A leakage protection system and method based on security data

Abstract

The present invention relates to the field of data security technology, and discloses a leakage protection system and method based on security data; the system and method include collecting comprehensive risk data, generating a risk assessment coefficient, determining whether to generate a risk warning prompt, collecting comprehensive repair parameters, generating a repair selection coefficient, generating a defense selection level, and selecting a first defense mode or a second defense mode based on the defense selection level. In the first defense mode, a passive defense instruction is executed, and in the second defense mode, an active defense instruction is executed. Compared with the prior art, the present invention can match adaptive security defense modes for security risks of different repair difficulties in a vehicle network, formulate passive defense instructions or active defense instructions, eliminate and repair security risks in the vehicle network, avoid the negative impact of malicious attacks on data security in the vehicle network, reduce the probability of data leakage, and improve the data security of the vehicle network.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and more specifically, to a leakage protection system and method based on security data. Background Art

[0002] In the daily management of data security in the Internet of Vehicles, malicious attacks often occur, which threatens the data security of the Internet of Vehicles and makes data leakage prone to occur. There may even be problems such as illegal collection, abuse, and leakage of personal data, which poses a serious threat to data security. Therefore, it is necessary to protect the data of the Internet of Vehicles from leakage.

[0003] The Chinese patent application with the publication number CN116467737A discloses an emergency response method and management system for the leakage of personal information in the Internet of Vehicles, which can quickly respond to the leakage of personal information in the Internet of Vehicles, handle information security emergencies in a timely manner, effectively prevent, timely control and eliminate the harm and impact of information security emergencies caused by the leakage of personal information in the Internet of Vehicles to the greatest extent possible; it can solve information security emergencies at a relatively low cost without causing other serious consequences, and prevent irreversible losses to the company and customers;

[0004] The prior art has the following deficiencies:

[0005] When evaluating the data security of the Internet of Vehicles, existing data leakage protection systems usually evaluate from the perspective of the data itself, which results in limitations in the data security results and makes it impossible to accurately analyze and judge the hidden dangers and loopholes in the data. As a result, subsequent data security response measures for the Internet of Vehicles are also lacking in specificity, and are unable to provide adaptive security protection for hidden dangers and loopholes of different security levels, increasing the probability of data leakage.

[0006] In view of this, the present invention proposes a security data leakage protection system and method to solve the above problems. Summary of the invention

[0007] In order to overcome the above-mentioned defects of the prior art and to achieve the above-mentioned purpose, the present invention provides the following technical solution: a leakage protection system based on security data, applied to a big data server, comprising:

[0008] The first data collection module is used to collect comprehensive risk data that affects the data security of the Internet of Vehicles;

[0009] The risk assessment module is used to generate a risk assessment coefficient based on the comprehensive risk data, obtain a risk assessment difference based on the risk assessment coefficient, and determine whether to generate a risk warning prompt;

[0010] The second data collection module is used to collect comprehensive repair parameters of the Internet of Vehicles, and generate a repair selection coefficient based on the comprehensive repair parameters and the risk assessment difference;

[0011] A mode analysis module, used for generating a defense selection level based on the repair selection coefficient, and selecting a first defense mode or a second defense mode based on the defense selection level;

[0012] A passive defense module, used for executing passive defense instructions in a first defense mode;

[0013] The active defense module is used to execute active defense instructions in the second defense mode.

[0014] Furthermore, the comprehensive risk data includes abnormal access frequency, security configuration update degree, defense vulnerability fluctuation value and suspicious data ratio value;

[0015] Methods for obtaining abnormal access frequency include:

[0016] Obtain access data from time A to time B through the identity entry system;

[0017] According to the preset duration, the time from time A to time B is divided into subintervals and count The amount of access data in a sub-interval;

[0018] Tracing The IP address corresponding to the access data in the sub-interval and the access key for accessing the data are identified;

[0019] Retrieve the decoding key that is consistent with the IP address from the Internet of Vehicles, and match the decoding key with the access key;

[0020] The access data whose decoding key is inconsistent with the access key is marked as abnormal access data, and the number of abnormal access data is counted to obtain Abnormal visits;

[0021] Will Abnormal visits and Compare the access data volume one by one and get The frequency of sub-accesses and The sub-access frequencies are numbered in sequence;

[0022] The expression of sub-access frequency is:

[0023] ;

[0024] In the formula, For the The frequency of sub-access, For the Abnormal visits, For the The amount of access data;

[0025] Remove The maximum and minimum values ​​of the sub-access frequencies are obtained from the remaining Randomly select from the sub-access frequencies sub-access frequencies with non-adjacent numbers, Less than ,Will The sub-access frequency is marked as the target sub-access frequency;

[0026] Will The target sub-access frequencies are accumulated and averaged to obtain the abnormal access frequency;

[0027] The expression of abnormal access frequency is:

[0028] ;

[0029] In the formula, is the abnormal access frequency, For the The target sub-access frequency.

[0030] Furthermore, the method for obtaining the security configuration update degree includes:

[0031] Obtained through security defense system The initial version level value of a security defense mechanism;

[0032] After the preset update time, obtain The terminal version level value of a security defense mechanism;

[0033] The security defense mechanism whose terminal version level value is higher than the initial version level value is recorded as the update mechanism, and the An update mechanism, Less than ;

[0034] Will The terminal version level values ​​of the update mechanisms are compared with the corresponding initial version level values ​​to obtain Level update value;

[0035] The expression for the level update value is:

[0036] ;

[0037] In the formula, For the Level update value, For the Terminal version level value, For the Initial version level value;

[0038] Will The level update values ​​are accumulated and Compare the security defense mechanisms to obtain the security configuration update degree;

[0039] The expression of security configuration update degree is:

[0040] ;

[0041] In the formula, To configure updates for security, For the Update the value of each level.

