Information security assessment detection system based on information protection

Abstract

The invention relates to the technical field of information security, and discloses an information security evaluation and detection system based on information protection. Comprising the steps of extracting attribute features to generate an information set, obtaining basic parameters of the information set, calculating a protection sequence value, sequentially collecting safety influence parameters in the information set, calculating a safety evaluation coefficient, marking an abnormal set and abnormal parameters, and generating a safety detection report; compared with the prior art, the method has the advantages that different types of information can be refined and distinguished, the safety evaluation coefficient can be accurately calculated in combination with the safety influence parameters, and the safety of the information in each information set can be accurately evaluated and detected; the information with low security can be integrated and displayed by constructing the security detection report, and the problems that different types of information intersect with each other and the security evaluation detection accuracy is low during security evaluation detection of the information are avoided.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and more specifically, to an information security assessment and detection system based on information protection. Background Art

[0002] The security of information is related to the healthy development of all walks of life. With the rapid development of Internet technology today, the information in the database must be kept safe to prevent the leakage and loss of information in the database due to the interference of external negative factors. Especially for non-public confidential information, the security of the information in the database must be maintained. Therefore, it is necessary to conduct security assessment and detection of the information in the database in order to better protect the information in the future.

[0003] The patent application with reference publication number CN116389171A discloses an information security assessment detection method, system, device and medium, which configures personnel steps, optimizes risk value calculation steps and optimizes risk acceptability judgment steps. When the risk value R after reduction is higher than the first threshold, the ratio of network maintenance personnel is optimized first, and then the optimized risk value R2 is calculated, and it is judged whether the optimized risk value R2 is acceptable; if the optimized risk value R2 is unacceptable, it proves that the network system itself also needs to be optimized; if the optimized risk value R2 is acceptable, it does not need to optimize the network system, thereby further reducing the cost of optimizing the network system;

[0004] The prior art has the following deficiencies:

[0005] When conducting security assessment on information, the existing information security assessment and detection system realizes the assessment and detection effect of the information security in the information database by comprehensively identifying, analyzing and calculating the information in the information database. Since the types of information stored in the information database are various, when the massive and complex information is comprehensively identified and analyzed and calculated, different types of information are prone to cross-over, resulting in chaos and disorder between the information. At the same time, the overall analysis and calculation of information will also increase the computational burden of information security assessment, thereby increasing the probability of errors in the security assessment and detection results, and reducing the accuracy of information security assessment and detection.

[0006] In view of this, the present invention proposes an information security assessment and detection system based on information protection to solve the above problems. Summary of the invention

[0007] In order to overcome the above-mentioned defects of the prior art and to achieve the above-mentioned purpose, the present invention provides the following technical solution: an information security assessment and detection system based on information protection, applied to an information security server, comprising:

[0008] An information set generation module is used to extract the attribute characteristics of the information in the information database, and to aggregate the information with the same attribute characteristics to generate an information set;

[0009] The information set sorting module is used to obtain the basic parameters of the information set, including the average level value and the average processing time, calculate the protection order value of the information set, and number the information set in order;

[0010] An evaluation coefficient calculation module is used to collect security impact parameters of the information set in order of numbers from small to large, the security impact parameters including abnormal access frequency, effective backup rate and encryption attenuation value, and calculate the security evaluation coefficient;

[0011] An abnormal marking identification module is used to compare the safety assessment coefficient with the safety standard coefficient, mark the abnormal set, and identify abnormal parameters from the abnormal set;

[0012] The report form generation module is used to construct a report form with a report station, which includes a collection station and a parameter station, and import the abnormal collection and abnormal parameters into the collection station and the parameter station respectively to generate a safety inspection report form.

[0013] Furthermore, attribute characteristics include system characteristics, user characteristics, confidential characteristics, public characteristics, and flow characteristics;

[0014] Methods for extracting system features, user features, confidential features, public features, and flow features include:

[0015] The attribute status of i pieces of information in the information database is queried one by one through the attribute management system, and the keyword recognition is performed on the i attribute statuses respectively through the natural language processing technology to obtain i keywords;

[0016] Compare the i keywords with the characteristic words in the system word set, user word set, confidential word set, public word set and mobile word set respectively;

[0017] The keywords that coincide with the characteristic words in the system word set, user word set, confidential word set, public word set and mobile word set are recorded as system characteristics, user characteristics, confidential characteristics, public characteristics and mobile characteristics respectively.

[0018] Furthermore, the method for generating the information set includes:

[0019] Aggregate information with attribute characteristics of system characteristics, user characteristics, confidential characteristics, public characteristics and flow characteristics to form a first information group, a second information group, a third information group, a fourth information group and a fifth information group;

[0020] Counting the number of information in the first information group, the second information group, the third information group, the fourth information group and the fifth information group one by one, and obtaining the system value, the user value, the confidential value, the public value and the flow value respectively;

[0021] Construct five independent blank sets, and mark points in the five blank sets that are equal in number to the system value, user value, confidential value, public value, and flow value;

[0022] A first contour line and a second contour line are drawn on both sides of the point along the vertical direction, and the bottom end of the first contour line and the bottom end of the second contour line are connected to form an information position;

[0023] The information in the first information group, the second information group, the third information group, the fourth information group and the fifth information group are respectively introduced into the information bits of the corresponding blank sets to generate p information sets.

