Data security inspection method and device, equipment and storage medium
By analyzing and classifying abnormal operation logs, using data verification models to determine the hierarchy and filtering priority of abnormal operations, the data security management problems between multi-system applications within the enterprise are solved, and rapid problem discovery and development in a large data environment are achieved. Screen and deal with it to prevent the threat from expanding.
Patent Information
- Application Number
- CN202411117867.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-08-14
- Publication Date
- 2024-12-17
AI Technical Summary
The existing technology is difficult to achieve unified data security management among multiple system applications within the enterprise, especially when facing large data volumes, it is impossible to quickly discover the source of data security problems and filter and sort them, resulting in the expansion of threats.
By obtaining exception operation logs from the source system, analyzing and classifying them, using preset mapping relationships and data verification models to determine the hierarchy and filtering of abnormal operations, sorting and repairing, and achieving data security issues under the conditions of refactoring applications. Quick discovery and filtering.
Without reconstructing the application, the source of data security problems can be quickly discovered, key objects can be screened and given priority, preventing threats from expanding, and improving the processing efficiency and effectiveness of data security problems.
Smart Images
Figure CN119150281A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of data security, and in particular to a data security verification method, device, equipment and storage medium. Background Art
[0002] There are numerous system applications in existing enterprises. These applications contain data from a wide range of sources and in huge quantities, and the relationships between them are intricate. It is very difficult to achieve unified data security management, such as data classification and grading, desensitization, permission control, deletion, and supervision. In addition, the R&D frameworks used by different applications are not the same. Therefore, it is only possible to analyze data security issues occurring within each independent application, and only to check data security item by item. When faced with data security issues with large amounts of data, it is impossible to handle them in a timely manner. Summary of the invention
[0003] The present application provides a data security verification method, apparatus, device and storage medium, which can quickly discover the source of data security problems when facing a large number of problems without reconstructing the application, and screen and sort numerous security issues to determine the objects to be screened first or focused on, so as to prevent the threat from expanding.
[0004] In a first aspect, the present application provides a data security verification method, comprising:
[0005] Acquire abnormal operation logs related to each application program from a source system, and obtain an abnormal operation element set by parsing the abnormal operation logs; each abnormal operation element is used to represent: a first abnormal operation record corresponding to first data in the application program;
[0006] For each operation exception element, perform the following operations:
[0007] Classifying and grading the first data corresponding to the operation abnormality element, determining a first data abnormality score corresponding to the first data, and determining an operation abnormality score corresponding to the first abnormal operation according to a preset mapping relationship;
[0008] If it is determined that the abnormal operation element is abnormal according to the pre-trained data verification model, then based on the first total score, the target abnormality score is obtained by increasing the first total score according to a first preset ratio; the first total score is determined according to the first data abnormality score and the operation abnormality score;
[0009] The operation abnormality elements are sorted according to the target abnormality score corresponding to each operation abnormality element, and the abnormality repair is performed on the corresponding application program in turn according to the sorting result.
[0010] In one or more possible embodiments, determining the operation abnormality score corresponding to the first abnormal operation according to a preset mapping relationship includes:
[0011] According to whether there is a cascade relationship or a parallel relationship between the first abnormal operation corresponding to the first data and other abnormal operations, and the preset mapping relationship, the operation abnormality score corresponding to the first abnormal operation is determined; wherein the other abnormal operations targeted by the cascade relationship are: the second abnormal operation corresponding to the first data, and the other abnormal operations targeted by the parallel relationship are: the first abnormal operation and / or the second abnormal operation corresponding to the second data.
[0012] In one or more possible embodiments, determining that the first abnormal operation corresponding to the first data has no cascade relationship and no parallel relationship;
[0013] A first operation abnormality score corresponding to the first abnormal operation is determined according to the mapping relationship, and the first operation abnormality score is directly used as the operation abnormality score corresponding to the first abnormal operation.
[0014] In one or more possible embodiments, determining that a first abnormal operation corresponding to the first data has a parallel relationship with at least one other abnormal operation;
[0015] Determine, according to the mapping relationship, a first operation abnormality score of a first abnormal operation corresponding to the first data, and a second operation abnormality score of each of the at least one other abnormal operation;
[0016] An operation abnormality score corresponding to the first abnormal operation is determined according to an average value of the first operation abnormality score and at least one second operation abnormality score.
[0017] In one or more possible embodiments, determining that a first abnormal operation corresponding to the first data has a cascade relationship with at least one other abnormal operation;
[0018] Sort the first abnormal operation and the at least one other abnormal operation in chronological order, and determine a first operation abnormality score corresponding to the first abnormal operation and a second operation abnormality score corresponding to each of the other abnormal operations before the first abnormal operation according to the mapping relationship;
[0019] The operation abnormality score corresponding to the first abnormal operation is determined according to the first operation abnormality score and each determined second operation abnormality score, and a time sequence between corresponding abnormal operations.
