:

[0027] Extract key parameters, including backup frequency, data integrity verification mechanism, and access control rules;

[0028] Use formal language to define the relationships and constraints between key parameters; define the evaluation logic through formal language;

[0029] Convert the formal model into a state machine; define the transition rules between states based on the logic of backup operations; use model checking tools to check whether the model meets all predefined specifications;

[0030] Convert the parameters and rules in the evaluation logic into nodes and edges of the graph; use graph theory algorithms to identify and analyze logical conflicts;

[0031] Calculate the conflict degree index, the expression is: ;in, is the conflict intensity index, is the set of nodes in the graph, Is with the node The set of adjacent nodes, is the edge weight, and Represents a node in the graph.

[0032] In a preferred embodiment, a comprehensive analysis is performed on the complexity required to verify the authenticity of the assessment data and the potential degree of logical conflicts during the security assessment process to determine whether the credibility of the security assessment report meets the standards, specifically:

[0033] The weighted comprehensive entropy value of the assessment and the conflict degree index are normalized, and the normalized weighted comprehensive entropy value of the assessment and the conflict degree index are assigned preset proportional coefficients respectively, and the report credibility evaluation coefficient is calculated;

[0034] Set the report credibility assessment threshold and compare the report credibility assessment coefficient with the report credibility assessment threshold:

[0035] When the report credibility assessment coefficient is less than or equal to the report credibility assessment threshold, the credibility of the security assessment report is determined to meet the standard, and the security assessment report is determined to be output;

[0036] When the report credibility assessment coefficient is greater than the report credibility assessment threshold, it is determined that the credibility of the security assessment report does not meet the standard.

[0037] In a preferred embodiment, the frequency of non-compliance of the credibility of the historical medium-level security assessment report is obtained, specifically:

[0038] The ratio of the number of times the credibility of the security assessment report fails to meet the standard to the total number of security assessment reports is marked as the frequency of failure to meet the standard;

[0039] Gets the degree of geographic dispersion of the backup data, specifically:

[0040] Collect the specific geographic locations of all data centers; convert the specific geographic locations of the data centers into geographic coordinates;

[0041] Calculate the actual distance between data centers using geographic coordinates; average all calculated actual distances between data centers to obtain an average dispersion distance;

[0042] The geographic dispersal index was calculated based on the ratio of the average dispersal distance to the benchmark distance.

[0043] In a preferred embodiment, the security assessment cycle is adjusted according to the degree of geographical dispersion of the backup data and the frequency of non-compliance of the credibility of the historical security assessment reports, specifically:

[0044] Get the basic evaluation cycle; set the geographical dispersion adjustment factor and the evaluation failure frequency adjustment factor;

[0045] The basic assessment cycle is adjusted through the geographical dispersion adjustment coefficient and the assessment non-compliance frequency adjustment coefficient.

[0046] On the other hand, the present invention provides a security assessment information processing system, including an assessment report generation module, a data complexity assessment module, a logic conflict assessment module, a report compliance assessment module, an assessment report output module and an assessment cycle adjustment module;

[0047] The evaluation report generation module performs a security evaluation on the data backup function according to the predetermined rules and standards of the security evaluation, and generates a security evaluation report;

[0048] The data complexity assessment module uses information entropy analysis to assess data complexity and evaluate the degree of complexity required to verify the authenticity of assessment data during the security assessment process.

[0049] The logic conflict assessment module uses formal verification tools to model the assessment logic, applies model detection technology to analyze rule behavior, and uses graph theory to assess the potential degree of logic conflicts in the security assessment process.

[0050] The report compliance assessment module conducts a comprehensive analysis of the complexity required to verify the authenticity of the assessment data during the security assessment process and the potential degree of logical conflicts to determine whether the credibility of the security assessment report meets the requirements;

[0051] When the credibility of the security assessment report meets the standard, the assessment report output module outputs the security assessment report;

[0052] The assessment cycle adjustment module obtains the frequency of historical medium security assessment reports that fail to meet the credibility standards; obtains the degree of geographical dispersion of backup data; and adjusts the security assessment cycle based on the degree of geographical dispersion of backup data and the frequency of historical medium security assessment reports that fail to meet the credibility standards.