[0024] Furthermore, the method for obtaining the average level value includes:

[0025] The hierarchical semantics of s information in p information sets are queried one by one through the hierarchical management system to obtain s hierarchical semantics;

[0026] The text part and the numerical part of the s level semantics are identified one by one by natural language processing technology, and the s level semantics are split into S text semantics and S numerical semantics based on the text part and the numerical part;

[0027] The numerical value in the numerical semantics is recorded as the level value, and the S level values ​​are accumulated one by one and averaged to obtain p average level values;

[0028] The expression for the average level value is:

[0029]

[0030] In the formula, DJ pjp is the average level value of the pth information set, DJ zpa is the ath level value of the pth information set.

[0031] Furthermore, the method for obtaining the average processing time includes:

[0032] Search the information database one by one for the processing events of the processed information with the same content as the s information in the p information set, and obtain s processing events;

[0033] Query the event durations of s processing events one by one through the timestamps to obtain the s event durations;

[0034] Subtract the duration of s events from the fixed delay duration of the information database in turn to obtain s processing durations, and then add up the s processing durations and calculate the average to obtain p average processing durations;

[0035] The expression of average processing time is:

[0036]

[0037] In the formula, SC pjp is the average processing time of the pth information set, SCs jpb is the duration of the bth event in the pth information set, SC yc is the fixed delay time of the information base;

[0038] The expression for protecting the order value is:

[0039] BH sxp =DJ pjp -SC pjp ;

[0040] In the formula, BH sxp is the protection order value of the pth information set.

[0041] Furthermore, the method for obtaining abnormal access frequency includes:

[0042] Query the time when the information in the p information sets first receives the access record through the timestamp, and obtain the p access start times;

[0043] Record the current time as the access end time, and record the period from the p access start time to the access end time as the access period, to obtain p access periods;

[0044] The access management system counts all the access records received by the information in the p information sets within the p access periods one by one, and queries the access attribute values ​​of all the access records one by one;

[0045] Record the access records with access attribute values ​​of unauthorized access and sensitive access values ​​as abnormal access behaviors, and count the number of abnormal access behaviors of p information sets to obtain p abnormal access values;

[0046] Compare the p abnormal access values ​​with the durations of the p access periods in sequence to obtain p abnormal access frequencies;

[0047] The expression of abnormal access frequency is:

[0048]

[0049] Where FW plp is the abnormal access frequency of the pth information set, YCfwp is the abnormal access value of the pth information set, SC sdp is the duration of the pth access period.

[0050] Furthermore, the method for obtaining the effective backup rate includes:

[0051] Identify the public status of the information in the p information sets one by one, record the information with a semi-public status and a closed status as information to be backed up, and count the number of information to be backed up;

[0052] Constructing backup status boxes one by one on all the information to be backed up, and matching the information to be backed up and the backup status boxes one by one to form a log to be backed up;

[0053] All logs to be backed up are backed up synchronously, and after a preset backup cycle, the backup management system is used to query the remark value of the backup status box of the logs to be backed up one by one;

[0054] The backup logs whose notes value in the backup status box has been backed up are recorded as valid backup logs, and the number of valid backup logs in p information sets is counted;

[0055] Compare the number of p valid backup logs with the number of p pieces of information to be backed up, and obtain p valid backup rates;

[0056] The expression of effective backup rate is:

[0057]

[0058] In the formula, YX bfp is the effective backup rate of the pth information set, SL rzp is the number of valid backup logs for the pth information set, SL bfp is the number of information to be backed up in the p-th information set.

[0059] Furthermore, the method for obtaining the encryption attenuation value includes:

[0060] The encryption management system queries the encryption data of the information in the p information sets one by one, and calculates the key length from the encryption data to obtain p initial key lengths;

[0061] Combine the p initial key lengths with the encryption algorithm to calculate the p initial encryption strengths;

[0062] The expression of initial encryption strength is:

[0063]

[0064] Where, QD csp is the initial encryption strength of the pth information set, MYcsp is the initial key length of the pth information set;

[0065] Within a preset attack cycle, the information in the p information sets is cryptographically attacked by the attack model, and the encrypted data of the information in the p information sets are queried one by one, and the key length is calculated from the encrypted data to obtain p termination key lengths;

[0066] Combine the p termination key lengths with the encryption algorithm to calculate the p termination encryption strengths;

[0067] The expression for the termination encryption strength is:

[0068]

[0069] Where, QD zzp is the termination encryption strength of the pth information set, MY zzp is the termination key length of the pth information set;

[0070] Subtract the p initial encryption strengths from the p termination encryption strengths in turn to obtain p encryption attenuation values;

[0071] The expression of encryption decay value is:

[0072] JM sjp =QD csp -QD zzp ;

[0073] In the formula, JM sjp is the encryption attenuation value of the pth information set;

[0074] The expression of safety assessment coefficient is:

[0075]

[0076] Where AQ xsp is the security assessment coefficient of the pth information set, σ1, σ2, σ3 are weight coefficients greater than 0.

[0077] Furthermore, the marking method of the abnormal set includes:

[0078] The security assessment coefficient AQ of p information sets xsp One by one with the safety standard factor AQ bz Compare;

[0079] When AQ xsp Greater than or equal to AQ bz When , the pth information set is not marked as an abnormal set;

[0080] When AQ xsp Less than AQbz When , mark the pth information set as an abnormal set, and obtain x abnormal sets;

[0081] Methods for identifying abnormal parameters include:

[0082] The abnormal access frequencies in the x abnormal sets are compared with the frequency standard values ​​in sequence. When the abnormal access frequency is greater than the frequency standard value, the abnormal access frequency is identified as an abnormal parameter.