[0020] In one or more possible embodiments, classifying and grading the first data corresponding to the abnormal operation element and determining a first data abnormality score corresponding to the first data includes:
[0021] Classifying the first data corresponding to the abnormal operation element to determine different attribute information contained in the first data;
[0022] According to the mapping relationship between the attribute information and the data anomaly score, the highest data anomaly score corresponding to the different attribute information is used as the first data anomaly score corresponding to the first data.
[0023] In one or more possible embodiments, it further includes:
[0024] Pre-configure at least one sensitive rule, and determine whether the first abnormal operation record corresponding to the first data hits the pre-configured sensitive rule;
[0025] If so, the corresponding second data anomaly score is determined according to the hit rule; wherein the sensitivity rule is used to describe the sensitivity of the first abnormal operation; and the first total score is determined according to the first data anomaly score, the second data anomaly score and the operation anomaly score.
[0026] In one or more possible embodiments, it further includes:
[0027] Pre-configure at least one trigger condition, and determine whether the first abnormal operation record corresponding to the first data satisfies the at least one pre-configured trigger condition;
[0028] If so, the third data anomaly score is determined based on the number of trigger conditions that are met; wherein the pre-configured trigger conditions are used to filter the first abnormal operation records; and the first total score is determined based on the first data anomaly score, the third data anomaly score and the operation anomaly score.
[0029] In one or more possible embodiments, it further includes:
[0030] determining a frequency of occurrence of the first abnormal operation according to a first abnormal operation record corresponding to the first data, and comparing the frequency with a preset threshold;
[0031] If it is determined that the frequency is greater than the preset threshold, a fourth data anomaly score is obtained by increasing the first data anomaly score according to a second preset ratio; wherein the first total score is determined based on the first data anomaly score, the fourth data anomaly score and the operation anomaly score.
[0032] In one or more possible embodiments, the data verification model is an isolation forest model and / or an autoencoder.
[0033] In a second aspect, the present application provides a data security verification device, the device comprising:
[0034] The element acquisition module is used to acquire abnormal operation logs related to each application from the source system, and obtain an abnormal operation element set by parsing the abnormal operation logs; each abnormal operation element is used to represent: a first abnormal operation record corresponding to the first data in the application;
[0035] The target abnormality score acquisition module is used to perform the following operations for each abnormal operation element: classify and grade the first data corresponding to the abnormal operation element, determine the first data abnormality score corresponding to the first data, and determine the operation abnormality score corresponding to the first abnormal operation according to a preset mapping relationship; if it is determined that the abnormal operation element is abnormal according to the pre-trained data verification model, then on the basis of the first total score, the target abnormality score is obtained by increasing it according to a first preset ratio; the first total score is determined according to the first data abnormality score and the operation abnormality score;
[0036] The abnormality repair module is used to sort the abnormal operation elements according to the target abnormality score corresponding to each of the abnormal operation elements, and perform abnormality repair on the corresponding application programs in turn according to the sorting results.
[0037] In a third aspect, the present application provides a data security verification device, the device comprising:
[0038] At least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute a method as described in any one of the first aspects.
[0039] In a fourth aspect, the present application provides a computer storage medium storing a computer program, wherein the computer program is used to enable a computer to execute the method as described in any one of the first aspects.
[0040] According to the present application, a data security verification method, device, equipment and storage medium are provided, which can quickly discover the source of data security problems when facing a large number of problems without reconstructing the application, and screen and sort the numerous security problems, determine the objects to be screened first or focused on, and prevent the threat from expanding. BRIEF DESCRIPTION OF THE DRAWINGS
[0041] The drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present application, and together with the specification are used to explain the principles of the present application, and do not constitute an improper limitation on the present application.
[0042] Figure 1A flowchart of an existing data verification method provided according to an embodiment;
[0043] Figure 2 A flowchart of a data verification method provided according to an embodiment;
[0044] Figure 3 A schematic diagram of an abnormal operation element set provided according to an embodiment;
[0045] Figure 4 A schematic diagram of a sensitive rule provided according to an embodiment;
[0046] Figure 5 A schematic diagram of a trigger condition provided according to an embodiment;
[0047] Figure 6 A schematic diagram of a target anomaly score accumulation process provided according to an embodiment;
[0048] Figure 7 A schematic diagram of a data verification device provided according to an embodiment;
[0049] Figure 8 A schematic diagram of a data verification device provided according to an embodiment;
[0050] Fig. 9 A schematic diagram of a storage medium provided according to an embodiment. DETAILED DESCRIPTION
[0051] In order to make the purpose, technical scheme and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.
