Data security management method, system and equipment based on cross-architecture pipeline

Abstract

The invention provides a data security management method, system and device based on a cross-architecture assembly line, and the method comprises the steps: dividing a data security management cycle into a plurality of monitoring sub-regions according to a preset time period, and collecting various communication security management data of each monitoring sub-region based on the cross-architecture assembly line; calculating a corresponding communication security management index according to each type of communication security management data; comparing each communication security management index of each monitoring sub-region with a corresponding preset index, and sending a risk processing signal in the monitoring sub-region with an abnormality; and calculating a communication security management efficiency coefficient according to all the communication security management indexes of each monitoring sub-region, and sending an early warning signal when the communication security management efficiency coefficient is abnormal. According to the method, the data acquisition and processing efficiency is improved by applying the cross-architecture assembly line, a plurality of evaluation indexes are integrated, and the comprehensiveness, intelligence and high efficiency of data security management are improved.

Description

Technical Field

[0001] The present application relates to the field of data security management technology, and in particular to a data security management method, system and device based on a cross-architecture pipeline. Background Art

[0002] As the amount and types of business data that need to be processed in the business network of enterprises continue to increase, data security has attracted more and more attention. Through data security management, the security risks of information data can be reduced.

[0003] In related technologies, when conducting data security management, a data security risk assessment system is usually built to analyze and calculate the security risks of the business network. By collecting data from different sources during business use, extracting the main component information for later analysis, and mining the correlation between the data, the data risk assessment results are obtained.

[0004] However, the data security risk assessment systems in related technologies have the defect of being unable to conduct real-time and comprehensive data security management, resulting in low efficiency of data security management. For example, the security assessment systems in related technologies often cannot respond to data risks in real time and lack the ability to quickly identify, analyze and respond to data risks; moreover, these systems usually only focus on security controls in a single architecture or a specific field, resulting in poor implementation of security management strategies. Summary of the invention

[0005] The present application aims to solve one of the technical problems in the related art at least to some extent.

[0006] To this end, the first purpose of this application is to propose a data security management method based on a cross-architecture pipeline, which develops a more advanced, intelligent and efficient data risk identification system to achieve functions such as real-time response, intelligent analysis, cross-architecture unified management and monitoring, thereby improving the efficiency and quality of data security management.

[0007] The second object of this application is to propose a data security management system based on a cross-architecture pipeline;

[0008] The third object of the present application is to provide an electronic device;

[0009] A fourth objective of the present application is to provide a computer-readable storage medium.

[0010] To achieve the above objectives, the first aspect of the present application is to propose a data security management method based on a cross-architecture pipeline, the method comprising the following steps:

[0011] Divide the data security management cycle of the target data to be managed into multiple monitoring sub-areas according to a preset time period, and collect multiple communication security management data of each monitoring sub-area based on a cross-architecture pipeline;

[0012] For each of the monitoring sub-areas, calculating a corresponding communication security management index according to each of the communication security management data;

[0013] Comparing each of the communication security management indexes of each of the monitoring sub-areas with the corresponding preset index, determining whether there is an abnormality according to the comparison result, and sending a risk handling signal to the user in the monitoring sub-area where the abnormality exists;

[0014] The communication security management efficiency coefficient of the data security management cycle is calculated based on all the communication security management indexes of each monitoring sub-area, and it is determined whether the communication security management efficiency coefficient is abnormal, and a warning signal is sent when the communication security management efficiency coefficient is abnormal.

[0015] Optionally, according to one embodiment of the present application, the multiple communication security management data include: security level data, malicious intrusion data and security audit data, and collecting the security level data of each of the monitoring sub-areas includes: collecting the data asset value, total data access traffic, traffic transmission rate and traffic transmission peak rate of each of the monitoring sub-areas; collecting the malicious intrusion data of each of the monitoring sub-areas includes: collecting the number of firewall alarms, the number of data access times during non-working time periods and the number of remote login failures of each of the monitoring sub-areas; collecting the security audit data of each of the monitoring sub-areas includes: collecting the number of vulnerabilities, vulnerability repair time, the amount of encrypted data and the amount of data to be encrypted of each of the monitoring sub-areas.

[0016] Optionally, according to one embodiment of the present application, the calculation of the corresponding communication security management index based on each type of communication security management data includes: calculating a data security level assessment index based on the security level data; calculating a malicious intrusion protection warning index based on the malicious intrusion data; and calculating a data security audit warning index based on the security audit data.