[0053] The technical effects and advantages of the security assessment information processing method and system of the present invention are as follows:

[0054] 1. Using information entropy to analyze the complexity of assessment data can quantify the uncertainty and complexity in the data verification process, which helps to identify potential problems and vulnerabilities at an early stage. The application of formal verification tools and model detection technology ensures the integrity and consistency of the assessment logic, can comprehensively discover logical errors in the system and correct them, and reduce the interference of human factors. By evaluating logical conflicts through graphical theory, complex dependencies and potential conflict points can be intuitively revealed and quantified, providing a systematic way to solve problems. By comprehensively analyzing the degree of complexity required to verify the authenticity of assessment data during the security assessment process and the potential degree of logical conflicts, the credibility of the security assessment report is scientifically and systematically evaluated to ensure its accuracy and reliability.

[0055] 2. By obtaining the frequency of non-compliance with the credibility of historical medium-level security assessment reports and the degree of geographical dispersion of backup data, the security assessment cycle can be dynamically adjusted. This dynamic adjustment mechanism based on actual conditions not only improves the utilization efficiency of assessment resources and avoids resource waste caused by excessive assessment, but also ensures the continuous security and stability of the system. This method provides an agile security management means to help organizations respond to new threats and challenges in a timely manner and improve the overall security management effect and resilience. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Figure 1 The present invention is a schematic diagram of a method for processing information of security assessment.

[0057] Figure 2 The present invention is a structural diagram of a security assessment information processing system. DETAILED DESCRIPTION

[0058] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0059] The present invention comprehensively reflects the key links of information processing of security assessment through a series of systematic steps. First, the security assessment of the data backup function is carried out according to predetermined rules and standards, and a detailed report is generated. Then, the complexity of the assessment data is evaluated through information entropy analysis to ensure the authenticity and integrity of data verification. The application of formal verification tools and model detection technology, combined with graph theory, can further identify and analyze the potential risks of logical conflicts. Comprehensively analyze data complexity and logical conflicts to judge the credibility of the assessment report. Dynamically adjust the assessment cycle based on the frequency of historical assessment reports that do not meet the credibility standards and the geographical dispersion of backup data. This process not only ensures the accuracy and reliability of the assessment results, but also optimizes the assessment frequency and resource allocation through the analysis of historical data and geographical dispersion, thereby improving the efficiency and benefits of overall information processing.

[0060] Embodiment 1

[0061] Figure 1 The present invention provides a method for processing information of security assessment, which comprises the following steps:

[0062] According to the predetermined rules and standards of the security assessment, the data backup function is evaluated and a security assessment report is generated.

[0063] The complexity of assessment data is analyzed through information entropy, and the degree of complexity required to verify the authenticity of assessment data during the security assessment process is evaluated.

[0064] The evaluation logic is modeled through formal verification tools, the rule behavior is analyzed using model checking technology, and the potential degree of logical conflicts in the security evaluation process is evaluated using graph theory.

[0065] By comprehensively analyzing the degree of complexity required to verify the authenticity of the assessment data during the security assessment process and the potential degree of logical conflicts, we can determine whether the credibility of the security assessment report meets the standards.

[0066] When the credibility of the security assessment report meets the requirements, the security assessment report is output.

[0067] Obtain the frequency of historical medium-level security assessment reports that fail to meet the credibility standards; obtain the degree of geographical dispersion of backup data; adjust the security assessment cycle based on the degree of geographical dispersion of backup data and the frequency of historical medium-level security assessment reports that fail to meet the credibility standards.

[0068] According to the rules and standards of the security assessment, the data backup function is evaluated and a security assessment report is generated, including the following steps:

[0069] According to national regulations and industry standards, formulate detailed evaluation criteria and rules covering all aspects of data backup.

[0070] Collect information about the data backup system, including configuration, policies, and historical operation records, and perform preliminary analysis.

[0071] Conduct on-site inspections of backup data storage locations and evaluate physical security measures; test the recovery capabilities of backup systems by simulating attacks and failures.

[0072] Comprehensively analyze various evaluation data and generate a security assessment report containing detailed results and improvement suggestions.

[0073] Specifically:

[0074] Define the evaluation scope of the data backup system, including physical facilities, software configuration, backup strategy, data transmission and storage, etc.

[0075] Establish specific rules and standards for each evaluation item, such as backup frequency, data encryption standards, data integrity verification methods, etc.

[0076] Write a detailed assessment manual that includes the assessment steps, required tools, evaluation indicators and scoring criteria.

[0077] Collect hardware facility information of the data backup system, including servers, storage devices, and network equipment.

[0078] Obtain software configuration and version information, including operating system, backup software, database system, etc.

[0079] Collect and review backup policy documentation to understand backup frequency, retention policy, encryption measures, etc.

[0080] Obtain backup and recovery operation logs and analyze the integrity and correctness of historical operations.

[0081] Organize and classify the collected data to build the database required for evaluation.