[0083] Compare the effective backup rates in the x abnormal sets with the backup standard values ​​in turn, and when the effective backup rate is less than the backup standard value, identify the effective backup rate as an abnormal parameter;

[0084] The encrypted attenuation values ​​in the x abnormal sets are compared with the attenuation standard values ​​in turn. When the encrypted attenuation value is greater than the attenuation standard value, the encrypted attenuation value is identified as an abnormal parameter.

[0085] Furthermore, the method for generating the safety inspection report includes:

[0086] A blank report form is constructed through the form management system, and a header area and x parallel content areas are drawn in the report form;

[0087] A blank workstation is constructed on the left side of each of the x content areas, and the attribute characteristics of the information set are noted on the blank workstation to obtain x collection workstations;

[0088] Three blank workstations are constructed on the right side of the x content areas, and the workstation numbers are respectively noted on the three blank workstations to obtain parameter workstations;

[0089] Import x exception sets and the exception parameters in the corresponding exception sets into x set stations and corresponding parameter stations respectively, and obtain x imported content areas;

[0090] Arrange the x imported content areas from top to bottom in descending order of safety assessment coefficients to generate a safety inspection report.

[0091] The technical effects and advantages of the information security assessment and detection system based on information protection of the present invention are as follows:

[0092] The present invention extracts the attribute characteristics of information in the information database, aggregates the information with the same attribute characteristics, generates an information set, obtains the basic parameters of the information set, calculates the protection sequence value of the information set, and sequentially numbers the information set, collects the security impact parameters in the information set in sequence according to the numbering from small to large, calculates the security assessment coefficient, compares the security assessment coefficient with the security standard coefficient, marks the abnormal set, identifies the abnormal parameters from the abnormal set, constructs a report sheet with a reporting station, and imports the abnormal set and the abnormal parameters into the set station and the parameter station respectively to generate a security detection report sheet; compared with the prior art, by extracting the attribute characteristics of information in the information database, the present invention ... The characteristics of the information database can divide the massive and complex information into several independent information sets, so as to distinguish different types of information in detail, and combine with the security impact parameters to accurately calculate the security assessment coefficient, so as to accurately assess and detect the security of the information in each information set. At the same time, after identifying the abnormal sets and abnormal parameters, the information with lower security can be integrated and displayed by constructing a security detection report, so as to quickly and accurately perform security assessment and detection operations on the massive and complex information in the information database, avoiding the problems of cross-over between different types of information and low accuracy of security assessment and detection during security assessment and detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0093] Figure 1 A schematic diagram of an information security assessment and detection system based on information protection provided in Embodiment 1 of the present invention;

[0094] Figure 2 A flowchart of an information security assessment and detection method based on information protection provided in Embodiment 2 of the present invention. DETAILED DESCRIPTION

[0095] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0096] Example 1: Please refer to Figure 1 As shown, the information security assessment and detection system based on information protection described in this embodiment is applied to an information security server, including:

[0097] The information set generation module extracts the attribute characteristics of the information in the information database, and aggregates the information with the same attribute characteristics to generate an information set;

[0098] Attribute features refer to phrases that can accurately and concisely represent the true meaning of the information in the information database, so as to accurately replace information with longer content or more complex types. At the same time, they can also provide a basis for distinguishing subsequent information, ensuring that different information in the information database can be quickly and accurately distinguished.

[0099] Attribute features include system features, user features, confidential features, public features, and flow features; system features refer to features that can represent the system software of the information database itself, user features refer to features that can represent the target user of the information, confidential features refer to features that can represent non-public information that needs to be encrypted, public features refer to features that can represent public information that does not need to be encrypted, and flow features refer to features that can represent information that can be randomly mobilized in the information database;

[0100] Methods for extracting system features, user features, confidential features, public features, and flow features include:

[0101] The attribute status of i information in the information database is queried one by one through the attribute management system, and the keyword recognition of i attribute status is performed respectively through the natural language processing technology to obtain i keywords; the attribute status is used to represent the status of the category of information, that is, to accurately represent information of different categories, so that the attribute status can represent the status of system, user, confidential, public and flow types of information;

[0102] Compare the i keywords with the characteristic words in the system word set, user word set, confidential word set, public word set and mobile word set respectively; the system word set, user word set, confidential word set, public word set and mobile word set refer to pre-stored sets that can summarize the characteristic words of the system, user, confidential, public and mobile, which can be used as the basis for subsequent comparison of keywords, so as to accurately identify the system characteristics, user characteristics, confidential characteristics, public characteristics and mobile characteristics;

[0103] The keywords that coincide with the characteristic words in the system word set are recorded as system characteristics;

[0104] The keywords that coincide with the characteristic words in the user word set are recorded as user characteristics;

[0105] The keywords that coincide with the characteristic words in the confidential word set are recorded as confidential features;

[0106] The keywords that coincide with the characteristic words in the public word set are recorded as public characteristics;

[0107] The keywords that coincide with the characteristic words in the flow word set are recorded as flow characteristics.