[0017] Optionally, according to one embodiment of the present application, the calculation of the data security level assessment index based on the security level data includes: calculating the difference between the traffic transmission peak rate and the traffic transmission rate, dividing the difference by the traffic transmission peak rate, and calculating the network abnormality risk; taking a natural constant as a base, calculating the exponent of the natural constant based on the network abnormality risk and the total amount of data access traffic to construct an exponential operation formula, and multiplying the data asset value by the exponential operation formula to obtain the data security level assessment index; calculating the malicious intrusion protection warning index based on the malicious intrusion data includes: performing an exponential operation based on the number of firewall alarms, the number of data accesses in the non-working time period, and the number of remote login failures to obtain the malicious intrusion protection warning index.

[0018] Optionally, according to one embodiment of the present application, calculating the data security audit warning index based on the security audit data includes: calculating the vulnerability management efficiency based on the number of vulnerabilities and the vulnerability repair time, and calculating the data encryption coverage based on the number of encrypted data and the number of data to be encrypted; calculating the sum of the vulnerability management efficiency and the data encryption coverage, and calculating the data security audit warning index based on the natural logarithm of the sum.

[0019] Optionally, according to one embodiment of the present application, each communication security management index of each monitoring sub-area is compared with the corresponding preset index, and whether there is an abnormality is determined based on the comparison result, including: when the data security level assessment index of any monitoring sub-area is less than the preset data security level assessment index, it is determined that there is an abnormality in the communication data security risk assessment of any monitoring sub-area; when the malicious intrusion protection warning index of any monitoring sub-area is greater than the preset malicious intrusion protection warning index, it is determined that there is a risk of malicious intrusion in the communication data of any monitoring sub-area; when the data security audit warning index of any monitoring sub-area is greater than the preset data security audit warning index, it is determined that there is a risk of leakage in the communication data of any monitoring sub-area.

[0020] Optionally, according to one embodiment of the present application, the calculation of the communication security management efficiency coefficient of the data security management cycle includes: for each of the monitoring sub-areas, calculating the sum of the malicious intrusion protection warning index and the data security audit warning index, and calculating the quotient of the data security level assessment index and the sum; calculating the cumulative sum of the quotient values ​​corresponding to all the monitoring sub-areas to obtain the communication security management efficiency coefficient; and judging whether the communication security management efficiency coefficient is abnormal includes: when the communication security management efficiency coefficient is less than a preset communication security management efficiency coefficient, judging that the communication security management efficiency coefficient is abnormal.

[0021] To achieve the above objectives, the second aspect of the present application also proposes a data security management system based on a cross-architecture pipeline, comprising the following modules:

[0022] A cross-architecture pipeline data partitioning module is used to divide the data security management cycle of the target data to be managed into multiple monitoring sub-areas according to a preset time period;

[0023] A cross-architecture pipeline data collection module, used for collecting a variety of communication security management data of each monitoring sub-area based on a cross-architecture pipeline;

[0024] A cross-architecture pipeline data processing module, configured to calculate, for each of the monitoring sub-areas, a corresponding communication security management index according to each of the communication security management data;

[0025] A cross-architecture pipeline data risk processing module, used to compare each of the communication security management indexes of each of the monitoring sub-areas with the corresponding preset index, determine whether there is an abnormality according to the comparison result, and send a risk processing signal to the user in the monitoring sub-area where the abnormality exists;

[0026] A cross-architecture pipeline data analysis module, used to calculate the communication security management efficiency coefficient of the data security management cycle according to all the communication security management indexes of each of the monitoring sub-areas;

[0027] The cross-architecture pipeline data evaluation module is used to determine whether the communication security management efficiency coefficient is abnormal, and send an early warning signal when the communication security management efficiency coefficient is abnormal.

[0028] To achieve the above-mentioned purpose, the third aspect of the present application further proposes an electronic device, comprising:

[0029] processor;

[0030] a memory for storing instructions executable by the processor;

[0031] The processor is configured to execute the instructions to implement a data security management method based on a cross-architecture pipeline as described in any one of the first aspects above.

[0032] To achieve the above-mentioned purpose, the fourth aspect of the present application also proposes a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, it implements the data security management method based on a cross-architecture pipeline as described in any one of the above-mentioned first aspects.