[0082] Perform an initial basic assessment to identify obvious configuration errors and policy gaps.

[0083] Conduct on-site inspections of data centers and backup storage locations to assess physical security measures, including access control systems, surveillance facilities, fire and water protection measures, etc.

[0084] Evaluate the data center's environmental control systems, such as temperature, humidity, power supply, and ventilation systems, to ensure the hardware facilities operate in a safe environment.

[0085] Test the backup system's defense capabilities and recovery speed by simulating cyber attacks and physical intrusions.

[0086] Simulate hardware failures, software crashes, and data corruption to test backup system recovery capabilities and data integrity.

[0087] Conduct data recovery drills regularly to verify the integrity of backup data and the operability of the recovery process.

[0088] Summarize the results of each evaluation link, including on-site inspection, system testing, data complexity and authenticity verification.

[0089] Perform comprehensive analysis of the aggregated data to identify the strengths and weaknesses of the backup system and assess overall security.

[0090] Develop the structure of the evaluation report, including the introduction, evaluation methods, evaluation results, problem analysis and improvement suggestions.

[0091] Write a detailed evaluation report, ensure that the content is detailed, the logic is clear, the data is accurate, and provide intuitive charts and analysis results.

[0092] The evaluation report comprehensively displays all aspects and results of the evaluation, helping management to fully understand the security status of the backup system. Through specific data and analysis results, targeted improvement suggestions are put forward to help improve the security and reliability of the data backup system.

[0093] The complexity of the evaluation data is analyzed through information entropy, and the degree of complexity required to verify the authenticity of the evaluation data during the security evaluation process is evaluated, specifically:

[0094] When conducting security assessments on the data backup functions of critical infrastructure (such as power grid systems, transportation systems, and water resource management systems), data complexity is a key indicator. Information entropy analysis is an effective method to quantify the complexity of data and thus assess the complexity required to verify data authenticity during security assessments.

[0095] Collect backup data, including timestamp, file size, file type, and source address.

[0096] Handle missing values, duplicate values, and outliers to ensure data integrity and accuracy.

[0097] The backup data is discretized to adapt to the calculation of information entropy. The discretization method can adopt equal-width binning or equal-frequency binning.

[0098] Timestamp: The time when data is backed up. The unit can be seconds, minutes, hours, etc.

[0099] File Size: The size of the backup file, which can be in bytes, kilobytes, megabytes, etc.

[0100] File Type: The type of file, such as text file, image file, video file, etc.

[0101] Source Address: The source address of the data, such as IP address, device ID, etc.

[0102] Count the value frequency of each backup data (the number of times a certain value appears in the data set): , count each value Frequency of occurrence .

[0103] Calculate the probability of each backup data value (the frequency of a value divided by the total number of observations): ;in, is the probability of taking value; is the total number of observations; It is the index of a value, indicating the position or sequence number of a specific value in a set of data. For example, suppose a backup data (such as a file type) has three different values ​​(such as text files, image files, and video files). It can be 1, 2, or 3, corresponding to these three values.

[0104] Use the information entropy formula: ;in, To backup data The information entropy of It is backup data The total number of values, that is, the backup data The number of different possible values.

[0105] Determine the weight coefficient of each backup data based on the importance and information entropy of the backup data , use the weight coefficient to calculate the evaluation weighted comprehensive entropy value, the expression is: ;in, is the weighted comprehensive entropy value for evaluation, They are the quantity and number of the backup data respectively.

[0106] The larger the evaluation weighted comprehensive entropy value, the higher the complexity and uncertainty of the data backup system, and the higher the complexity required to verify the authenticity of the evaluation data during the security evaluation process. This means that the diversity of data attributes and the amount of information are large, which may indicate more complex data management and higher potential risks. Increased complexity may lead to more errors in data processing and verification, especially in an environment with insufficient automation. Through information entropy analysis, the complexity of data can be comprehensively evaluated, thereby providing quantitative indicators for the complexity required to verify the authenticity of data during the security evaluation process.

[0107] The evaluation logic is modeled by formal verification tools, the rule behavior is analyzed by applying model checking technology, and the potential degree of logical conflicts in the security evaluation process is evaluated by using graph theory. Specifically:

[0108] Extract key parameters from the backup system's configuration, operation, and maintenance records, such as backup frequency, data integrity verification mechanism, access control rules, etc.

[0109] Use a formal language (such as Z language, VDM or B method) to define the relationships and constraints between these key parameters.

[0110] Defining the evaluation logic in a formal language can accurately describe the system behavior and avoid ambiguity and vagueness. The formal model helps to systematically understand and analyze the logical structure of the backup system and ensure the integrity of the logic.