[0108] After obtaining system characteristics, user characteristics, confidential characteristics, public characteristics and flow characteristics, all information in the information database can be accurately identified. At the same time, when a large amount of information with different attribute characteristics in the information database is summarized into an overall structure, it is easy for different attribute characteristics to cross-influence each other, which is not convenient for subsequent rapid and accurate collection of relevant parameters of the information in the information database. Therefore, it is necessary to further distinguish a large amount of information with different attribute characteristics in the information database;

[0109] After the information in the information database is further differentiated, the information with the same attribute characteristics can be gathered together, and the information with the same attribute characteristics can be summarized to form an information set, so that the information in each information set has the same attribute characteristics, thereby avoiding the phenomenon of inaccurate collection when the relevant parameters in the information set are collected later;

[0110] The method for generating an information set includes:

[0111] Aggregate information with attribute characteristics of system characteristics, user characteristics, confidential characteristics, public characteristics and flow characteristics to form a first information group, a second information group, a third information group, a fourth information group and a fifth information group;

[0112] Counting the number of information in the first information group, the second information group, the third information group, the fourth information group and the fifth information group one by one, and obtaining the system value, the user value, the confidential value, the public value and the flow value respectively;

[0113] Construct five independent blank sets, and mark points in the five blank sets that are equal in number to the system value, user value, confidential value, public value, and flow value;

[0114] A first contour line and a second contour line are drawn on both sides of the point in the vertical direction, and the bottom end of the first contour line and the bottom end of the second contour line are connected to form an information position; an information position refers to a point that can provide an accurate position for the introduction of an information group, so as to ensure that the information in each information group can be accurately introduced into the corresponding position, and ensure the independence and accuracy of the information position in each information group;

[0115] The information in the first information group, the second information group, the third information group, the fourth information group and the fifth information group are respectively introduced into the information bits of the corresponding blank sets to generate p information sets.

[0116] The information set sorting module obtains the basic parameters of the information set, calculates the protection order value of the information set, and numbers the information set in order;

[0117] Basic parameters refer to parameters that can affect the order of security assessment and detection of information sets, thereby providing data support for the order of security assessment and detection of each information set and serving as the basis for subsequent calculation of protection order values;

[0118] Basic parameters include average level value and average processing time;

[0119] The average level value refers to the average value of the processing level corresponding to the information in each information set, which can be used to indicate the level of processing of the information in each information set. The larger the average level value, the larger the average value of the processing level corresponding to the information in the information set, the higher the order of security assessment detection of the information set, and the larger the protection order value;

[0120] The methods for obtaining the average level value include:

[0121] The hierarchical semantics of the s information in the p information sets are queried one by one through the hierarchical management system to obtain S hierarchical semantics; hierarchical semantics is used to express the priority of information processing, that is, the processing priority of each information is numerically expressed;

[0122] The text part and the numerical part of the S hierarchical semantics are identified one by one through natural language processing technology, and the s hierarchical semantics are split into s textual semantics and s numerical semantics with the textual part and the numerical part as the splitting points; the textual part and the numerical part are used to represent the text and the numerical value in the hierarchical semantics respectively, and serve as the basis for splitting the hierarchical semantics, so as to ensure the accuracy of the hierarchical semantic splitting;

[0123] The numerical value in the numerical semantics is recorded as the level value, and the s level values ​​are accumulated one by one and averaged to obtain p average level values;

[0124] The expression for the average level value is:

[0125]

[0126] In the formula, DJ pjp is the average level value of the pth information set, DJ zpa is the ath level value of the pth information set.

[0127] The average processing time refers to the average processing time corresponding to the disassembly and analysis of the information in each information set, which can be used to represent the processing time of the information in each information set. The longer the average processing time is, the later the order of security assessment and detection of the information set is, and the smaller the protection order value is.

[0128] Methods for obtaining the average processing time include:

[0129] Search the information database one by one for the processing events of the processed information with the same content as the s information in the p information set, and obtain s processing events;

[0130] Query the event durations of S processing events one by one through the timestamps to obtain s event durations;

[0131] Subtract the duration of s events from the fixed delay duration of the information database in turn to obtain s processing durations, and then add up the s processing durations and calculate the average to obtain p average processing durations; the fixed delay duration of the information database refers to the inherent duration of the information database when processing any information. The fixed delay duration of the information database is not used as the occupied duration of information processing, so the fixed delay duration of the information database needs to be eliminated;

[0132] The expression of average processing time is:

[0133]

[0134] In the formula, SC pjp is the average processing time of the pth information set, SC sjpb is the duration of the bth event in the pth information set, SC yc is the fixed delay time of the information base.

[0135] The expression for protecting the order value is:

[0136] BH sxp =DJ pjp -SC pjp ;

[0137] In the formula, BH sxp is the protection order value of the pth information set.

[0138] After obtaining the protection sequence value of the information set, the order of security assessment and detection of the information set can be arranged and numbered according to the size of the protection sequence value, ensuring that all information sets can be security assessed and detected in sequence in a specific order to ensure the orderliness of security assessment and detection;

[0139] When it is required to number the information sets in order, the protection sequence values ​​of the p information sets are arranged in descending order, and the information set corresponding to the first protection sequence value is numbered 1, the information set corresponding to the second protection sequence value is numbered 2, and so on, until all the p information sets are numbered.

[0140] The evaluation coefficient calculation module collects the safety impact parameters of the information set in order from small to large numbers, and calculates the safety evaluation coefficient;

[0141] Security impact parameters refer to parameters that can have a positive or negative impact on the security status of information in an information set, that is, they can represent various interferences and impacts on the information in the information set, and serve as the data basis for subsequent security impact parameters. In order to ensure the orderly collection of security impact parameters in each information set, it is necessary to limit the collection order of security impact parameters in the information set. In this case, they need to be collected in ascending order of numbers.

[0142] Security impact parameters include abnormal access frequency, effective backup rate, and encryption decay value;

[0143] Abnormal access frequency refers to the number of abnormal access behaviors that occur to the information in the information set within a unit time, which can be used to indicate the abnormal access to the information in the information set. The greater the abnormal access frequency, the greater the number of abnormal access behaviors that occur to the information in the information set within a unit time. At this time, the security of the information in the information set is lower, and the security assessment coefficient is smaller.