[0033] The technical solution provided by the embodiments of the present application brings at least the following beneficial effects: the present application improves the efficiency of data collection and data processing in the security management process based on the application of cross-architecture pipelines, and intelligently classifies and identifies data risk types, reduces the need for manual intervention, and reduces the cost in the data security management process. In addition, the communication security management efficiency coefficient calculated by the present application by integrating multiple evaluation indexes can more accurately reflect the overall communication security management efficiency status of the data security management cycle of the target data, and through a timely early warning mechanism, it helps to take measures quickly, thereby improving the ability to respond to data security risks. Therefore, the present application improves the efficiency of data collection and processing by applying a cross-architecture pipeline, and integrates multiple evaluation indicators to improve the comprehensiveness, intelligence and efficiency of data security management.

[0034] Additional aspects and advantages of the present invention will be given in part in the following description and in part will be obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0036] Figure 1 A flowchart of a data security management method based on a cross-architecture pipeline proposed in an embodiment of the present application;

[0037] Figure 2 A flowchart of a method for calculating a data security level evaluation index proposed in an embodiment of the present application;

[0038] Figure 3 A flowchart of a method for calculating a data security audit warning index proposed in an embodiment of the present application;

[0039] Figure 4 A schematic diagram of the structure of a data security management system based on a cross-architecture pipeline proposed in an embodiment of the present application;

[0040] Figure 5 A schematic diagram of the structure of an electronic device proposed in an embodiment of the present application. DETAILED DESCRIPTION

[0041] Embodiments of the present invention are described in detail below, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present invention, and should not be construed as limiting the present invention.

[0042] It should be noted that when data security management is performed in the relevant technology, the information security risk assessment system constructed generally includes a service unavailability risk assessment criteria generation module, a data security risk assessment criteria generation module, a service unavailability risk analysis and calculation module, a data security risk analysis module, a system risk analysis and calculation module, and an information system security module, etc. The system can analyze and calculate the security risks of the business network. When working, the system collects data from different sources in static storage processes and business use processes, extracts the main component information for later analysis, and mines the correlation between the data, thereby obtaining the data asset distribution location, data asset content, and data asset flow information required for data security situation calculation.

[0043] However, in actual applications, the data risk identification systems in the above-mentioned related technologies face the challenges of insufficient real-time and intelligence, which leads to inefficient data security management. Specifically, the system is often unable to respond to data risks through management terminals in real time, and lacks the ability to quickly identify, analyze and respond to data risks. In addition, these systems usually focus on security controls in a single architecture or a specific field, and lack the ability to uniformly manage and monitor cross-architecture data flows, which makes it difficult to uniformly implement security policies, increases potential protection vulnerabilities, and causes a delay in response speed when security incidents occur. Therefore, it is difficult to meet the requirements of efficiency and comprehensiveness of modern data security management.

[0044] To this end, this application proposes a data security management method based on a cross-architecture pipeline. The method can achieve functions such as real-time response, intelligent analysis, and cross-architecture unified management and monitoring, thereby improving the efficiency and quality of data security management.

[0045] It should also be noted that the data security management method based on the cross-architecture pipeline implemented in the present application is configured in the data security management system based on the cross-architecture pipeline proposed in the present application for illustration, that is, the execution subject of the data security management method of the present application can be the data security management system based on the cross-architecture pipeline proposed in the present application. And the data security management system based on the cross-architecture pipeline can be applied to any electronic device so that the electronic device can perform the function of data security management.

[0046] The electronic device may be any type of device with computing capabilities, such as a personal computer (PC) and various terminals, and the electronic device may support cross-architecture pipeline data processing procedures.

[0047] The following describes a data security management method, system and device based on a cross-architecture pipeline proposed in an embodiment of the present invention with reference to the accompanying drawings.

[0048] Figure 1 A flowchart of a data security management method based on a cross-architecture pipeline proposed in an embodiment of the present application, such as Figure 1 As shown, the method comprises the following steps:

[0049] Step S101: Divide the data security management cycle of the target data to be managed into multiple monitoring sub-areas according to a preset time period, and collect a variety of communication security management data of each monitoring sub-area based on a cross-architecture pipeline.

[0050] Among them, the cross-architecture pipeline is a processing flow that decomposes a complex processing process into multiple sub-processes, each of which is executed by a dedicated functional component. In the context of cross-architecture, this pipeline design can span different systems or hardware architectures to achieve more efficient and flexible processing. The cross-architecture pipeline can be applied to complex tasks that require a large amount of computing and storage resources, such as data processing and scientific computing.