[0111] The backup frequency, data integrity verification mechanism, and access control rules are explained as follows:

[0112] Backup frequency: Defines how often data backup operations are performed.

[0113] Data integrity verification: Describes the techniques or strategies used to ensure the integrity of backup data.

[0114] Access control rules: Define who can access the backup data and under what conditions.

[0115] Convert the formal model into a state machine where each state represents a possible configuration of the system.

[0116] Based on the logic of the backup operation, define the transition rules between states.

[0117] Use a model checking tool (such as SPIN or NuSMV) to check whether the model meets all predefined specifications (such as safety and liveness).

[0118] The formula for the result state is: ;in, Indicates the current state. Indicates the action to be performed. is the transfer function, Is the result state.

[0119] Model checking can fully explore the state space to ensure that all possible logical errors are found. This process is automated, reducing human errors and omissions.

[0120] The parameters and rules in the evaluation logic are converted into nodes and edges of the graph, where nodes represent parameters and edges represent dependencies between parameters.

[0121] Use graph theory algorithms (e.g., shortest path, maximum flow) to identify and analyze logical conflicts.

[0122] Calculate the conflict degree index, the expression is: ;in, is the conflict intensity index, is the set of nodes in the graph (each node represents an evaluation parameter or logic rule), Is with the node The set of adjacent nodes (i.e., nodes directly connected to Other nodes that have dependencies. ), is the edge weight, and Represents a node in the graph.

[0123] Among them, the node : In this model, represents the center point of a particular logic or parameter being evaluated. This means that all directly related Associated other nodes (logical or parameter) to evaluate all potential conflicts related to this node.

[0124] node :node is with One of a set of directly associated (or adjacent) nodes. In a graph, and There is an edge between them, which means there is a direct logical relationship or dependency between the two. In actual security assessment, this may refer to the dependency between two parameters, for example, the configuration of one parameter may depend on or affect the setting of another parameter.

[0125] is the edge weight function, which quantifies the node and The potential conflict between the two parameters or logics. This weight indicates the compatibility or conflict probability between the two parameters or logics. The higher the weight, the greater the possibility of conflict between the two.

[0126] Through the graphical representation, we can intuitively see the dependencies and potential conflict points between parameters. Graph algorithms provide a flexible way to quantify and analyze complex dependencies and conflicts.

[0127] The larger the conflict degree index is, the greater the potential degree of logical conflict in the security assessment process is, which means that the smallest value of the sum of the conflict degrees of all possible nodes and their adjacent nodes in the system is relatively high, indicating that the whole system generally has a higher degree of logical conflict.

[0128] The comprehensive application of formal verification, model checking and graph theory can be used to judge the credibility of the security assessment report. First, formal verification ensures the accurate description and consistency of the assessment logic. By strictly defining parameters and rules, it greatly reduces errors caused by ambiguity or misunderstanding. Secondly, by comprehensively exploring the state space, model checking technology can systematically discover and correct logical errors, ensuring the integrity and correctness of the assessment process. Finally, the application of graph theory reveals the dependencies and potential conflicts between parameters, providing an intuitive and quantitative way to evaluate the degree of logical conflicts. By identifying and analyzing potential conflicts in the system, it helps to optimize system configuration and improve system stability, thereby improving the overall credibility of the assessment report. A high conflict degree index indicates that there are many potential problems in the system, which suggests that further optimization or adjustment is needed to reduce conflicts and improve system efficiency and security. It not only enhances the judgment of the credibility of the security assessment report, but also provides practical guidance for system improvement, making the entire assessment process more transparent and reliable. By timely discovering and resolving logical conflicts in the system, future problems can be effectively prevented, ensuring that the data backup function of critical infrastructure meets security standards, thereby maintaining the continuous operation of the system and the integrity of the data. Ensure that the results of assessment activities are accurate and credible, and support the formulation of key decisions and improvement measures.

[0129] Through comprehensive analysis of the complexity required to verify the authenticity of the assessment data and the potential degree of logical conflicts during the security assessment process, we can determine whether the credibility of the security assessment report meets the standards. Specifically:

[0130] The weighted comprehensive entropy value and conflict degree index of the assessment are normalized, and the preset proportional coefficients are assigned to the normalized weighted comprehensive entropy value and conflict degree index respectively. The report credibility assessment coefficient is calculated to determine whether the credibility of the security assessment report meets the standards.