[0042] Furthermore, the method for obtaining the defense vulnerability fluctuation value includes:

[0043] According to the preset scanning time, the security defense system of the Internet of Vehicles is scanned by vulnerability scanning tools. Scan and obtain Scan results;

[0044] The scanned vulnerabilities in the scan results are divided into level 1 risk vulnerabilities and level 2 risk vulnerabilities according to the risk level;

[0045] Mark the scanned vulnerabilities with risk level 2 as defense vulnerabilities and count the number of defense vulnerabilities;

[0046] The first The number of defense vulnerabilities is Compare the difference in the number of defense vulnerabilities and obtain Vulnerability difference;

[0047] The expression of the vulnerability difference is:

[0048] ;

[0049] In the formula, For the Vulnerability difference, For the Number of defense vulnerabilities, For the Number of defense vulnerabilities;

[0050] Will The difference between the vulnerabilities is accumulated and The duration corresponding to the preset scanning time is averaged to obtain the defense vulnerability fluctuation value;

[0051] The expression of the defense vulnerability fluctuation value is:

[0052] ;

[0053] In the formula, To prevent vulnerability fluctuations, For the Vulnerability difference, The duration corresponding to the preset scanning time.

[0054] Furthermore, the method for obtaining the suspicious data ratio includes:

[0055] Use network packet capture tools to capture network data in the Internet of Vehicles Real-time packet capture, obtained Data packets and statistics The total amount of data in a data packet;

[0056] right The captured data is used to identify the protocol and data format, and the data corresponding to the uncommon protocols and non-standard data formats in the Internet of Vehicles are marked and counted. Amount of suspicious data;

[0057] Will The amount of suspicious data Compare the total data values ​​one by one and obtain The percentage of children;

[0058] The expression of the sub-ratio value is:

[0059] ;

[0060] In the formula, For the The percentage of children, For the Amount of suspicious data, For the Total amount of data;

[0061] Will The percentage of each individual is accumulated and averaged to obtain the percentage of suspicious data;

[0062] The expression of suspicious data ratio is:

[0063] ;

[0064] In the formula, is the percentage of suspicious data, For the The percentage of children;

[0065] The expression of risk assessment coefficient is:

[0066] ;

[0067] In the formula, is the risk assessment coefficient, , , , is the weight coefficient;

[0068] The determination method of whether to generate a risk warning prompt includes:

[0069] The risk assessment factor Compared with the preset risk assessment threshold Difference comparison, If it is greater than 0, the risk assessment difference is obtained;

[0070] The expression of risk assessment difference is:

[0071] ;

[0072] In the formula, is the risk assessment difference;

[0073] when When it is greater than 0, a risk warning prompt is generated;

[0074] when When it is less than or equal to 0, it is determined that no risk warning prompt will be generated.

[0075] Furthermore, the comprehensive repair parameters include a repair dimension value and a repair rate value;

[0076] The methods for obtaining repair dimension values ​​include:

[0077] Divide the network system of the Internet of Vehicles into cloud service level, management level and terminal level;

[0078] Assign dimension values ​​to the cloud service level, management level, and terminal level respectively;

[0079] Check the levels of abnormal access frequency, security configuration update degree, defense vulnerability fluctuation value and suspicious data ratio value one by one, and mark the dimension values ​​of abnormal access frequency, security configuration update degree, defense vulnerability fluctuation value and suspicious data ratio value, respectively. , and ;

[0080] based on , and , get the repair dimension value;

[0081] The expression to fix the dimension value is:

[0082] ;

[0083] In the formula, To fix the dimension value, is a natural constant.

[0084] Furthermore, the method for obtaining the repair rate value includes:

[0085] Obtained through system repair tools Comprehensive vulnerability repair data, including the total number of vulnerabilities, successful repair rate and total repair time;

[0086] Combination The total number of vulnerabilities, successful repair rate and total repair time are obtained. The repair rate of each child;

[0087] The expression of the sub-repair rate is:

[0088] ;

[0089] In the formula, For the The repair rate of each For the The total number of vulnerabilities, For the The success rate of repair For the Total repair time;

[0090] Will The individual repair rates are accumulated and averaged to obtain the repair rate value;

[0091] The expression for the repair rate value is:

[0092] ;

[0093] In the formula, is the repair rate value, For the The repair rate of each child;

[0094] The expression of the repair selection coefficient is:

[0095] ;

[0096] In the formula, Select the coefficient for the repair.

[0097] Furthermore, the defense selection level includes a primary selection level and a secondary selection level;

[0098] The method for generating the primary selection level and the secondary selection level includes:

[0099] Will fix the selection coefficient With the preset repair selection threshold Compare, Greater than 0;

[0100] when Less than or equal to When , a first-level selection level is generated;

[0101] when Greater than When , a secondary selection level is generated;

[0102] Methods for selecting the first defense mode or the second defense mode include:

[0103] When the defense selection level is the first level, select the first defense mode;

[0104] When the defense selection level is the secondary selection level, the second defense mode is selected.

[0105] Furthermore, the passive defense instructions include reducing the frequency of abnormal access and reducing the proportion of suspicious data;

[0106] The execution method of reducing the abnormal access frequency and reducing the proportion of suspicious data includes:

[0107] Preset the minimum value of abnormal access frequency and the minimum value of suspicious data ratio;

[0108] In the first defense mode, first reduce the frequency of abnormal access until no risk warning prompts are generated;

[0109] In the first defense mode, when the frequency of abnormal access is reduced to the minimum value, the proportion of suspicious data is reduced until no risk warning prompt is generated;

[0110] In the first defense mode, when the abnormal access frequency and the suspicious data ratio are reduced to the minimum value, no risk warning prompt is generated;

[0111] Active defense instructions include increasing the security configuration update rate and reducing the defense vulnerability fluctuation value;

[0112] The implementation methods for increasing the security configuration update rate and reducing the defense vulnerability fluctuation value include:

[0113] The maximum value of the preset security configuration update degree and the minimum value of the defense vulnerability fluctuation value;

[0114] In the second defense mode, first increase the security configuration update rate until no risk warning prompts are generated;

[0115] In the second defense mode, when the security configuration update degree increases to the maximum value, the defense vulnerability fluctuation value is reduced until no risk warning prompt is generated;

[0116] In the second defense mode, when the security configuration update degree increases to the maximum value and the defense vulnerability fluctuation value decreases to the minimum value, no risk warning prompt is generated.