[0051] By using a cross-architecture pipeline, the present application can decompose the data security management task into multiple stages and execute them in parallel on different hardware or system architectures, thereby improving the overall processing speed and efficiency. Among them, the present application performs data collection based on the cross-architecture pipeline, and also performs data calculation processing in subsequent steps based on the cross-architecture pipeline, such as the index calculation in the subsequent step S102 and the abnormality judgment in step S103.

[0052] Specifically, the present application first divides the data security management cycle of the target data to be managed through the cross-architecture pipeline data partitioning module, wherein the target data may be data in the business system of the target enterprise, that is, the data to be currently managed for data security. The division is performed according to the preset time period, and each time period corresponds to a monitoring sub-area, that is, one monitoring sub-area corresponds to one time period, and the length of each time period may be the same.

[0053] As a possible implementation method, the data security management cycle of the target enterprise is divided into monitoring sub-areas according to i time periods through the cross-architecture pipeline data partitioning module, and each monitoring sub-area of ​​the data security management cycle is numbered. The specific division method is: obtain the data security management cycle of the target enterprise, divide the monitoring sub-areas according to the division method of dividing the data security management cycle of the target enterprise into i time periods, and number each monitoring sub-area of ​​the data security management cycle of the target enterprise as 1, 2...i...n in sequence. Among them, the number of each monitoring sub-area corresponds to the time period, and n is the total number of monitoring sub-areas.

[0054] Furthermore, through the cross-architecture pipeline data collection module based on the cross-architecture pipeline, various communication security management data of each monitoring sub-area in the data security management cycle of the target enterprise are collected.

[0055] In one embodiment of the present application, multiple communication security management data include: security level data, malicious intrusion data and security audit data. In order to collect multiple types of communication security management data, the cross-architecture pipeline data acquisition module correspondingly includes a security level data acquisition unit, a malicious intrusion data acquisition unit and a security audit data acquisition unit. Each acquisition unit collects data of the corresponding type for each of the monitoring sub-areas.

[0056] Specifically, in this embodiment, the specific data collection method of the cross-architecture pipeline data collection module is described as follows.

[0057] First, the data asset value, total data access traffic, traffic transmission rate and traffic transmission peak rate of each monitoring sub-area in the target enterprise data security management cycle are collected through the security level data collection unit. Among them, the above four types of data collected are marked as ds i 、dz i 、dv i and df i , where i=1, 2, ..., n, and i represents the number of the i-th monitoring sub-area.

[0058] Secondly, the malicious intrusion data collection unit collects the number of firewall alarms, data access times during non-working hours, and remote login failures in each monitoring sub-area during the target enterprise data security management cycle. The three types of data collected are marked as eg i ew i and ed i , where i=1, 2, ..., n, and i represents the number of the i-th monitoring sub-area.

[0059] Furthermore, the number of vulnerabilities, vulnerability repair time, number of encrypted data, and number of data to be encrypted in each monitoring sub-area in the target enterprise data security management cycle are collected through the security audit data collection unit. Among them, the above four types of data collected are marked as hl i 、ht i 、hx i andhy i , where i=1, 2, ..., n, and i represents the number of the i-th monitoring sub-area.

[0060] Step S102: For each monitoring sub-area, a corresponding communication security management index is calculated according to each communication security management data.

[0061] Specifically, the cross-architecture pipeline data processing module receives multiple communication security management data transmitted by the cross-architecture pipeline data acquisition module in the previous step, and calculates the corresponding communication security management index of each monitoring sub-area according to each communication security management data received.

[0062] In one embodiment of the present application, a corresponding communication security management index is calculated based on each type of communication security management data, including: calculating a data security level assessment index based on security level data, calculating a malicious intrusion protection warning index based on malicious intrusion data, and calculating a data security audit warning index based on security audit data.

[0063] Specifically, according to the security level data collected by the security level data collection unit, the data security level assessment index of each monitoring sub-area of ​​the target enterprise data security management cycle is calculated; according to the malicious intrusion data collected by the malicious intrusion data collection unit, the malicious intrusion protection warning index of each monitoring sub-area of ​​the target enterprise data security management cycle is calculated; according to the security audit data collected by the security audit data collection unit, the data security audit warning index of each monitoring sub-area of ​​the target enterprise data security management cycle is calculated. The specific calculation method of each communication security management index will be explained later.