[0144] Methods for obtaining abnormal access frequency include:

[0145] Query the time when the information in the p information sets first receives the access record through the timestamp, and obtain the p access start times;

[0146] Record the current time as the access end time, and record the period from the p access start time to the access end time as the access period, to obtain p access periods;

[0147] The access management system counts all the access records received by the information in the p information sets within the p access periods one by one, and queries the access attribute values ​​of all the access records one by one; the access attribute value is used to represent the type of the access record. The access attribute value includes unauthorized access, sensitive access value and authorized access; thus, the access records with different attributes can be accurately represented;

[0148] Record the access records with access attribute values ​​of unauthorized access and sensitive access values ​​as abnormal access behaviors, and count the number of abnormal access behaviors of p information sets to obtain p abnormal access values;

[0149] Compare the p abnormal access values ​​with the durations of the p access periods in sequence to obtain p abnormal access frequencies;

[0150] The expression of abnormal access frequency is:

[0151]

[0152] Where FW plp is the abnormal access frequency of the pth information set, YCfwp is the abnormal access value of the pth information set, SC sdp is the duration of the pth access period.

[0153] The effective backup rate refers to the ratio of the number of information in the information set that has been safely backed up to the total number of information that needs to be backed up, which can be used to indicate the backup status of the information in the information set. The larger the effective backup rate, the larger the ratio of the number of information in the information set that has been safely backed up to the total number of information that needs to be backed up. At this time, the security of the information in the information set is higher, and the security assessment coefficient is greater.

[0154] Methods for obtaining the effective backup rate include:

[0155] Identify the public status of the information in the p information sets one by one, record the information with a semi-public status and a closed status as information to be backed up, and count the number of information to be backed up; the public status is used to represent the public attribute of the information, which can be used as a basis for determining whether the information needs to be backed up. The public status includes semi-public status, closed status and full public status;

[0156] Constructing backup status boxes one by one on all the information to be backed up, and matching the information to be backed up and the backup status boxes one by one to form a log to be backed up;

[0157] All logs to be backed up are backed up synchronously, and after a preset backup cycle, the remark values ​​in the backup status boxes of the logs to be backed up are queried one by one through the backup management system; the preset backup cycle refers to the minimum time required for the logs to be backed up to complete a backup, which can ensure that the remark values ​​in the backup status boxes of the logs to be backed up can change;

[0158] The backup status box's remark value is the backed up log to be backed up as a valid backup log, and the number of valid backup logs in p information sets is counted; the backup status box's remark value includes backed up and not backed up, which is used to indicate whether the log to be backed up is backed up or not;

[0159] Compare the number of p valid backup logs with the number of p pieces of information to be backed up, and obtain p valid backup rates;

[0160] The expression of effective backup rate is:

[0161]

[0162] In the formula, YX bfp is the effective backup rate of the pth information set, SI rzp is the number of valid backup logs for the pth information set, SL bfp is the number of information to be backed up in the p-th information set.

[0163] The encryption attenuation value refers to the attenuation amplitude of the encryption strength of the information in the information set in a unit time, which can be used to indicate the anti-attack capability of the information in the information set. The larger the encryption attenuation value, the greater the attenuation amplitude of the encryption strength of the information in the information set in a unit time. At this time, the security of the information in the information set is lower, and the security assessment coefficient is smaller.

[0164] Methods for obtaining the encryption attenuation value include:

[0165] The encryption management system queries the encryption data of the information in the p information sets one by one, and calculates the key length from the encryption data to obtain p initial key lengths;

[0166] Combine the p initial key lengths with the encryption algorithm to calculate the p initial encryption strengths;

[0167] The expression of initial encryption strength is:

[0168]

[0169] Where, QD csp is the initial encryption strength of the pth information set, MY csp is the initial key length of the pth information set;

[0170] Within a preset attack cycle, the information in p information sets is cryptographically attacked through the attack model, and the encrypted data of the information in the p information sets is queried one by one, and the key length is calculated from the encrypted data to obtain p termination key lengths; the preset attack cycle refers to the length of time corresponding to the encrypted data of the information being able to undergo sufficient changes, thereby ensuring that the attack model can exert sufficient attack behavior on the information so that the encrypted data can change; the attack model refers to a model that the information security server constructs after collecting a large amount of historical information attacked data and can meet the current encrypted data attack;

[0171] Combine the p termination key lengths with the encryption algorithm to calculate the p termination encryption strengths;

[0172] The expression for the termination encryption strength is:

[0173]

[0174] Where, QD zzp is the termination encryption strength of the pth information set, MY zzp is the termination key length of the pth information set;

[0175] Subtract the p initial encryption strengths from the p termination encryption strengths in turn to obtain p encryption attenuation values;

[0176] The expression of encryption decay value is:

[0177] JM sjp =QD csp –QD zzp ;

[0178] In the formula, JM sjp is the encryption attenuation value of the pth information set.

[0179] After obtaining the abnormal access frequency, effective backup rate and encryption decay value, the security assessment coefficient can be calculated according to the abnormal access frequency, effective backup rate and encryption decay value, so that the security assessment coefficient can numerically represent the security of the information in the information set and serve as the numerical basis for subsequent security assessment;

[0180] The expression of safety assessment coefficient is:

[0181]

[0182] Where AQ xsp is the security assessment coefficient of the pth information set, σ1, σ2, σ3 are weight coefficients greater than 0;

[0183] In the formula, σ1+σ2+σ3=1, exemplarily, σ1 is 0.32, σ2 is 0.35, and σ3 is 0.33; it should be noted that σ1, σ2, and σ3 are for the proportion of abnormal access frequency, effective backup rate, and encryption attenuation value in the security assessment coefficient, so that the influence of abnormal access frequency, effective backup rate, and encryption attenuation value on the size of the security assessment coefficient can be kept relatively balanced, thereby ensuring the accuracy of the entire assessment coefficient.