[0117] A security data based leakage protection method, applied to a big data server, is implemented based on a security data based leakage protection system, including:

[0118] S1: Collect comprehensive risk data that affects the security of Internet of Vehicles data;

[0119] S2: Generate a risk assessment coefficient based on the comprehensive risk data, obtain a risk assessment difference based on the risk assessment coefficient, and determine whether to generate a risk warning prompt; if a risk warning prompt is generated, execute S3-S6; if no risk warning prompt is generated, repeat S1-S2;

[0120] S3: Collect comprehensive repair parameters of the Internet of Vehicles, and generate a repair selection coefficient based on the comprehensive repair parameters and risk assessment differences;

[0121] S4: generating a defense selection level based on the repair selection coefficient, and selecting a first defense mode or a second defense mode based on the defense selection level;

[0122] S5: In the first defense mode, execute the passive defense command;

[0123] S6: In the second defense mode, execute active defense instructions.

[0124] The technical effects and advantages of the security data leakage protection system and method of the present invention are as follows:

[0125] The present invention collects comprehensive risk data that affects the data security of the Internet of Vehicles, generates a risk assessment coefficient based on the comprehensive risk data, obtains a risk assessment difference based on the risk assessment coefficient, and determines whether to generate a risk warning prompt, collects comprehensive repair parameters of the Internet of Vehicles, generates a repair selection coefficient based on the comprehensive repair parameters and the risk assessment difference, generates a defense selection level based on the repair selection coefficient, selects a first defense mode or a second defense mode based on the defense selection level, executes a passive defense instruction in the first defense mode, and executes an active defense instruction in the second defense mode; compared with the prior art, the present invention can comprehensively analyze the data security of the Internet of Vehicles and judge the level of data security of the Internet of Vehicles, and at the same time, combined with the comprehensive repair parameters, can match adaptive security defense modes for security risks of different repair difficulties in the Internet of Vehicles, formulate passive defense instructions or active defense instructions, eliminate and repair security risks in the Internet of Vehicles, thereby avoiding the negative impact of malicious attacks on data in the Internet of Vehicles, improving the data security of the Internet of Vehicles as much as possible, and reducing the probability of data leakage. BRIEF DESCRIPTION OF THE DRAWINGS

[0126] Figure 1 A schematic diagram of a security data leakage protection system provided in Example 1 of the present invention;

[0127] Figure 2 A flowchart of a security data leakage protection method provided in Example 2 of the present invention. DETAILED DESCRIPTION

[0128] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0129] Example 1: Please refer to Figure 1 As shown, the security data leakage protection system described in this embodiment is applied to a big data server, including:

[0130] The first data collection module collects comprehensive risk data that affects the data security of the Internet of Vehicles;

[0131] Comprehensive risk data refers to comprehensive factors that may have a negative impact on the data security operation of the Internet of Vehicles. When the data security of the Internet of Vehicles is interfered with or maliciously attacked, the data security status of the Internet of Vehicles will change. At the same time, some corresponding data parameters will be generated in the Internet of Vehicles. These data parameters can be used to numerically reflect the interference or malicious attack, so as to facilitate the subsequent evaluation and processing of the data security of the Internet of Vehicles.

[0132] Comprehensive risk data includes abnormal access frequency, security configuration update rate, defense vulnerability fluctuation value and suspicious data ratio;

[0133] Abnormal access frequency refers to the frequency of invalid visitors who are not identified as vehicle owners accessing the vehicle control system. The greater the abnormal access frequency, the more frequently invalid visitors access the vehicle control system, and the lower the data security of the Internet of Vehicles.

[0134] Methods for obtaining abnormal access frequency include:

[0135] Obtain access data from time A to time B through the identity entry system;

[0136] According to the preset duration, the time from time A to time B is divided into subintervals and count The amount of access data in a sub-interval; the preset duration refers to the numerical representation that a longer access duration can be divided into smaller access durations. When each access data accesses the Internet of Vehicles, it will occupy a corresponding access duration in the identity entry system, and the sub-intervals divided by the preset duration can fully accommodate the access durations of multiple access data, so that each sub-interval can have a sufficient amount of access data. The specific preset duration refers to the access duration corresponding to a large amount of historical access data collected and obtained through coefficient optimization;

[0137] Tracing The IP address corresponding to the access data in the sub-interval and the access key for accessing the data are identified;

[0138] The decoding key that is consistent with the IP address is retrieved from the Internet of Vehicles, and the decoding key is matched with the access key. The Internet of Vehicles will pre-store the owner's identity login information of each vehicle, including the owner's IP address, decoding key and other related data, so that the owner's identity can be accurately referenced for access data, thereby improving the accuracy of identifying abnormal access data.