[0064] Step S103: Compare each communication security management index of each monitoring sub-area with the corresponding preset index, determine whether there is an abnormality based on the comparison result, and send a risk handling signal to the user in the monitoring sub-area where the abnormality exists.

[0065] Specifically, the cross-architecture pipeline data risk processing module is used to determine whether there is an abnormality in each communication security management index of each monitoring sub-area. If an abnormality is detected in a certain communication security management index of a monitoring sub-area, a corresponding risk processing signal is sent in the monitoring sub-area to eliminate the abnormality through relevant staff.

[0066] It can be understood that, as described above, since each monitoring sub-area in the present application represents a corresponding time period, in the present application, after an abnormality is found in each divided time period, a risk handling signal can be sent in time within the time period.

[0067] As a possible implementation method, the cross-architecture pipeline data risk processing module includes a security level risk processing unit, a malicious intrusion risk processing unit and a security audit risk processing unit. Among them, the security level risk processing unit compares the data security level assessment index of each monitoring sub-area in the target enterprise data security management cycle with the preset data security level assessment index, and sends a risk processing signal. The malicious intrusion risk processing unit compares the malicious intrusion protection warning index of each monitoring sub-area in the target enterprise data security management cycle with the preset malicious intrusion protection warning index, and sends a risk processing signal. The security audit risk processing unit compares the data security audit warning index of each monitoring sub-area in the target enterprise data security management cycle with the preset data security audit warning index, and sends a risk processing signal.

[0068] In specific implementation, in one embodiment of the present application, each of the communication security management indexes of each monitoring sub-area is compared with the corresponding preset index, and whether there is an abnormality is determined based on the comparison result, including: when the data security level assessment index of any monitoring sub-area is less than the preset data security level assessment index, it is determined that there is an abnormality in the communication data security risk assessment of any monitoring sub-area; when the malicious intrusion protection warning index of any monitoring sub-area is greater than the preset malicious intrusion protection warning index, it is determined that there is a risk of malicious intrusion in the communication data of any monitoring sub-area; when the data security audit warning index of any monitoring sub-area is greater than the preset data security audit warning index, it is determined that there is a risk of leakage in the communication data of any monitoring sub-area.

[0069] Specifically, in this embodiment, the security level risk processing unit is specifically used to compare the data security level assessment index of each monitoring sub-area of ​​the target enterprise's data security management cycle with the preset data security level assessment index. If the data security level assessment index of a certain time period is less than the preset data security level assessment index, it indicates that there is an abnormality in the communication data security risk assessment of the target enterprise in this time period, and the management personnel should be notified immediately for processing. Otherwise, it indicates that there is no abnormality in the communication data security risk assessment of the target enterprise in this time period;

[0070] The malicious intrusion risk processing unit is specifically used to compare the malicious intrusion protection warning index of each monitoring sub-area in the target enterprise's data security management cycle with the preset malicious intrusion protection warning index. If the malicious intrusion protection warning index of a certain time period is greater than the preset malicious intrusion protection warning index, it indicates that the communication data of the target enterprise in this time period has a malicious intrusion risk, and the management personnel should be notified immediately for processing. Otherwise, it indicates that there is no abnormal intrusion phenomenon in the communication data of the target enterprise in this time period;

[0071] The security audit risk processing unit is specifically used to compare the data security audit warning index of each monitoring sub-area of ​​the target enterprise's data security management cycle with the preset data security audit warning index. If the data security audit warning index of a certain time period is greater than the preset data security audit warning index, it indicates that the communication data of the target enterprise in this time period has a leakage risk, and the management personnel should be notified immediately for processing. Otherwise, it indicates that the communication data of the target enterprise in this time period has no abnormal characteristics.

[0072] Therefore, after discovering an anomaly in each time period, this application can promptly notify relevant personnel to eliminate the anomaly, respond to data risks accurately and quickly, and help take measures quickly through a timely early warning mechanism, thereby improving the timeliness of responding to data security risks.

[0073] Step S104: Calculate the communication security management efficiency coefficient of the data security management cycle based on all communication security management indexes of each monitoring sub-area, and determine whether the communication security management efficiency coefficient is abnormal, and send a warning signal when the communication security management efficiency coefficient is abnormal.