[0052] It should be noted that the terms "first", "second", etc. in the specification and claims of the present disclosure and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present disclosure described herein can be implemented in an order other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present disclosure. Instead, they are merely examples of devices and methods consistent with some aspects of the present disclosure as detailed in the appended claims.
[0053] Furthermore, in the description of the embodiments of the present application, unless otherwise specified, “ / ” means or. For example, A / B can mean A or B. The “and / or” in the text is merely a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of the embodiments of the present application, “multiple” refers to two or more than two.
[0054] The following is an introduction to the professional terms involved in this application:
[0055] Cascading anomalies are failures that occur due to positive feedback loops and increase over time. The typical manifestation is that a chain of abnormal event reactions is initially triggered by a single node or subsystem security abnormal event.
[0056] Parallel anomalies are caused by the simultaneous occurrence of security anomalies in multiple nodes or applications within a certain time frame, and there is a certain degree of dependence. For example, the occurrence of event A directly leads to or makes the probability of event B higher, and the overall anomaly frequency increases explosively.
[0057] There are numerous system applications in existing enterprises. These applications contain data from a wide range of sources and in huge quantities, and the relationships between them are intricate. It is very difficult to achieve unified data security management, such as data classification and grading, desensitization, permission control, deletion, and supervision. Moreover, the R&D frameworks used by different applications are not the same. Reconstructing the security functions of all applications will cost a lot of money and time.
[0058] The existing data verification method is to check security incidents item by item based on security anomaly logs, and handle them separately for different applications, such as Figure 1 As shown, it is a flow chart of data verification in the prior art, including:
[0059] Step 101, security event data preparation, security anomaly log check; wherein, the security anomaly log check includes classification, grading, desensitization, and deletion of security events.
[0060] Step 102, determine the abnormal application and issue a task for application self-check;
[0061] Step 103, multiple applications receive the application self-check task and perform the application self-check;
[0062] Step 104, determining multiple abnormal data operations based on the application self-check, and performing troubleshooting and repair;
[0063] Step 105, the data interface corresponding to each application is closed;
[0064] Step 106, correcting the above data interface function;
[0065] Step 107, determine whether the data interface security check passes, if yes, execute step 108, if no, execute step 106;
[0066] Step 108, determining that the data interface function is to be republished.
[0067] according to Figure 1 From the content shown, it can be seen that the data verification method in the prior art can only verify the data of the application itself, and when each application performs self-inspection, it also independently analyzes the data security issues occurring within each application. It is only suitable for item-by-item security incident investigation, and cannot handle a large number of problems in a timely manner, and cannot find common features from a large number of problems. It is difficult to coordinate and handle problems from multiple application decision-making levels. There is no priority or focus on the numerous security issues. If the security incident is caused by the association of multiple applications, it is also difficult to prevent or correct it in a timely manner.
[0068] Based on the above problems, the present application provides a data security verification method, device, equipment and storage medium, which can quickly discover the source of data security problems when facing a large number of problems without reconstructing the application, and screen and sort numerous security issues, determine the objects that need to be screened first or focused on, and prevent the threat from expanding.
[0069] Example 1
[0070] This application provides a data security verification method, such as Figure 2 As shown, including:
[0071] Step 201, obtaining abnormal operation logs related to each application from the source system, and parsing the abnormal operation logs to obtain an abnormal operation element set; each abnormal operation element is used to represent: a first abnormal operation record corresponding to the first data in the application;
[0072] In one or more possible embodiments, abnormal operation log data is obtained from a source system. The source system generally includes a database, an application, a server, etc., so a security check is performed on multiple data volumes. After obtaining the abnormal operation log, the abnormal operation logs from different sources are parsed, and the parsed data are converted into a string of operation records to obtain an abnormal operation element set. In the embodiment of the present application, the abnormal operation element set X is presented in the form of a data table, such as Figure 3 As shown, the above-mentioned operation abnormal element set X includes multiple abnormal elements Xi, each row is an abnormal element, and each operation abnormal element represents a first abnormal operation record corresponding to the first data in the above-mentioned application.