[0131] The specific implementation method of calculating the above-mentioned report credibility assessment coefficient is not specifically limited here. Any method that can calculate the report credibility assessment coefficient by assigning the normalized evaluation weighted comprehensive entropy value and the conflict degree index to preset proportional coefficients respectively is acceptable. In order to implement the technical solution of the present invention, the present invention provides a specific method for calculating the report credibility assessment coefficient.

[0132] The expression for reporting the credibility assessment coefficient is: ;in, To report the confidence estimate coefficient, are the normalized weighted comprehensive entropy value and conflict degree index of the evaluation, are the preset proportional coefficients for evaluating the weighted comprehensive entropy value and the conflict degree index, respectively, and Both are greater than 0.

[0133] Among them, the setting of the preset proportionality coefficient is usually based on historical data analysis, expert opinions and experimental test results. When determining these coefficients, the influence and importance of each indicator (such as the weighted comprehensive entropy value of the assessment and the conflict degree index) on the assessment results are mainly considered. For example, if historical data shows that the weighted comprehensive entropy value of the assessment has a greater impact on the credibility of the security assessment, the proportionality coefficient of this indicator should be relatively high. In addition, a large amount of historical assessment data can be analyzed through machine learning methods, such as regression analysis or decision trees, so as to learn the proportionality coefficient that best reflects the weight of the factors affecting the credibility of the assessment. The setting of this coefficient also needs to be reviewed and adjusted regularly to ensure that it remains relevant and accurate as the environment changes and new data. Through this dynamic adjustment, it is ensured that the assessment model can always reflect the current security situation and assessment needs.

[0134] According to the expression of the report credibility assessment coefficient, the larger the report credibility assessment coefficient, the lower the credibility of the security assessment report. The evaluation weighted comprehensive entropy value and conflict degree index reflect the complexity and potential logical conflicts of the system respectively. Higher evaluation weighted comprehensive entropy value and conflict degree index indicate that the system faces greater complexity and conflict, resulting in increased challenges in verifying authenticity and accuracy. Therefore, if the report credibility assessment coefficient is large, it means that the assessment faces more difficulties and uncertainties, resulting in a lower credibility of the security assessment report. This reflects that the potential risks and problems of the system may affect the accuracy and reliability of the assessment results.

[0135] Set the report credibility assessment threshold and compare the report credibility assessment coefficient with the report credibility assessment threshold:

[0136] When the report credibility assessment coefficient is less than or equal to the report credibility assessment threshold, the credibility of the security assessment report is determined to meet the standard, and the output security assessment report is determined; this indicates that the system configuration and operation displayed in the security assessment report meet security expectations, the system complexity and potential conflicts are within an acceptable range, and the report results are considered reliable.

[0137] When the report credibility assessment coefficient is greater than the report credibility assessment threshold, the credibility of the security assessment report is judged to be unsatisfactory; this indicates that the security assessment report reveals that the system has excessive complexity or potential conflicts, which may hinder the accurate assessment of the system status and result in insufficient credibility of the report.

[0138] When the credibility of the security assessment report is determined to be unsatisfactory, take the following measures:

[0139] Problem Diagnosis: Drill down to the cause of an above-threshold level to identify specific problem areas, such as specific configuration errors, policy conflicts, or outdated security measures.

[0140] Immediate Correction: Develop corrective measures for identified issues, prioritizing those that have the greatest impact on system security.

[0141] Strengthen training and publicity: Improve the relevant personnel's awareness and implementation capabilities of safety policies to avoid operational errors that increase system risks.

[0142] Re-evaluation: After the problem is solved, re-conduct the security assessment to verify whether the problem has been effectively solved and ensure that the assessment results meet security requirements.

[0143] The setting of the report trustworthiness assessment threshold is usually based on multiple factors: historical data, expert experience, industry standards, and expected security requirements. By statistically analyzing historical security assessment data, the distribution of report trustworthiness assessment coefficients under different configurations and conditions can be obtained. Based on these data and current security trends, the expert group sets a reasonable threshold that should be able to effectively distinguish which assessment results are reliable. In addition, taking into account industry standards and specific security policies, the threshold should also be consistent with current technical and regulatory requirements to ensure that all passed reports meet the minimum security standards.

[0144] Obtain the frequency of historical medium-level security assessment reports that do not meet the credibility standards, specifically:

[0145] Statistics are collected on the credibility judgment results of the security assessment reports of the data backup function of the critical infrastructure in the past. The ratio of the number of times that the credibility of the security assessment reports fails to meet the standards to the total number of security assessment reports is marked as the frequency of failure to meet the standards. The greater the frequency of failure to meet the standards, the higher the frequency of failure to meet the credibility of the security assessment reports in history.