[0139] The access data whose decoding key is inconsistent with the access key is marked as abnormal access data, and the number of abnormal access data is counted to obtain Abnormal visits;

[0140] Will Abnormal visits and Compare the access data volume one by one and get The frequency of sub-accesses and The sub-access frequencies are numbered in sequence;

[0141] The expression of sub-access frequency is:

[0142] ;

[0143] In the formula, For the The frequency of sub-access, For the Abnormal visits, For the The amount of access data;

[0144] Remove The maximum and minimum values ​​of the sub-access frequencies are obtained from the remaining Randomly select from the sub-access frequencies sub-access frequencies with non-adjacent numbers, Less than ,Will The sub-access frequencies are marked as target sub-access frequencies; removing the maximum and minimum values ​​of the sub-access frequencies can make a preliminary clustering among the sub-access frequencies, avoiding the deviation of the final result caused by too large or too small values, and the random selection of non-adjacent numbers can further optimize the data randomness of the sub-access frequencies, so that the sub-access frequencies involved in the final calculation can truly represent the actual situation, avoiding the influence of adjacent data adhesion, and at the same time can also reduce the amount of data calculation and improve the calculation efficiency;

[0145] Will The target sub-access frequencies are accumulated and averaged to obtain the abnormal access frequency;

[0146] The expression of abnormal access frequency is:

[0147] ;

[0148] In the formula, is the abnormal access frequency, For the The target sub-access frequency;

[0149] The security configuration update degree refers to the update degree of the security defense version in the vehicle control system. When the security configuration update degree is greater, it means that the update frequency of the security defense version in the vehicle control system is greater, and the number of security configuration data that has not changed in the vehicle control system is greater, then the data security of the Internet of Vehicles is higher;

[0150] Methods for obtaining the security configuration update degree include:

[0151] Obtained through security defense system The initial version level value of a security defense mechanism; the security defense mechanism is the basis of the security defense system, which is used to provide security defense measures for the vehicle's Internet of Vehicles, and the security defense system is composed of several different security defense mechanisms;

[0152] After the preset update time, obtain The terminal version level value of a security defense mechanism; the preset update duration refers to the time span that can satisfy the security defense mechanism for at least one complete version update. The preset update duration ensures that the security defense mechanism can perform a complete version update, thereby providing data support for the security configuration update degree. The specific preset update duration refers to the time corresponding to a complete version update of a large number of historical security defense mechanisms, which is obtained after coefficient optimization;

[0153] The security defense mechanism whose terminal version level value is higher than the initial version level value is recorded as the update mechanism, and the An update mechanism, Less than ;

[0154] Will The terminal version level values ​​of the update mechanisms are compared with the corresponding initial version level values ​​to obtain Level update value;

[0155] The expression for the level update value is:

[0156] ;

[0157] In the formula, For the Level update value, For the Terminal version level value, For the Initial version level value;

[0158] Will The level update values ​​are accumulated and Compare the security defense mechanisms to obtain the security configuration update degree;

[0159] The expression of security configuration update degree is:

[0160] ;

[0161] In the formula, To configure updates for security, For the Level update value;

[0162] The defense vulnerability fluctuation value refers to the magnitude of the increase in the defense vulnerability of the security defense system within a unit of time. The larger the defense vulnerability fluctuation value, the more vulnerabilities and hidden dangers there are in the security defense system, and the lower the data security of the Internet of Vehicles.

[0163] Methods for obtaining the defense vulnerability fluctuation value include:

[0164] According to the preset scanning time, the security defense system of the Internet of Vehicles is scanned by vulnerability scanning tools. Scan and obtain The preset scanning time refers to the time it takes for the Internet of Vehicles to complete a system self-check. By presetting the scanning time, it can be ensured that the vulnerability scanning tool can fully scan and detect system vulnerabilities in the security defense system of the Internet of Vehicles, thereby providing numerical support for the data security of the Internet of Vehicles. The specific value of the preset scanning time is obtained by collecting a large number of historical Internet of Vehicles to complete a system self-check, and then optimizing the coefficients based on the actual configurations of different Internet of Vehicles.

[0165] The scanned vulnerabilities in the scan results are divided into primary risk vulnerabilities and secondary risk vulnerabilities according to the risk level; the risk level is the basis for dividing the risks of the scanned vulnerabilities, and the risk level is divided into primary risk vulnerabilities and secondary risk vulnerabilities. The primary risk vulnerabilities correspond to lower risks and have a low impact on the data security of the Internet of Vehicles. The secondary risk vulnerabilities correspond to higher risks and have a high impact on the data security of the Internet of Vehicles, so the secondary risk vulnerabilities are marked;

[0166] Mark the scanned vulnerabilities with risk level 2 as defense vulnerabilities and count the number of defense vulnerabilities;

[0167] The first The number of defense vulnerabilities is Compare the difference in the number of defense vulnerabilities and obtain Vulnerability difference;

[0168] The expression of the vulnerability difference is:

[0169] ;

[0170] In the formula, For the Vulnerability difference, For the Number of defense vulnerabilities, For the Number of defense vulnerabilities;

[0171] Will The difference between the vulnerabilities is accumulated and The duration corresponding to the preset scanning time is averaged to obtain the defense vulnerability fluctuation value;

[0172] The expression of the defense vulnerability fluctuation value is:

[0173] ;

[0174] In the formula, To prevent vulnerability fluctuations, For the Vulnerability difference, The duration corresponding to the preset scanning time;

[0175] The suspicious data ratio refers to the proportion of network data that has not been securely identified and authenticated in the Internet of Vehicles to the total amount of network data. The larger the suspicious data ratio, the more network data that has not been securely identified and authenticated in the Internet of Vehicles, and the lower the data security of the Internet of Vehicles.