[0073] Step 202, for each operation abnormality element, the following operations are performed respectively: the first data corresponding to the operation abnormality element is classified and graded, the first data abnormality score corresponding to the first data is determined, and the operation abnormality score corresponding to the first abnormal operation is determined according to a preset mapping relationship; if the operation abnormality element is determined to be abnormal according to the pre-trained data verification model, the target abnormality score is obtained by increasing the first total score according to a first preset ratio; the first total score is determined according to the first data abnormality score and the operation abnormality score;
[0074] In one or more possible embodiments, for each abnormal operation element, a target abnormal score of each abnormal operation element needs to be determined, and the target abnormal score is determined in the following manner:
[0075] First, the first data corresponding to the above-mentioned operation abnormality element is classified and graded, and the first data corresponding to the above-mentioned operation abnormality element is classified to determine different attribute information contained in the above-mentioned first data; for example, the first data contains name: Xia Yi, gender: female, contact information: 173xxxx3794, address: City B, Province A, and the first data corresponding to the above-mentioned operation abnormality element is classified to determine different attribute information, name, gender, contact information, and address; according to the mapping relationship between attribute information and data abnormality score, the highest data abnormality score corresponding to the above-mentioned different attribute information is used as the first data abnormality score corresponding to the above-mentioned first data; for example, the data abnormality score corresponding to the name is 1, the data abnormality score corresponding to the gender is 1, the data abnormality score corresponding to the contact information is 3, and the data abnormality score corresponding to the address is 4. The highest data abnormality score is the data abnormality score corresponding to the address, that is, the data abnormality score 4 corresponding to the address is used as the first data abnormality score corresponding to the above-mentioned first data, and finally the first data abnormality score is 4.
[0076] Secondly, determine the operation abnormality score corresponding to the first abnormal operation according to the preset mapping relationship; determine the operation abnormality score corresponding to the first abnormal operation according to whether there is a cascade relationship or a parallel relationship between the first abnormal operation corresponding to the above-mentioned first data and other abnormal operations, and the preset above-mentioned mapping relationship; wherein, the other abnormal operations targeted by the above-mentioned cascade relationship are: the second abnormal operation corresponding to the above-mentioned first data, and the other abnormal operations targeted by the above-mentioned parallel relationship are: the first abnormal operation and / or the second abnormal operation corresponding to the second data; when it is determined that there is no cascade relationship or parallel relationship between the first abnormal operation and other abnormal operations, the preset mapping relationship can be directly used to determine the operation abnormality score corresponding to the first abnormal operation; for example, the first abnormal operation is a forwarding operation, and the corresponding operation abnormality score is determined to be 3 according to the above-mentioned mapping relationship, and the first abnormal operation is The deletion operation determines the corresponding operation abnormality score of 2 according to the above mapping relationship; when it is determined that there is a cascade relationship or a parallel relationship between the first abnormal operation and other abnormal operations, the operation abnormality score corresponding to the first abnormal operation is determined according to the cascade relationship or the parallel relationship, and the preset mapping relationship. That is, if there is a cascade relationship between the first abnormal operation and the other abnormal operation, then the operation abnormality score corresponding to the first abnormal operation is determined according to the cascade relationship and the above mapping relationship; if there is a parallel relationship between the first abnormal operation and the other abnormal operation, then the operation abnormality score corresponding to the first abnormal operation is determined according to the parallel relationship and the above mapping relationship; if there is a cascade relationship and a parallel relationship between the first abnormal operation and the other abnormal operation, then the operation abnormality score corresponding to the first abnormal operation is determined according to the parallel relationship, the cascade relationship and the above mapping relationship.
[0077] Finally, the first total score is determined according to the first data anomaly score and the above-mentioned operation anomaly score. For example, the first data anomaly score is 4, and the above-mentioned operation anomaly score is 4.4, then the first total score is 4+4.4=8.4; according to the pre-trained data verification model, when it is determined that the above-mentioned operation anomaly element is abnormal, then on the basis of the first total score, the target anomaly score is obtained by increasing it according to the first preset ratio. The first total score is 8.4, and the first preset ratio is 10%, then the target anomaly score is 8.4×(1+10%)=9.24; the above-mentioned pre-trained data verification model is an isolation forest model and / or an autoencoder. The isolation forest model can detect abnormal data through an integrated learning method. When the autoencoder faces an anomaly, the abnormal data usually does not conform to the normal pattern, resulting in an increase in reconstruction error, and is thus detected as an anomaly.
[0078] Step 203: sort the operation abnormality elements according to the target abnormality score corresponding to each of the above operation abnormality elements, and perform abnormal repair on the corresponding application programs in turn according to the sorting results.