[0146] Gets the degree of geographic dispersion of the backup data, specifically:

[0147] Geographically dispersed backups are an important risk management strategy that aims to ensure that backups in other regions can guarantee the continuity of data and services in the event of natural disasters, political unrest, cyber attacks or other events that may cause data loss in one location. Businesses and organizations need to ensure that they can continue to operate under any conditions. By storing data backups in different geographical locations, services can be quickly restored in the event of a facility failure in one region, thereby maintaining business continuity.

[0148] Collect the specific geographic location of all data centers, including country, city, and even specific address.

[0149] Collect detailed information about each data center's backup strategy, including backup frequency, backup type (full, incremental, differential, etc.), and the size of the backup data.

[0150] By collecting comprehensive geographic location and backup strategy data, you can ensure accurate and comprehensive analysis.

[0151] Convert the specific geographic location of the data center into geographic coordinates (latitude and longitude).

[0152] Use geographic coordinates to calculate the actual distance between data centers. The Haversine formula can be used to calculate the distance between two points on a sphere.

[0153] The actual distances between all calculated data centers are averaged to obtain the average dispersion distance.

[0154] The geographic dispersion index is calculated based on the ratio of the average dispersion distance to a certain base distance. For example, the base distance can be set to 100 kilometers and the actual average dispersion distance can be divided by this base distance.

[0155] A larger geographic dispersion index indicates that the average distance between backup data centers is greater, meaning that the data is dispersed over a wider geographical range. In this case, a higher degree of geographic dispersion of backup data can provide stronger disaster recovery capabilities because the data is less likely to be affected by events in the same geographical area at the same time.

[0156] The smaller the geographic dispersion index, the more concentrated all backup data centers are and the smaller the geographic area. In this case, the geographic dispersion is low, which may increase the risk of affecting the entire backup system due to problems in a single region.

[0157] According to the degree of geographical dispersion of backup data and the frequency of non-compliance of historical medium-level security assessment reports, the security assessment cycle is adjusted as follows:

[0158] Obtain a basic measurement cycle (for example, conduct an assessment every 6 months). This basic measurement cycle can be based on industry standards, regulatory requirements, or the company's historical experience.

[0159] When the geographical dispersion index is large, it means that the data backup is widely distributed and the system redundancy is high, so the evaluation cycle can be appropriately extended. On the contrary, when the geographical dispersion index is small, the evaluation cycle should be shortened.

[0160] If the frequency of non-compliance is high, it means that many problems were found in the past evaluations, and the evaluation cycle needs to be shortened to strengthen monitoring. On the contrary, if the frequency of non-compliance is low, the evaluation cycle can be appropriately extended.

[0161] Therefore, the geographical dispersion adjustment coefficient and the assessment failure frequency adjustment coefficient are set.

[0162] The basic evaluation cycle can be adjusted by adjusting the geographical dispersion adjustment coefficient and the evaluation failure frequency adjustment coefficient. The basic evaluation cycle can be adjusted by the following formula: ;in, is the adjusted basic evaluation cycle. It is the basic evaluation cycle. They are the geographical dispersion adjustment factor and the assessment failure frequency adjustment factor.

[0163] The geographic dispersion adjustment factor is an adjustment factor based on the geographic dispersion index, which can usually be set as a constant multiple (for example, 10% of the geographic dispersion index). The frequency adjustment factor for non-compliance with the assessment is an adjustment factor based on the frequency of non-compliance with the assessment, which can usually be set as a constant multiple (for example, 20% of the frequency of non-compliance with the assessment).

[0164] By dynamically adjusting the security assessment cycle according to the degree of geographical dispersion of backup data and the frequency of non-compliance of historical security assessment reports, the security and operational efficiency of the system can be significantly improved. Specifically, the setting of the geographical dispersion adjustment coefficient and the frequency adjustment coefficient of non-compliance of assessments makes the assessment cycle more flexible and can be optimized according to actual conditions. When the geographical dispersion index is large, it indicates that the backup data is widely distributed and the system has high redundancy and fault tolerance. The assessment cycle can be appropriately extended to reduce unnecessary resource consumption. When the frequency of non-compliance of assessments is high, it reflects that there are many problems in the system and more frequent assessments are needed to timely discover and resolve potential safety hazards. Through this dynamic adjustment mechanism, not only can the high standards of security and reliability of the data backup system be ensured, but also the utilization of assessment resources can be effectively balanced to avoid the waste of resources caused by excessive assessments.