[0176] Methods for obtaining the suspicious data ratio include:

[0177] Use network packet capture tools to capture network data in the Internet of Vehicles Real-time packet capture, obtained Data packets and statistics The total amount of data in a data packet;

[0178] right The captured data is used to identify the protocol and data format, and the data corresponding to the uncommon protocols and non-standard data formats in the Internet of Vehicles are marked and counted. The amount of suspicious data; by identifying the protocol and data format of the data in the data packet, the data in the Internet of Vehicles that is different from the pre-stored data protocol and data format can be accurately identified. When the data protocol and data format change, this may be a vulnerability or a specific attack method exploited by the attacker;

[0179] Will The amount of suspicious data Compare the total data values ​​one by one and obtain The percentage of children;

[0180] The expression of the sub-ratio value is:

[0181] ;

[0182] In the formula, For the The percentage of children, For the Amount of suspicious data, For the Total amount of data;

[0183] Will The percentage of each individual is accumulated and averaged to obtain the percentage of suspicious data;

[0184] The expression of suspicious data ratio is:

[0185] ;

[0186] In the formula, is the percentage of suspicious data, For the The percentage of children;

[0187] The risk assessment module generates a risk assessment coefficient based on the comprehensive risk data, obtains the risk assessment difference based on the risk assessment coefficient, and determines whether to generate a risk warning prompt;

[0188] The risk assessment coefficient is a numerical representation used to judge the security level of Internet of Vehicles data. Different risk assessment coefficients correspond to different levels of Internet of Vehicles data security. When the risk assessment coefficient is larger, it means that the Internet of Vehicles data security is low, and vice versa.

[0189] The expression of risk assessment coefficient is:

[0190] ;

[0191] In the formula, is the risk assessment coefficient, , , , is the weight coefficient; substitute the set weight coefficient and the collected comprehensive risk data into the formula, any four formulas constitute a four-variable linear equation system, screen the calculated weight coefficients and take the average value to obtain , , , The mean of

[0192] In addition, it should be noted that the size of the weight coefficient is a specific value obtained by quantifying each data, which is convenient for subsequent comparison. The size of the weight coefficient depends on the amount of comprehensive risk data and the initial setting of the corresponding weight coefficient for each set of comprehensive risk data by technicians in this field.

[0193] The determination method of whether to generate a risk warning prompt includes:

[0194] The risk assessment factor Compared with the preset risk assessment threshold Difference comparison, If it is greater than 0, the risk assessment difference is obtained; the preset risk assessment threshold is used to distinguish the data security level corresponding to the risk assessment coefficient, so that the risk assessment coefficient can be divided into different security levels. The risk assessment coefficient is obtained by collecting a large amount of historical risk assessment coefficients corresponding to low data security and high data security, and then optimizing the coefficient;

[0195] The expression of risk assessment difference is:

[0196] ;

[0197] In the formula, is the risk assessment difference;

[0198] when When it is greater than 0, it means that the risk assessment coefficient is greater than the preset risk assessment threshold. At this time, the data security of the Internet of Vehicles is low, and a risk warning prompt is generated;

[0199] when When it is less than or equal to 0, it means that the risk assessment coefficient is less than or equal to the preset risk assessment threshold. At this time, the data security of the Internet of Vehicles is high, and it is determined that no risk warning prompt will be generated;

[0200] The second data collection module collects the comprehensive repair parameters of the Internet of Vehicles and generates a repair selection coefficient based on the comprehensive repair parameters and the risk assessment difference;

[0201] Comprehensive repair parameters refer to relevant data that affects the elimination process when the data security of the Internet of Vehicles is low. By collecting comprehensive repair parameters, the actual network configuration and capabilities of the Internet of Vehicles can be obtained, and data support can be provided for subsequent repair operations;

[0202] The comprehensive repair parameters include the repair dimension value and the repair rate value;

[0203] The repair dimension value refers to the level dimension that the repair measures need to cross when the Internet of Vehicles eliminates and repairs safety hazards. When the repair dimension value is larger, it means that the repair measures need to cross more level dimensions, the greater the difficulty of repair, and the greater the repair selection coefficient;

[0204] The methods for obtaining repair dimension values ​​include:

[0205] The network system of the Internet of Vehicles is divided into a cloud service layer, a management layer and a terminal layer. The cloud server layer is used for data calculation in the Internet of Vehicles network system, the management layer is used for data management in the Internet of Vehicles network system, and the execution layer is used for data execution in the Internet of Vehicles network system. By dividing the network system of the Internet of Vehicles into different layers, the network system of the Internet of Vehicles can be distinguished in different dimensions, thereby accurately identifying the cross-dimensionality of the repair measures.

[0206] Assign dimension values ​​to the cloud service level, management level, and terminal level respectively;

[0207] Check the levels of abnormal access frequency, security configuration update degree, defense vulnerability fluctuation value and suspicious data ratio value one by one, and mark the dimension values ​​of abnormal access frequency, security configuration update degree, defense vulnerability fluctuation value and suspicious data ratio value, respectively. , and ;

[0208] based on , and , get the repair dimension value;

[0209] The expression to fix the dimension value is:

[0210] ;

[0211] In the formula, To fix the dimension value, is a natural constant;

[0212] The repair rate value refers to the speed at which the Internet of Vehicles repairs different types of safety hazards when eliminating and repairing safety hazards. The larger the repair rate value, the faster the Internet of Vehicles eliminates and repairs safety hazards, the easier the repair is, and the smaller the repair selection coefficient is.

[0213] Methods for obtaining the repair rate value include:

[0214] Obtained through system repair tools Comprehensive vulnerability repair data, including the total number of vulnerabilities, successful repair rate and total repair time;

[0215] Combination The total number of vulnerabilities, successful repair rate and total repair time are obtained. The repair rate of each child;

[0216] The expression of the sub-repair rate is:

[0217] ;

[0218] In the formula, For the The repair rate of each For the The total number of vulnerabilities, For the The success rate of repair For the Total repair time;

[0219] Will The individual repair rates are accumulated and averaged to obtain the repair rate value;

[0220] The expression for the repair rate value is:

[0221] ;

[0222] In the formula, is the repair rate value, For the The repair rate of each child;

[0223] The repair selection coefficient is a numerical representation of the repair mode selected for the Internet of Vehicles, thereby distinguishing the selection mode of different Internet of Vehicles based on the data security level;

[0224] The expression of the repair selection coefficient is:

[0225] ;

[0226] In the formula, Select coefficients for restoration;

[0227] The mode analysis module generates a defense selection level based on the repair selection coefficient, and selects the first defense mode or the second defense mode based on the defense selection level;

[0228] The defense selection level refers to the difficulty of the Internet of Vehicles in repairing security vulnerabilities. When the repair selection coefficient is larger, the difficulty of repairing the security vulnerability is higher, and the defense selection level is higher, and vice versa;

[0229] The defense selection level includes the first-level selection level and the second-level selection level. The difficulty of the first-level selection level is lower than that of the second-level selection level.