[0079] In one or more possible embodiments, a target abnormality score corresponding to each operation abnormality element is determined, for example, the target abnormality score of the operation abnormality element X1 is 9.3, the target abnormality score of the operation abnormality element X2 is 6.6, the target abnormality score of the operation abnormality element X3 is 11.7, and the target abnormality score of the operation abnormality element X4 is 12.5. Sorting is performed according to the above four target abnormality scores, and the sorting result is determined as: operation abnormality element X4-operation abnormality element X3-operation abnormality element X1-operation abnormality element X2; and the corresponding applications are repaired in turn according to the sorting results.
[0080] According to a data security verification method provided by the present application, the source of data security problems can be quickly discovered when facing a large number of problems without reconstructing the application, and numerous security issues can be screened and sorted to determine the objects that need to be screened first or focused on, so as to prevent the threat from expanding.
[0081] In one or more possible embodiments, it is determined that the first abnormal operation corresponding to the above-mentioned first data has no cascade relationship and no parallel relationship; the first operation abnormality score corresponding to the first abnormal operation is determined according to the above-mentioned mapping relationship, and the above-mentioned first operation abnormality score is directly used as the operation abnormality score corresponding to the first abnormal operation; that is, when it is determined that the first abnormal operation corresponding to the above-mentioned first data has no cascade relationship with at least one second abnormal operation corresponding to the above-mentioned first data, and has no parallel relationship with the first abnormal operation and / or the second abnormal operation corresponding to at least one second data, the first operation abnormality score corresponding to the first abnormal operation is determined according to the preset mapping relationship, and the above-mentioned first operation abnormality score is directly used as the operation abnormality score corresponding to the first abnormal operation.
[0082] In one or more possible embodiments, it is determined that the first abnormal operation corresponding to the above-mentioned first data has a parallel relationship with at least one other abnormal operation; according to the above-mentioned mapping relationship, the first operation abnormality score of the first abnormal operation corresponding to the above-mentioned first data and the second operation abnormality score of each of the above-mentioned at least one other abnormal operation are determined; according to the average value of the above-mentioned first operation abnormality score and at least one second operation abnormality score, the operation abnormality score corresponding to the above-mentioned first abnormal operation is determined; that is, when it is determined that the first abnormal operation corresponding to the above-mentioned first data has a parallel relationship with the first abnormal operation and / or the second abnormal operation corresponding to at least one second data, according to the above-mentioned preset mapping relationship, the first operation abnormality score of the first abnormal operation corresponding to the above-mentioned first data and the second operation abnormality score of all the first abnormal operations corresponding to the above-mentioned first data that have a parallel relationship are determined; the operation abnormality score corresponding to the above-mentioned first abnormal operation is determined according to the average value of the above-mentioned first operation abnormality score and at least one second operation abnormality score. For example, the first abnormal operation A1 corresponding to the first data, the first abnormal operation A2 corresponding to the second data, the second abnormal operation A3 corresponding to the second data, and the second abnormal operation A4 corresponding to the second data have a parallel relationship. Then, according to the above mapping relationship, the first operation abnormality score of the first abnormal operation A1 is determined to be 5. Similarly, the second operation abnormality scores of the other three are 4, 2, and 3. Then, the operation abnormality score corresponding to the final first abnormal operation is (5+4+2+3)÷4=3.5; it is also possible to increase the calculated operation abnormality score by 10% or 20% to obtain 3.5×1.1=3.85 or 3.5×1.2=4.2, and use 3.85 or 4.2 as the operation abnormality score corresponding to the first abnormal operation; it is also possible to directly increase the fixed value 1 or 2 to obtain 4.5 and 5.5, and use 4.5 and 5.5 as the operation abnormality scores corresponding to the first abnormal operation. There is no specific restriction here and it can be determined according to actual conditions.