[0184] The abnormal marking identification module compares the safety assessment coefficient with the safety standard coefficient, marks the abnormal set, and identifies the abnormal parameters from the abnormal set;

[0185] After the security assessment coefficient is calculated, the security of the information in each information set can be identified according to the size of the security assessment coefficient, and the information set with lower security is recorded as an abnormal set;

[0186] The marking methods for the exception collection include:

[0187] The security assessment coefficient AQ of p information sets xsp One by one with the safety standard factor AQ bzComparison; the safety standard coefficient refers to the maximum value of the safety assessment coefficient when the information set is identified as an abnormal set, so as to accurately distinguish the abnormal set from the non-abnormal set; the safety standard coefficient is obtained by collecting a large number of maximum values ​​of the safety assessment coefficients when the information set is identified as an abnormal set and calculating their average value;

[0188] When AQ xsp Greater than or equal to AQ bz When , it means that the security assessment coefficient of the p-th information set is greater than or equal to the security standard coefficient. At this time, the security of the p-th information set is higher, and the p-th information set is not marked as an abnormal set;

[0189] When AQ xsp Less than AQ bz When , it means that the security assessment coefficient of the p-th information set is less than the security standard coefficient. At this time, the security of the p-th information set is low, so the p-th information set is marked as an abnormal set, and x abnormal sets are obtained.

[0190] Abnormal parameters refer to the parameters in the abnormal set that will have a negative impact on the security of the information in the information set, and serve as the basis for subsequent security assessment and analysis;

[0191] Methods for identifying abnormal parameters include:

[0192] The abnormal access frequencies in the x abnormal sets are compared with the frequency standard values ​​in sequence; the frequency standard value refers to the maximum value when the abnormal access frequency is identified as an abnormal parameter, which can limit the upper limit of the abnormal access frequency;

[0193] When the abnormal access frequency is greater than the frequency standard value, the abnormal access frequency of the abnormal set will have a negative impact on the security of the information, and the abnormal access frequency is identified as an abnormal parameter;

[0194] Compare the effective backup rates in the x abnormal sets with the backup standard values ​​in turn; the backup standard value refers to the minimum value when the effective backup rate is identified as an abnormal parameter, which can limit the lower limit of the effective backup rate;

[0195] When the effective backup rate is less than the backup standard value, the effective backup rate of the abnormal set will have a negative impact on the security of the information, and the effective backup rate will be identified as an abnormal parameter;

[0196] Compare the encrypted attenuation values ​​in the x abnormal sets with the attenuation standard value in turn; the attenuation standard value refers to the maximum value when the encrypted attenuation value is identified as an abnormal parameter, which can limit the upper limit of the encrypted attenuation value;

[0197] When the encryption attenuation value is greater than the attenuation standard value, the encryption attenuation value of the abnormal set will have a negative impact on the security of the information, and the encryption attenuation value is identified as an abnormal parameter.

[0198] The report form generation module constructs a report form with a report station, and imports the abnormal set and abnormal parameters into the set station and parameter station respectively to generate a safety inspection report form;

[0199] The report sheet refers to a blank form that can provide an import space for anomaly sets and anomaly parameters, and after the anomaly sets and anomaly parameters are imported, a security detection report sheet is formed, so that the security detection report sheet can represent the overall security of the information in the information database and be displayed externally as an evaluation and detection result of the information security in the information database;

[0200] The report station includes a collection station and a parameter station; the collection station is used to provide a location for importing abnormal collections, and the parameter station is used to provide a location for importing abnormal parameters;

[0201] The methods for generating a safety inspection report include:

[0202] A blank report form is constructed through the form management system, and a header area and x parallel content areas are drawn in the report form; the header area and the content area are the basic areas constituting the report form, so that the header area can be used to annotate the name of the report form, and the content area can be used to annotate the substantial content of the report form;

[0203] A blank workstation is constructed on the left side of each of the x content areas, and the attribute characteristics of the information set are noted on the blank workstation to obtain x collection workstations;

[0204] Three blank workstations are constructed on the right side of the x content areas, and the workstation numbers are respectively noted on the three blank workstations to obtain parameter workstations;

[0205] Import x exception sets and the exception parameters in the corresponding exception sets into x set stations and corresponding parameter stations respectively, and obtain x imported content areas;

[0206] Arrange the x imported content areas from top to bottom in descending order of safety assessment coefficients to generate a safety inspection report.

[0207] It should be noted that when a security inspection report is obtained, the security inspection report can display the security of the information in the information database, that is, it can separately indicate the security level of the information in each information set, and it is also convenient to display the security assessment data of multiple information sets on one report, thereby enabling a comprehensive and accurate visual assessment and detection display effect of the information security situation in the information database.