[0230] The method for generating the primary selection level and the secondary selection level includes:

[0231] Will fix the selection coefficient With the preset repair selection threshold Compare, Greater than 0; the preset repair selection threshold is a numerical representation used to distinguish the difficulty of the repair selection coefficient, that is, the difficulty corresponding to the repair selection coefficient is divided into two different ranges of high difficulty and low difficulty, and provides data support for the subsequent defense selection level;

[0232] when Less than or equal to When , it means that the repair selection coefficient is less than or equal to the preset repair selection threshold. At this time, the difficulty of repairing the security vulnerability is low, and a first-level selection level is generated;

[0233] when Greater than When , it means that the repair selection coefficient is greater than the preset repair selection threshold. At this time, the difficulty of repairing the security vulnerability is high, and a secondary selection level is generated;

[0234] Methods for selecting the first defense mode or the second defense mode include:

[0235] When the defense selection level is the first level, select the first defense mode;

[0236] When the defense selection level is the secondary selection level, select the second defense mode;

[0237] A passive defense module, in a first defense mode, executes a passive defense instruction;

[0238] The first defense mode refers to the mode in which the security defense system of the Internet of Vehicles is passively triggered. In the first defense mode, the security defense system of the Internet of Vehicles will not actively defend;

[0239] Passive defense instructions refer to when the Internet of Vehicles is attacked by malicious attacks and detects malicious attacks, the security defense system will perform passive defense under the trigger of malicious attacks. Passive defense instructions cannot perform defense actions before detecting malicious attacks. They are suitable for scenarios where the difficulty of repairing security risks is relatively low.

[0240] Passive defense instructions include reducing the frequency of abnormal access and reducing the proportion of suspicious data;

[0241] The execution method of reducing the abnormal access frequency and reducing the proportion of suspicious data includes:

[0242] Preset the minimum value of abnormal access frequency and the minimum value of suspicious data ratio; through the preset minimum value, the abnormal access frequency and the minimum amplitude of reducing the suspicious data ratio can be limited, so that when the abnormal access frequency and the suspicious data ratio reach the minimum value, the risk assessment coefficient corresponding to the Internet of Vehicles is less than the preset risk assessment threshold, and no risk warning prompt is generated;

[0243] In the first defense mode, first reduce the frequency of abnormal access until no risk warning prompts are generated;

[0244] In the first defense mode, when the frequency of abnormal access is reduced to the minimum value, the proportion of suspicious data is reduced until no risk warning prompt is generated;

[0245] In the first defense mode, when the abnormal access frequency and the suspicious data ratio are reduced to the minimum value, no risk warning prompt is generated;

[0246] Exemplarily, reducing the frequency of abnormal access refers to reducing the number of times invalid visitors attempt to enter and access unrecognized authentication data of the Internet of Vehicles. By adding identity encryption verification to the identity entry system, invalid visitors can be effectively blocked, reducing the number of malicious attacks on the Internet of Vehicles. Reducing the proportion of suspicious data refers to reducing the number of uncommon protocols and non-standard data formats in the Internet of Vehicles. By identifying the type of data entered into the identity entry system, uncommon protocols and non-standard data formats can be filtered out.

[0247] An active defense module executes active defense instructions in the second defense mode;

[0248] The second defense mode refers to the mode in which the security defense system of the Internet of Vehicles is actively triggered. In the second defense mode, the security defense system of the Internet of Vehicles will actively defend;

[0249] Active defense instructions refer to the active defense that the security defense system will perform when the Internet of Vehicles detects a malicious attack and before it is attacked. Active defense instructions can perform defense actions before detecting a malicious attack and are suitable for scenarios where it is difficult to repair security risks.

[0250] Active defense instructions include increasing the security configuration update rate and reducing the defense vulnerability fluctuation value;

[0251] The implementation methods for increasing the security configuration update rate and reducing the defense vulnerability fluctuation value include:

[0252] The maximum value of the security configuration update degree and the minimum value of the defense vulnerability fluctuation value are preset; through the preset maximum and minimum values, the security configuration update degree and the defense vulnerability fluctuation value can be limited in magnitude, so that when the security configuration update degree reaches the maximum value and the defense vulnerability fluctuation value reaches the minimum value, the risk assessment coefficient corresponding to the Internet of Vehicles is less than the preset risk assessment threshold, and no risk warning prompt is generated;

[0253] In the second defense mode, first increase the security configuration update rate until no risk warning prompts are generated;

[0254] In the second defense mode, when the security configuration update degree increases to the maximum value, the defense vulnerability fluctuation value is reduced until no risk warning prompt is generated;

[0255] In the second defense mode, when the security configuration update degree increases to the maximum value and the defense vulnerability fluctuation value decreases to the minimum value, no risk warning prompt is generated;

[0256] Exemplarily, increasing the security configuration update rate refers to increasing the number of patch updates of the Internet of Vehicles security defense system. By shortening the update time of the security defense version, the security configuration update rate can be increased. Reducing the defense vulnerability fluctuation value refers to reducing the time interval for repairing vulnerabilities of the security defense system in the Internet of Vehicles. By reducing the time interval, the security defense system can perform multiple vulnerability repairs, thereby reducing the defense vulnerability fluctuation value.