[0083] In one or more possible embodiments, it is determined that the first abnormal operation corresponding to the above-mentioned first data has a cascade relationship with at least one other abnormal operation; the first abnormal operation and the above-mentioned at least one other abnormal operation are sorted in time order, and the first operation abnormality score corresponding to the first abnormal operation and the second operation abnormality score corresponding to each of the other abnormal operations before the above-mentioned first abnormal operation are determined according to the above-mentioned mapping relationship; the operation abnormality score corresponding to the above-mentioned first abnormal operation is determined according to the above-mentioned first operation abnormality score and the determined second operation abnormality scores, and the time sequence between the corresponding abnormal operations; that is, when it is determined that the first abnormal operation corresponding to the above-mentioned first data and the at least one second abnormal operation corresponding to the above-mentioned first data are in a cascade relationship, the first abnormal operation and the at least one second abnormal operation are sorted in time order, and the first operation abnormality score corresponding to the first abnormal operation and the at least one second operation abnormality score corresponding to the at least one second abnormal operation before the first abnormal operation are determined according to the above-mentioned preset mapping relationship; the operation abnormality score corresponding to the first abnormal operation is determined according to the above-mentioned first operation abnormality score and the at least one second operation abnormality score corresponding to the at least one second abnormal operation before the first abnormal operation, and the time sequence between the corresponding abnormal operations.For example, it is determined that there is a cascade relationship between the first abnormal operation A1 and the second abnormal operation A2, the second abnormal operation A3, the second abnormal operation A4, and the second abnormal operation A5, and the abnormal operations are sorted according to the time sequence, and the sorting result is determined to be the second abnormal operation A4, the second abnormal operation A3, and the second abnormal operation A5. The first abnormal operation A1 and the second abnormal operation A2 are determined, and according to the above preset mapping relationship, the first operation abnormality score of the first abnormal operation A1 is determined to be 4, and the second operation abnormality scores corresponding to the second abnormal operation A4, the second abnormal operation A3, and the second abnormal operation A5 are 5, 4, and 2 respectively; according to the above first operation abnormality score and at least one second operation abnormality score corresponding to at least one second abnormal operation before the first abnormal operation, and the time sequence between the corresponding abnormal operations, the operation abnormality score corresponding to the first abnormal operation is determined, that is, according to the second operation abnormality scores of 5, 4, and 2 and the first operation abnormality score of 4, the operation abnormality score corresponding to the first abnormal operation is determined; the first abnormal operation A1 is ranked fourth, and the operation abnormality score corresponding to the first abnormal operation is determined The abnormal score can be calculated in the following manner: the first step is to calculate the first iteration score of the second abnormal operation ranked first and second (5+4)÷2=4.5; the second step is to calculate the first iteration score and the second iteration score of the second abnormal operation ranked third (4.5+2)÷2=3.25; the third step is to determine the operational abnormal score of the first abnormal operation according to the second iteration score and the first abnormal operation ranked fourth (3.25+4)÷2=3.625, and finally determine that the operational abnormal score of the first abnormal operation is 3.625; similarly , you can also increase the ratio of 10% or 20% in each step to determine the iteration score of each step. For example, if you increase the ratio of 10% in each step, the first iteration score is (5+4)×1.1÷2=4.95, the second iteration score is (4.95+2)×1.1÷2=3.8225, and the operation abnormality score of the first abnormal operation is (3.8225+4)×1.1÷2=4.302375; similarly, you can also directly add a fixed value in each step, which is not explained here as an example and can be determined according to actual conditions.
[0084] In one or more possible embodiments, it also includes: pre-configuring at least one sensitive rule, and determining whether the first abnormal operation record corresponding to the first data hits the pre-configured sensitive rule; if so, determining the corresponding second data abnormality score according to the hit rule; wherein the sensitive rule is used to describe the sensitivity of the first abnormal operation; the first total score is determined according to the first data abnormality score, the second data abnormality score and the operation abnormality score. One sensitive rule corresponds to one second data abnormality score, for example, the second data abnormality score corresponding to sensitive rule 1 is 1, the second data abnormality score corresponding to sensitive rule 2 is 2, and so on; Figure 4As shown, communication forwarding is the first abnormal operation record, and the hit sensitive rule is that the information receiving subject is A. According to the hit sensitive rule, it can be determined that the second data anomaly score is 4. It is worth noting that a first abnormal operation can hit multiple sensitive rules, so the final second data anomaly score is the sum of the second data anomaly scores corresponding to multiple sensitive rules.
[0085] In one or more possible embodiments, it also includes: pre-configuring at least one trigger condition to determine whether the first abnormal operation record corresponding to the first data satisfies the at least one pre-configured trigger condition; if so, determining the third data abnormality score according to the number of satisfied trigger conditions; wherein the pre-configured trigger condition is used to filter the first abnormal operation record; the first total score is determined according to the first data abnormality score, the third data abnormality score and the operation abnormality score. The trigger condition is included in the key business rules defined by the user, such as Figure 5 As mentioned above, the first abnormal operation record corresponding to the first data hits the key business rule 1, and the key business rule 1 contains 5 trigger conditions. The third data abnormality score is determined according to the number of pre-configured trigger conditions satisfied by the first abnormal operation record corresponding to the first data. Similarly, a first abnormal operation record corresponding to a first data may hit multiple key business rules. The third data abnormality score is determined according to the number of all trigger conditions hit in multiple key business rules.