[0208] In this embodiment, by extracting the attribute characteristics of the information in the information database, and aggregating the information with the same attribute characteristics, an information set is generated, the basic parameters of the information set are obtained, the protection sequence value of the information set is calculated, and the information set is numbered in order, and the safety impact parameters in the information set are collected in order from small to large, and the safety assessment coefficient is calculated, the safety assessment coefficient is compared with the safety standard coefficient, the abnormal set is marked, and the abnormal parameters are identified from the abnormal set, a report sheet with a reporting station is constructed, and the abnormal set and the abnormal parameters are respectively imported into the collection station and the parameter station to generate a safety inspection report sheet; compared with the prior art, by extracting Attribute characteristics can divide the massive and complex information in the information database into several independent information sets, so as to refine and distinguish different types of information, and combine with security impact parameters to accurately calculate the security assessment coefficient, so as to accurately assess and detect the security of the information in each information set. At the same time, after identifying abnormal sets and abnormal parameters, the information with lower security can be integrated and displayed by constructing a security detection report, so as to quickly and accurately perform security assessment and detection operations on the massive and complex information in the information database, avoiding the intersection of different types of information and low accuracy of security assessment and detection during security assessment and detection.

[0209] Example 2: Please refer to Figure 2 As shown, the part not described in detail in this embodiment is described in the first embodiment, and an information security assessment and detection method based on information protection is provided, which is applied to an information security server and is implemented by an information security assessment and detection system based on information protection, including:

[0210] S1: Extract the attribute characteristics of the information in the information database, and aggregate the information with the same attribute characteristics to generate an information set;

[0211] S2: Obtain basic parameters of the information set, including the average level value and the average processing time, calculate the protection order value of the information set, and number the information set in order;

[0212] S3: Collect the security impact parameters of the information set in order from small to large numbers, including abnormal access frequency, effective backup rate and encryption attenuation value, and calculate the security assessment coefficient;

[0213] S4: compare the safety assessment coefficient with the safety standard coefficient, mark the abnormal set, and identify the abnormal parameters from the abnormal set;

[0214] S5: Construct a report sheet with a reporting station, the reporting station includes a collection station and a parameter station, and import the abnormal collection and abnormal parameters into the collection station and the parameter station respectively to generate a safety inspection report sheet.

[0215] The above description is only a specific implementation mode of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be covered by the protection scope of the present invention.

Claims

1. An information security assessment and detection system based on information protection, applied to an information security server, characterized in that: include: An information set generation module is used to extract the attribute characteristics of the information in the information database, and to aggregate the information with the same attribute characteristics to generate an information set; The information set sorting module is used to obtain the basic parameters of the information set, including the average level value and the average processing time, calculate the protection order value of the information set, and number the information set in order; An evaluation coefficient calculation module is used to collect security impact parameters of the information set in order of numbers from small to large, the security impact parameters including abnormal access frequency, effective backup rate and encryption attenuation value, and calculate the security evaluation coefficient; An abnormal marking identification module is used to compare the safety assessment coefficient with the safety standard coefficient, mark the abnormal set, and identify abnormal parameters from the abnormal set; The report form generation module is used to construct a report form with a reporting station, which includes a collection station and a parameter station, and import the abnormal collection and abnormal parameters into the collection station and the parameter station respectively to generate a safety inspection report form.

2. The information security assessment and detection system based on information protection according to claim 1 is characterized in that: The attribute characteristics include system characteristics, user characteristics, confidential characteristics, public characteristics and flow characteristics; Methods for extracting system features, user features, confidential features, public features, and flow features include: The attribute status of i pieces of information in the information database is queried one by one through the attribute management system, and the keyword recognition is performed on the i attribute statuses respectively through the natural language processing technology to obtain i keywords; Compare the i keywords with the characteristic words in the system word set, user word set, confidential word set, public word set and mobile word set respectively; The keywords that coincide with the characteristic words in the system word set, user word set, confidential word set, public word set and mobile word set are recorded as system characteristics, user characteristics, confidential characteristics, public characteristics and mobile characteristics respectively.

3. The information security assessment and detection system based on information protection according to claim 2 is characterized in that: The method for generating the information set includes: Aggregate information with attribute characteristics of system characteristics, user characteristics, confidential characteristics, public characteristics and flow characteristics to form a first information group, a second information group, a third information group, a fourth information group and a fifth information group; Counting the number of information in the first information group, the second information group, the third information group, the fourth information group and the fifth information group one by one, and obtaining the system value, the user value, the confidential value, the public value and the flow value respectively; Construct five independent blank sets, and mark points in the five blank sets that are equal in number to the system value, user value, confidential value, public value, and flow value; A first contour line and a second contour line are drawn on both sides of the point along the vertical direction, and the bottom end of the first contour line and the bottom end of the second contour line are connected to form an information position; The information in the first information group, the second information group, the third information group, the fourth information group and the fifth information group are respectively introduced into the information bits of the corresponding blank sets to generate p information sets.

4. The information security assessment and detection system based on information protection according to claim 3 is characterized in that: The method for obtaining the average level value includes: The hierarchical semantics of the s information in the p information sets are queried one by one through the hierarchical management system to obtain S hierarchical semantics; The text part and the numerical part of the s hierarchical semantics are identified one by one by using natural language processing technology, and the s hierarchical semantics are split into s textual semantics and s numerical semantics based on the text part and the numerical part; The numerical value in the numerical semantics is recorded as the level value, and the s level values ​​are accumulated one by one and averaged to obtain p average level values; The expression for the average level value is: In the formula, DJ pjp is the average level value of the pth information set, DJ zpa is the ath level value of the pth information set.