[0257] In this embodiment, comprehensive risk data that affects the data security of the Internet of Vehicles is collected, a risk assessment coefficient is generated based on the comprehensive risk data, a risk assessment difference is obtained based on the risk assessment coefficient, and it is determined whether to generate a risk warning prompt, and comprehensive repair parameters of the Internet of Vehicles are collected, a repair selection coefficient is generated based on the comprehensive repair parameters and the risk assessment difference, a defense selection level is generated based on the repair selection coefficient, and a first defense mode or a second defense mode is selected based on the defense selection level. In the first defense mode, a passive defense instruction is executed, and in the second defense mode, an active defense instruction is executed. Compared with the prior art, a comprehensive analysis of the data security of the Internet of Vehicles can be performed, and the level of data security of the Internet of Vehicles can be determined. At the same time, combined with the comprehensive repair parameters, adaptive security defense modes can be matched for security risks of different repair difficulties in the Internet of Vehicles, and passive defense instructions or active defense instructions can be formulated to eliminate and repair security risks in the Internet of Vehicles, thereby avoiding the negative impact of malicious attacks on data in the Internet of Vehicles, and improving the data security of the Internet of Vehicles as much as possible, and reducing the probability of data leakage.

[0258] Example 2: Please refer to Figure 2 As shown, the part not described in detail in this embodiment is described in Example 1, and a leakage protection method based on security data is provided, which is applied to a big data server and implemented based on a leakage protection system based on security data, including:

[0259] S1: Collect comprehensive risk data that affects the security of Internet of Vehicles data;

[0260] S2: Generate a risk assessment coefficient based on the comprehensive risk data, obtain a risk assessment difference based on the risk assessment coefficient, and determine whether to generate a risk warning prompt; if a risk warning prompt is generated, execute S3-S6; if no risk warning prompt is generated, repeat S1-S2;

[0261] S3: Collect comprehensive repair parameters of the Internet of Vehicles, and generate a repair selection coefficient based on the comprehensive repair parameters and risk assessment differences;

[0262] S4: generating a defense selection level based on the repair selection coefficient, and selecting a first defense mode or a second defense mode based on the defense selection level;

[0263] S5: In the first defense mode, execute the passive defense command;

[0264] S6: In the second defense mode, execute active defense instructions.

[0265] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A security data leakage protection system, applied to a big data server, characterized in that: include: The first data collection module is used to collect comprehensive risk data that affects the data security of the Internet of Vehicles; The risk assessment module is used to generate a risk assessment coefficient based on the comprehensive risk data, obtain a risk assessment difference based on the risk assessment coefficient, and determine whether to generate a risk warning prompt; The second data collection module is used to collect comprehensive repair parameters of the Internet of Vehicles, and generate a repair selection coefficient based on the comprehensive repair parameters and the risk assessment difference; The comprehensive repair parameters include the repair dimension value and the repair rate value; The methods for obtaining repair dimension values ​​include: Divide the network system of the Internet of Vehicles into cloud service level, management level and terminal level; Assign dimension values ​​to the cloud service level, management level, and terminal level respectively; Check the levels of abnormal access frequency, security configuration update degree, defense vulnerability fluctuation value and suspicious data ratio value one by one, and mark the dimension values ​​of abnormal access frequency, security configuration update degree, defense vulnerability fluctuation value and suspicious data ratio value, respectively. , , and ; based on , , and , get the repair dimension value; The expression to fix the dimension value is: ； In the formula, To fix the dimension value, is a natural constant; Methods for obtaining the repair rate value include: Obtained through system repair tools Comprehensive vulnerability repair data, including the total number of vulnerabilities, successful repair rate and total repair time; Combination The total number of vulnerabilities, successful repair rate and total repair time are obtained. The repair rate of each child; The expression of the sub-repair rate is: ； In the formula, For the The repair rate of each For the The total number of vulnerabilities, For the The success rate of repair For the Total repair time; Will The individual repair rates are accumulated and averaged to obtain the repair rate value; The expression for the repair rate value is: ； In the formula, is the repair rate value, For the The repair rate of each child; The expression of the repair selection coefficient is: ； In the formula, To repair the selection coefficient, is the risk assessment difference; A mode analysis module, used for generating a defense selection level based on the repair selection coefficient, and selecting a first defense mode or a second defense mode based on the defense selection level; A passive defense module, used for executing passive defense instructions in a first defense mode; The active defense module is used to execute active defense instructions in the second defense mode.

2. A security data leakage protection system according to claim 1, characterized in that: The comprehensive risk data includes abnormal access frequency, security configuration update degree, defense vulnerability fluctuation value and suspicious data ratio value; Methods for obtaining abnormal access frequency include: Obtain access data from time A to time B through the identity entry system; According to the preset duration, the time from time A to time B is divided into subintervals and count The amount of access data in a sub-interval; Tracing The IP address corresponding to the access data in the sub-interval and the access key for accessing the data are identified; Retrieve the decoding key that is consistent with the IP address from the Internet of Vehicles, and match the decoding key with the access key; The access data whose decoding key is inconsistent with the access key is marked as abnormal access data, and the number of abnormal access data is counted to obtain Abnormal visits; Will Abnormal visits and Compare the access data volume one by one and get The frequency of sub-accesses and The sub-access frequencies are numbered in sequence; The expression of sub-access frequency is: ； In the formula, For the The frequency of sub-access, For the Abnormal visits, For the The amount of access data; Remove The maximum and minimum values ​​of the sub-access frequencies are obtained from the remaining Randomly select from the sub-access frequencies sub-access frequencies with non-adjacent numbers, Less than ,Will The sub-access frequency is marked as the target sub-access frequency; Will The target sub-access frequencies are accumulated and averaged to obtain the abnormal access frequency; The expression of abnormal access frequency is: ； In the formula, is the abnormal access frequency, For the The target sub-access frequency.