[0086] In one or more possible embodiments, it also includes: determining the frequency of the first abnormal operation according to the first abnormal operation record corresponding to the first data, and comparing the frequency with the preset threshold; if it is determined that the frequency is greater than the preset threshold, then increasing the first data abnormal score by the second preset ratio to obtain a fourth data abnormal score; wherein the first total score is determined according to the first data abnormal score, the fourth data abnormal score and the operation abnormal score. For example, the frequency of the first abnormal operation is 13, the preset threshold is 10, and it is determined that the frequency of the first abnormal operation is greater than the threshold, then the fourth data abnormal score is obtained by increasing the first data abnormal score by the second preset ratio. If the first data abnormal score is 5 and the second preset ratio is 10%, then the fourth data abnormal score is 5×1.1=5.5.
[0087] According to a data security verification method provided by this application, such as Figure 6 As shown, the target abnormality score of the first abnormal operation record corresponding to the first data is determined, which is used to quickly discover the source of data security problems when facing a large number of problems without reconstructing the application, and to screen and sort numerous security issues, determine the objects for screening priority or key processing, and prevent the threat from expanding.
[0088] Example 2
[0089] The present application provides a data security verification device, such as Figure 7 As shown, the above device comprises:
[0090] The element acquisition module 701 is used to acquire abnormal operation logs related to each application from the source system, and obtain an abnormal operation element set by parsing the abnormal operation logs; each abnormal operation element is used to represent: a first abnormal operation record corresponding to the first data in the above application;
[0091] The target abnormality score acquisition module 702 is used to perform the following operations for each abnormal operation element: classify and grade the first data corresponding to the abnormal operation element, determine the first data abnormality score corresponding to the first data, and determine the operation abnormality score corresponding to the first abnormal operation according to a preset mapping relationship; if it is determined that the abnormal operation element is abnormal according to the pre-trained data verification model, then on the basis of the first total score, the target abnormality score is obtained by increasing it according to a first preset ratio; the first total score is determined according to the first data abnormality score and the operation abnormality score;
[0092] The abnormality repair module 703 is used to sort the abnormal operation elements according to the target abnormality score corresponding to each of the abnormal operation elements, and perform abnormality repair on the corresponding application programs in sequence according to the sorting results.
[0093] Example 3
[0094] This application provides a data security verification device, such as Figure 8 As shown, the above-mentioned device includes at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the above-mentioned data security verification method.
[0095] like Figure 8 As shown, the device includes a processor 801, a memory 802, a communication interface 803 and a bus 804. The processor 801, the memory 802 and the communication interface 803 are connected to each other via the bus 804.
[0096] The processor 801 is used to read and execute instructions in the memory 802, so that at least one processor can execute the data security verification method provided by the above embodiment.
[0097] The memory 802 is used to store various instructions and programs of the data security verification method provided in the above embodiment.
[0098] The bus 804 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 8 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.
[0099] The processor 801 may be a central processing unit (CPU), a network processor (NP), a graphic processing unit (GPU), or any combination of CPU, NP, and GPU. It may also be a hardware chip. The hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.
[0100] Example 4
[0101] The present application also provides a computer-readable storage medium, such as Fig. 9 As shown, the computer storage medium stores a computer program, and the computer program is used to enable a computer to execute any one of the methods in the above embodiments.
[0102] The memory may include a readable medium in the form of a volatile memory, such as a random access memory (RAM) 901 and / or a cache memory 902 , and may further include a read-only memory (ROM) 903 .
[0103] The memory may also include a program / utility 905 having a set (at least one) of program modules 904, such program modules 904 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.
[0104] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.
[0105] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.
[0106] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.
[0107] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.
[0108] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.
Claims
1. A data security verification method, characterized in that: include: Acquire abnormal operation logs related to each application program from a source system, and obtain an abnormal operation element set by parsing the abnormal operation logs; each abnormal operation element is used to represent: a first abnormal operation record corresponding to first data in the application program; For each operation exception element, perform the following operations: Classifying and grading the first data corresponding to the operation abnormality element, determining a first data abnormality score corresponding to the first data, and determining an operation abnormality score corresponding to the first abnormal operation according to a preset mapping relationship; If it is determined that the abnormal operation element is abnormal according to the pre-trained data verification model, then based on the first total score, the target abnormality score is obtained by increasing the first total score according to a first preset ratio; the first total score is determined according to the first data abnormality score and the operation abnormality score; The operation abnormality elements are sorted according to the target abnormality score corresponding to each operation abnormality element, and the abnormality repair is performed on the corresponding application program in turn according to the sorting result.
2. The method according to claim 1, characterized in that The determining, according to a preset mapping relationship, an operation abnormality score corresponding to the first abnormal operation includes: According to whether there is a cascade relationship or a parallel relationship between the first abnormal operation corresponding to the first data and other abnormal operations, and the preset mapping relationship, the operation abnormality score corresponding to the first abnormal operation is determined; wherein the other abnormal operations targeted by the cascade relationship are: the second abnormal operation corresponding to the first data, and the other abnormal operations targeted by the parallel relationship are: the first abnormal operation and / or the second abnormal operation corresponding to the second data.