5. The information security assessment and detection system based on information protection according to claim 4 is characterized in that: The method for obtaining the average processing time includes: Search the information database one by one for the processing events of the processed information with the same content as the s information in the p information set, and obtain S processing events; Query the event durations of S processing events one by one through the timestamps to obtain s event durations; Subtract the duration of s events from the fixed delay duration of the information database in turn to obtain s processing durations, and then add up the S processing durations and calculate the average to obtain p average processing durations; The expression of average processing time is: In the formula, SC pjp is the average processing time of the pth information set, SC sjpb is the duration of the bth event in the pth information set, SC yc is the fixed delay time of the information base; The expression for protecting the order value is: BH sxp =DJ pip -SC pjp ; In the formula, BH sxp is the protection order value of the pth information set.

6. The information security assessment and detection system based on information protection according to claim 5 is characterized in that: The method for obtaining the abnormal access frequency includes: Query the time when the information in the p information sets first receives the access record through the timestamp, and obtain the p access start times; Record the current time as the access end time, and record the period from the p access start time to the access end time as the access period, to obtain p access periods; The access management system counts all the access records received by the information in the p information sets within the p access periods one by one, and queries the access attribute values ​​of all the access records one by one; Record access records with access attribute values ​​of unauthorized access and sensitive access values ​​as abnormal access behaviors, and count the number of abnormal access behaviors of p information sets to obtain p abnormal access values; Compare the p abnormal access values ​​with the durations of the p access periods in sequence to obtain p abnormal access frequencies; The expression of abnormal access frequency is: Where FW plp is the abnormal access frequency of the pth information set, YC fwp is the abnormal access value of the pth information set, SC sdp is the duration of the pth access period.

7. The information security assessment and detection system based on information protection according to claim 6 is characterized in that: The method for obtaining the effective backup rate includes: Identify the public status of the information in the p information sets one by one, record the information with a semi-public status and a closed status as information to be backed up, and count the number of information to be backed up; Constructing backup status boxes one by one on all the information to be backed up, and matching the information to be backed up and the backup status boxes one by one to form a log to be backed up; All logs to be backed up are backed up synchronously, and after a preset backup cycle, the backup management system is used to query the remark value of the backup status box of the logs to be backed up one by one; The backup logs whose notes value in the backup status box has been backed up are recorded as valid backup logs, and the number of valid backup logs in p information sets is counted; Compare the number of p valid backup logs with the number of p pieces of information to be backed up, and obtain p valid backup rates; The expression of effective backup rate is: In the formula, YX bfp is the effective backup rate of the pth information set, SL rzp is the number of valid backup logs for the pth information set, SL bfp is the number of information to be backed up in the p-th information set.

8. The information security assessment and detection system based on information protection according to claim 7 is characterized in that: The method for obtaining the encrypted attenuation value includes: The encryption management system queries the encryption data of the information in the p information sets one by one, and calculates the key length from the encryption data to obtain p initial key lengths; Combine the p initial key lengths with the encryption algorithm to calculate the p initial encryption strengths; The expression of initial encryption strength is: Where, QD csp is the initial encryption strength of the pth information set, MY csp is the initial key length of the pth information set; Within a preset attack cycle, the information in the p information sets is cryptographically attacked by the attack model, and the encrypted data of the information in the p information sets are queried one by one, and the key length is calculated from the encrypted data to obtain p termination key lengths; Combine the p termination key lengths with the encryption algorithm to calculate the p termination encryption strengths; The expression for the termination encryption strength is: Where, QD zzp is the termination encryption strength of the pth information set, MY zzp is the termination key length of the pth information set; Subtract the p initial encryption strengths from the p termination encryption strengths in turn to obtain p encryption attenuation values; The expression of encryption decay value is: JM sjp =QD csp -QD zzp ; In the formula, JM sjp is the encryption attenuation value of the pth information set; The expression of safety assessment coefficient is: Where AQ xsp is the security assessment coefficient of the pth information set, σ1, σ2, σ3 are weight coefficients greater than 0.

9. The information security assessment and detection system based on information protection according to claim 8 is characterized in that: The marking method of the abnormal set includes: The security assessment coefficient AQ of p information sets xsp One by one with the safety standard factor AQ bz Compare; When AQ xsp Greater than or equal to AQ bz When , the pth information set is not marked as an abnormal set; When AQ xsp Less than AQ bz When , mark the pth information set as an abnormal set, and obtain x abnormal sets; Methods for identifying abnormal parameters include: The abnormal access frequencies in the x abnormal sets are compared with the frequency standard values ​​in sequence. When the abnormal access frequency is greater than the frequency standard value, the abnormal access frequency is identified as an abnormal parameter. Compare the effective backup rates in the x abnormal sets with the backup standard values ​​in turn, and when the effective backup rate is less than the backup standard value, identify the effective backup rate as an abnormal parameter; The encrypted attenuation values ​​in the x abnormal sets are compared with the attenuation standard values ​​in turn. When the encrypted attenuation value is greater than the attenuation standard value, the encrypted attenuation value is identified as an abnormal parameter.

10. The information security assessment and detection system based on information protection according to claim 9 is characterized in that: The method for generating the safety inspection report includes: A blank report form is constructed through the form management system, and a header area and x parallel content areas are drawn in the report form; A blank workstation is constructed on the left side of each of the x content areas, and the attribute characteristics of the information set are noted on the blank workstation to obtain x collection workstations; Three blank workstations are constructed on the right side of the x content areas, and the workstation numbers are respectively noted on the three blank workstations to obtain parameter workstations; Import x exception sets and the exception parameters in the corresponding exception sets into x set stations and corresponding parameter stations respectively, and obtain x imported content areas; Arrange the x imported content areas from top to bottom in descending order of safety assessment coefficients to generate a safety inspection report.

Images