3. A security data leakage protection system according to claim 2, characterized in that: The method for obtaining the security configuration update degree includes: Obtained through security defense system The initial version level value of a security defense mechanism; After the preset update time, obtain The terminal version level value of a security defense mechanism; The security defense mechanism whose terminal version level value is higher than the initial version level value is recorded as the update mechanism, and the An update mechanism, Less than ; Will The terminal version level values ​​of the update mechanisms are compared with the corresponding initial version level values ​​to obtain Level update value; The expression for the level update value is: ； In the formula, For the Level update value, For the Terminal version level value, For the Initial version level value; Will The level update values ​​are accumulated and Compare the security defense mechanisms to obtain the security configuration update degree; The expression of security configuration update degree is: ； In the formula, To configure updates for security, For the Update the value of each level.

4. A security data leakage protection system according to claim 3, characterized in that: The method for obtaining the defense vulnerability fluctuation value includes: According to the preset scanning time, the security defense system of the Internet of Vehicles is scanned by vulnerability scanning tools. Scan and obtain Scan results; The scanned vulnerabilities in the scan results are divided into level 1 risk vulnerabilities and level 2 risk vulnerabilities according to the risk level; Mark the scanned vulnerabilities with risk level 2 as defense vulnerabilities and count the number of defense vulnerabilities; The first The number of defense vulnerabilities is Compare the difference in the number of defense vulnerabilities and obtain Vulnerability difference; The expression of the vulnerability difference is: ； In the formula, For the Vulnerability difference, For the The number of defense vulnerabilities, For the Number of defense vulnerabilities; Will The difference between the vulnerabilities is accumulated and The duration corresponding to the preset scanning time is averaged to obtain the defense vulnerability fluctuation value; The expression of the defense vulnerability fluctuation value is: ； In the formula, To prevent vulnerability fluctuations, For the Vulnerability difference, The duration corresponding to the preset scanning time.

5. A security data leakage protection system according to claim 4, characterized in that: The method for obtaining the suspicious data ratio value includes: Use network packet capture tools to capture network data in the Internet of Vehicles Real-time packet capture, obtained Data packets and statistics The total amount of data in a data packet; right The captured data is used to identify the protocol and data format, and the data corresponding to the uncommon protocols and non-standard data formats in the Internet of Vehicles are marked and counted. Amount of suspicious data; Will The amount of suspicious data Compare the total data values ​​one by one and obtain The percentage of children; The expression of the sub-ratio value is: ； In the formula, For the The percentage of children, For the Amount of suspicious data, For the Total amount of data; Will The percentage of each individual is accumulated and averaged to obtain the percentage of suspicious data; The expression of suspicious data ratio is: ； In the formula, is the percentage of suspicious data, For the The percentage of children; The expression of risk assessment coefficient is: ； In the formula, is the risk assessment coefficient, , , , is the weight coefficient; The determination method of whether to generate a risk warning prompt includes: The risk assessment factor Compared with the preset risk assessment threshold Difference comparison, If it is greater than 0, the risk assessment difference is obtained; The expression of risk assessment difference is: ； when When it is greater than 0, a risk warning prompt is generated; when When it is less than or equal to 0, it is determined that no risk warning prompt will be generated.

6. A security data leakage protection system according to claim 5, characterized in that: The defense selection level includes a primary selection level and a secondary selection level; The method for generating the primary selection level and the secondary selection level includes: Will fix the selection coefficient With the preset repair selection threshold Compare, Greater than 0; when Less than or equal to When , a first-level selection level is generated; when Greater than When , a secondary selection level is generated; Methods for selecting the first defense mode or the second defense mode include: When the defense selection level is the first level, select the first defense mode; When the defense selection level is the secondary selection level, the second defense mode is selected.

7. A security data leakage protection system according to claim 6, characterized in that: The passive defense instructions include reducing the frequency of abnormal access and reducing the proportion of suspicious data; The execution method of reducing the abnormal access frequency and reducing the proportion of suspicious data includes: Preset the minimum value of abnormal access frequency and the minimum value of suspicious data ratio; In the first defense mode, first reduce the frequency of abnormal access until no risk warning prompts are generated; In the first defense mode, when the frequency of abnormal access is reduced to the minimum value, the proportion of suspicious data is reduced until no risk warning prompt is generated; In the first defense mode, when the abnormal access frequency and the suspicious data ratio are reduced to the minimum value, no risk warning prompt is generated; Active defense instructions include increasing the security configuration update rate and reducing the defense vulnerability fluctuation value; The implementation methods for increasing the security configuration update rate and reducing the defense vulnerability fluctuation value include: The maximum value of the preset security configuration update degree and the minimum value of the defense vulnerability fluctuation value; In the second defense mode, first increase the security configuration update rate until no risk warning prompts are generated; In the second defense mode, when the security configuration update degree increases to the maximum value, the defense vulnerability fluctuation value is reduced until no risk warning prompt is generated; In the second defense mode, when the security configuration update degree increases to the maximum value and the defense vulnerability fluctuation value decreases to the minimum value, no risk warning prompt is generated.

8. A security data leakage protection method, applied to a big data server, implemented based on a security data leakage protection system according to any one of claims 1 to 7, characterized in that: include: S1: Collect comprehensive risk data that affects the security of Internet of Vehicles data; S2: Generate a risk assessment coefficient based on the comprehensive risk data, obtain a risk assessment difference based on the risk assessment coefficient, and determine whether to generate a risk warning prompt; If a risk warning is generated, execute S3-S6; If no risk warning is generated, repeat S1-S2; S3: Collect comprehensive repair parameters of the Internet of Vehicles, and generate a repair selection coefficient based on the comprehensive repair parameters and risk assessment differences; S4: generating a defense selection level based on the repair selection coefficient, and selecting a first defense mode or a second defense mode based on the defense selection level; S5: In the first defense mode, execute the passive defense command; S6: In the second defense mode, execute active defense instructions.

Images