3. The method according to claim 2, characterized in that Determining that the first abnormal operation corresponding to the first data has no cascade relationship and no parallel relationship; A first operation abnormality score corresponding to the first abnormal operation is determined according to the mapping relationship, and the first operation abnormality score is directly used as the operation abnormality score corresponding to the first abnormal operation.
4. The method according to claim 2, characterized in that: Determining that a first abnormal operation corresponding to the first data has a parallel relationship with at least one other abnormal operation; Determine, according to the mapping relationship, a first operation abnormality score of a first abnormal operation corresponding to the first data, and a second operation abnormality score of each of the at least one other abnormal operation; An operation abnormality score corresponding to the first abnormal operation is determined according to an average value of the first operation abnormality score and at least one second operation abnormality score.
5. The method according to claim 2, characterized in that: Determining that a first abnormal operation corresponding to the first data has a cascade relationship with at least one other abnormal operation; Sort the first abnormal operation and the at least one other abnormal operation in chronological order, and determine a first operation abnormality score corresponding to the first abnormal operation and a second operation abnormality score corresponding to each of the other abnormal operations before the first abnormal operation according to the mapping relationship; The operation abnormality score corresponding to the first abnormal operation is determined according to the first operation abnormality score and each determined second operation abnormality score, and a time sequence between corresponding abnormal operations.
6. The method according to claim 1, characterized in that The classifying and grading the first data corresponding to the abnormal operation element to determine a first data abnormality score corresponding to the first data includes: Classifying the first data corresponding to the abnormal operation element to determine different attribute information contained in the first data; According to the mapping relationship between the attribute information and the data anomaly score, the highest data anomaly score corresponding to the different attribute information is used as the first data anomaly score corresponding to the first data.
7. The method according to claim 1, characterized in that Also includes: Pre-configure at least one sensitive rule, and determine whether the first abnormal operation record corresponding to the first data hits the pre-configured sensitive rule; If yes, then determine the corresponding second data anomaly score according to the hit rule; wherein the sensitivity rule is used to describe the sensitivity of the first abnormal operation; The first total score is determined according to the first data anomaly score, the second data anomaly score, and the operation anomaly score.
8. The method according to claim 1, characterized in that Also includes: Pre-configure at least one trigger condition, and determine whether the first abnormal operation record corresponding to the first data satisfies the at least one pre-configured trigger condition; If so, the third data anomaly score is determined based on the number of trigger conditions that are met; wherein the pre-configured trigger conditions are used to filter the first abnormal operation records; and the first total score is determined based on the first data anomaly score, the third data anomaly score and the operation anomaly score.
9. The method according to claim 1, characterized in that: Also includes: determining a frequency of occurrence of the first abnormal operation according to a first abnormal operation record corresponding to the first data, and comparing the frequency with a preset threshold; If it is determined that the frequency is greater than the preset threshold, a fourth data anomaly score is obtained by increasing the first data anomaly score according to a second preset ratio; wherein the first total score is determined based on the first data anomaly score, the fourth data anomaly score and the operation anomaly score.
10. The method according to claim 1, characterized in that The data verification model is an isolation forest model and / or an autoencoder.
11. A data security verification device, characterized in that: The device comprises: The element acquisition module is used to acquire abnormal operation logs related to each application from the source system, and obtain an abnormal operation element set by parsing the abnormal operation logs; each abnormal operation element is used to represent: a first abnormal operation record corresponding to the first data in the application; The target abnormality score acquisition module is used to perform the following operations for each abnormal operation element: classify and grade the first data corresponding to the abnormal operation element, determine the first data abnormality score corresponding to the first data, and determine the operation abnormality score corresponding to the first abnormal operation according to a preset mapping relationship; if it is determined that the abnormal operation element is abnormal according to the pre-trained data verification model, then on the basis of the first total score, the target abnormality score is obtained by increasing it according to a first preset ratio; the first total score is determined according to the first data abnormality score and the operation abnormality score; The abnormality repair module is used to sort the abnormal operation elements according to the target abnormality score corresponding to each of the abnormal operation elements, and perform abnormality repair on the corresponding application programs in turn according to the sorting results.
12. A data security verification device, characterized in that: The device comprises: At least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor so that the at least one processor can execute a method as claimed in any one of claims 1 to 10.
13. A computer storage medium, characterized in that: The computer storage medium stores a computer program, and the computer program is used to make a computer execute the method according to any one of claims 1 to 10.