[0165] Embodiment 2

[0166] The difference between Example 2 of the present invention and Example 1 is that this example introduces an information processing system for security assessment.

[0167] Figure 2 A structural schematic diagram of a security assessment information processing system of the present invention is given, which includes an assessment report generation module, a data complexity assessment module, a logic conflict assessment module, a report compliance assessment module, an assessment report output module and an assessment cycle adjustment module.

[0168] The evaluation report generation module performs a security assessment on the data backup function according to the predetermined rules and standards for security assessment and generates a security assessment report.

[0169] The data complexity assessment module measures data complexity through information entropy analysis and evaluates the degree of complexity required to verify the authenticity of assessment data during the security assessment process.

[0170] The logic conflict assessment module uses formal verification tools to model the assessment logic, applies model checking technology to analyze rule behavior, and uses graph theory to assess the potential degree of logic conflicts in the security assessment process.

[0171] The report compliance assessment module conducts a comprehensive analysis of the complexity required to verify the authenticity of the assessment data during the security assessment process and the potential degree of logical conflicts to determine whether the credibility of the security assessment report meets the requirements.

[0172] When the credibility of the security assessment report meets the requirements, the assessment report output module outputs the security assessment report.

[0173] The assessment cycle adjustment module obtains the frequency of historical medium security assessment reports that fail to meet the credibility standards; obtains the degree of geographical dispersion of backup data; and adjusts the security assessment cycle based on the degree of geographical dispersion of backup data and the frequency of historical medium security assessment reports that fail to meet the credibility standards.

[0174] The above formulas are all dimensionless and numerical calculations. The formula is a formula for the most recent real situation obtained by collecting a large amount of data and performing software simulation. The preset parameters and thresholds in the formula are set by technicians in this field according to actual conditions.

[0175] The above embodiments may be implemented in whole or in part by software, hardware, firmware or any other combination thereof. When implemented by software, the above embodiments may be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or may be transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from one website, computer, server or data center to another website, computer, server or data center by wired (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that contains one or more available media sets. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium. The semiconductor medium may be a solid-state hard disk.

[0176] Those of ordinary skill in the art will appreciate that the modules and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0177] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and modules described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0178] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the modules is only a logical function division. There may be other division methods in actual implementation, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or modules, which can be electrical, mechanical or other forms.

[0179] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical modules, and may be located in one place or distributed on multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0180] In addition, each functional module in each embodiment of the present application may be integrated into one processing module, or each module may exist physically separately, or two or more modules may be integrated into one module.

[0181] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage media include: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, and other media that can store program codes.

[0182] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0183] Finally: The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for processing information of security assessment, characterized in that: The steps include: Conduct security assessment on data backup functions according to the pre-defined rules and standards, and generate security assessment reports; Analyze the complexity of assessment data through information entropy and evaluate the complexity required to verify the authenticity of assessment data during the security assessment process; Use formal verification tools to model the evaluation logic, apply model checking technology to analyze rule behavior, and use graph theory to evaluate the potential degree of logical conflicts in the security evaluation process; By comprehensively analyzing the complexity required to verify the authenticity of the assessment data during the security assessment process and the potential degree of logical conflicts, we can determine whether the credibility of the security assessment report meets the standards. When the credibility of the security assessment report meets the requirements, the security assessment report is output; Obtain the frequency of historical medium-level security assessment reports that fail to meet the credibility standards; obtain the degree of geographical dispersion of backup data; adjust the security assessment cycle based on the degree of geographical dispersion of backup data and the frequency of historical medium-level security assessment reports that fail to meet the credibility standards; The complexity of the evaluation data is analyzed through information entropy, and the degree of complexity required to verify the authenticity of the evaluation data during the security evaluation process is evaluated, specifically: Collect backup data, process missing values, duplicate values, and outliers, and discretize the backup data; The backup data includes timestamp, file size, file type and source address; Statistics on the frequency of each backup data: , count each value Frequency of occurrence ; Calculate the probability of taking each type of backup data: ;in, is the probability of taking value; is the total number of observations; is the index of the value; Calculate backup data Information entropy: ;in, To backup data The information entropy of It is backup data The total number of values ​​of ; Determine the weight coefficient for each backup data , calculate the weighted comprehensive entropy value of the evaluation: ;in, is the weighted comprehensive entropy value for evaluation, They are the quantity and number of the backup data respectively. Indicates backup data; The evaluation logic is modeled by formal verification tools, the rule behavior is analyzed by applying model checking technology, and the potential degree of logical conflicts in the security evaluation process is evaluated by using graph theory. Specifically: Extract key parameters, including backup frequency, data integrity verification mechanism, and access control rules; Use formal language to define the relationships and constraints between key parameters; define the evaluation logic through formal language; Convert the formal model into a state machine; define the transition rules between states based on the logic of backup operations; use model checking tools to check whether the model meets all predefined specifications; Convert the parameters and rules in the evaluation logic into nodes and edges of the graph; use algorithms in graph theory to identify and analyze logical conflicts; Calculate the conflict degree index, the expression is: ;in, is the conflict intensity index, is the set of nodes in the graph, Is with the node The set of adjacent nodes, is the edge weight, and Represents a node in the graph.

2. A method for processing information of security assessment according to claim 1, characterized in that: According to the rules and standards of the security assessment, the data backup function is evaluated and a security assessment report is generated, including the following steps: Formulate detailed evaluation criteria and rules according to national laws and industry standards; Collect information about the data backup system, including configuration, policies, and historical operation records, and perform preliminary analysis; Conduct on-site inspections of backup data storage locations and evaluate physical security measures; test the recovery capabilities of backup systems by simulating attacks and failures; Comprehensively analyze various evaluation data and generate security evaluation reports.

3. The method for processing information of security assessment according to claim 1, characterized in that: Through comprehensive analysis of the complexity required to verify the authenticity of the assessment data and the potential degree of logical conflicts during the security assessment process, we can determine whether the credibility of the security assessment report meets the standards. Specifically: The weighted comprehensive entropy value of the assessment and the conflict degree index are normalized, and the normalized weighted comprehensive entropy value of the assessment and the conflict degree index are assigned preset proportional coefficients respectively, and the report credibility evaluation coefficient is calculated; Set the report credibility assessment threshold and compare the report credibility assessment coefficient with the report credibility assessment threshold: When the report credibility assessment coefficient is less than or equal to the report credibility assessment threshold, the credibility of the security assessment report is determined to meet the standard, and the security assessment report is determined to be output; When the report credibility assessment coefficient is greater than the report credibility assessment threshold, it is determined that the credibility of the security assessment report does not meet the standard.

4. The method for processing information of security assessment according to claim 1, characterized in that: Obtain the frequency of historical medium-level security assessment reports that do not meet the credibility standards, specifically: The ratio of the number of times the credibility of the security assessment report fails to meet the standard to the total number of security assessment reports is marked as the frequency of failure to meet the standard; Gets the degree of geographic dispersion of the backup data, specifically: Collect the specific geographic locations of all data centers; convert the specific geographic locations of the data centers into geographic coordinates; Calculate the actual distance between data centers using geographic coordinates; average all calculated actual distances between data centers to obtain an average dispersion distance; The geographic dispersal index was calculated based on the ratio of the average dispersal distance to the benchmark distance.

5. A method for processing information of security assessment according to claim 4, characterized in that: According to the degree of geographical dispersion of backup data and the frequency of non-compliance of historical medium-level security assessment reports, the security assessment cycle is adjusted as follows: Get the basic evaluation cycle; set the geographical dispersion adjustment factor and the evaluation failure frequency adjustment factor; The basic assessment cycle is adjusted through the geographical dispersion adjustment coefficient and the assessment non-compliance frequency adjustment coefficient.

6. A security assessment information processing system, used to implement the security assessment information processing method according to any one of claims 1 to 5, characterized in that: It includes evaluation report generation module, data complexity assessment module, logic conflict assessment module, report compliance assessment module, evaluation report output module and evaluation cycle adjustment module; The evaluation report generation module performs a security evaluation on the data backup function according to the predetermined rules and standards of the security evaluation, and generates a security evaluation report; The data complexity assessment module uses information entropy analysis to assess data complexity and evaluate the degree of complexity required to verify the authenticity of assessment data during the security assessment process. The logic conflict assessment module uses formal verification tools to model the assessment logic, applies model detection technology to analyze rule behavior, and uses graph theory to assess the potential degree of logic conflicts in the security assessment process. The report compliance assessment module conducts a comprehensive analysis of the complexity required to verify the authenticity of the assessment data during the security assessment process and the potential degree of logical conflicts to determine whether the credibility of the security assessment report meets the requirements; When the credibility of the security assessment report meets the standard, the assessment report output module outputs the security assessment report; The assessment cycle adjustment module obtains the frequency of historical medium security assessment reports that fail to meet the credibility standards; obtains the degree of geographical dispersion of backup data; and adjusts the security assessment cycle based on the degree of geographical dispersion of backup data and the frequency of historical medium security assessment reports that fail to meet the credibility standards.

Images