[0074] Specifically, the present application also receives the data transmitted by the cross-architecture pipeline data processing module through the cross-architecture pipeline data analysis module, and calculates the communication security management efficiency coefficient of the target enterprise data security management cycle based on the data security level evaluation index, malicious intrusion protection warning index and data security audit warning index of each monitoring sub-area of ​​the target enterprise data security management cycle. Therefore, the communication security management efficiency of the data security management cycle is evaluated as a whole based on the coefficient.

[0075] In one embodiment of the present application, the communication security management efficiency coefficient of the data security management cycle is calculated, including: for each of the monitoring sub-areas, calculating the sum of the malicious intrusion protection warning index and the data security audit warning index, and calculating the quotient of the data security level assessment index and the sum; calculating the cumulative sum of the quotient values ​​corresponding to all monitoring sub-areas to obtain the communication security management efficiency coefficient.

[0076] Specifically, in this embodiment, the calculation formula of the communication security management efficiency coefficient is as follows:

[0077]

[0078] Among them, θ represents the communication security management efficiency coefficient, α i represents the data security level evaluation index of the i-th monitoring sub-area, β i It is represented as the malicious intrusion protection warning index of the i-th monitoring sub-area, γ i It is represented as the safety audit warning index of the ith monitoring sub-area, and n is represented as the number of time period divisions.

[0079] Further, judging whether the calculated communication security management efficiency coefficient is abnormal includes: when the communication security management efficiency coefficient is less than a preset communication security management efficiency coefficient, judging that the communication security management efficiency coefficient is abnormal.

[0080] Specifically, in this embodiment, the communication security management efficiency coefficient of the target enterprise data security management cycle is calculated through the cross-architecture pipeline data evaluation module, and the coefficient is compared with the preset communication security management efficiency coefficient, and relevant processing is performed according to the comparison result.

[0081] Among them, the specific evaluation method of the cross-architecture pipeline data evaluation module is: obtain the communication security management efficiency coefficient of the target enterprise's data security management cycle, and compare it with the preset communication security management efficiency coefficient. If the communication security management efficiency coefficient of a data security management cycle of the target enterprise is less than the preset communication security management efficiency coefficient, it indicates that the communication security management efficiency of the data security management cycle is abnormal, and an early warning signal is sent to the management terminal. Otherwise, it indicates that there is no abnormality in the communication security management efficiency of the data security management cycle.

[0082] Therefore, this application also uses the communication security management efficiency coefficient calculated by integrating multiple evaluation indexes to more accurately reflect the overall communication security management efficiency of the target enterprise's data security management cycle, and issue an early warning when the overall communication security management efficiency is abnormal. This achieves unified management and monitoring of cross-architecture data flow, and based on the cross-architecture pipeline, security strategies can be uniformly implemented from various angles, such as adjusting and managing the computing resources allocated to different types of data from the overall perspective of data security management.

[0083] In summary, the data security management method based on the cross-architecture pipeline of the embodiment of the present application improves the efficiency of data collection and data processing in the security management process based on the application of the cross-architecture pipeline, and intelligently classifies and identifies data risk types, reduces the need for manual intervention, and reduces the cost in the data security management process. In addition, the method can more accurately reflect the overall communication security management efficiency status of the data security management cycle of the target data by calculating the communication security management efficiency coefficient by integrating multiple evaluation indexes, and helps to take measures quickly through a timely early warning mechanism, thereby improving the ability to respond to data security risks. Therefore, the method improves the efficiency of data collection and processing by applying a cross-architecture pipeline, and integrates multiple evaluation indicators to improve the comprehensiveness, intelligence and efficiency of data security management.

[0084] Based on the above embodiments, in order to more clearly illustrate the specific implementation process of calculating the corresponding communication security management index according to each communication security management data in the present application, the calculation method of the communication security management index in several specific embodiments of the present application is exemplified below.

[0085] Figure 2 A flowchart of a method for calculating a data security level evaluation index proposed in an embodiment of the present application is shown in FIG. Figure 2 As shown, the method comprises the following steps:

[0086] Step S201, calculate the difference between the traffic transmission peak rate and the traffic transmission rate, divide the difference by the traffic transmission peak rate, and calculate the network abnormality risk.

[0087] Specifically, first calculate the peak traffic transmission rate df i With the flow rate dv i The difference between the difference and the peak traffic transmission rate df i That is, substitute the traffic transmission rate and the traffic transmission peak rate into the following formula to calculate the network abnormality risk:

[0088]

[0089] Among them, vf i It is expressed as the network anomaly risk of the ith monitoring sub-area, df i It is represented as the peak rate of traffic transmission in the i-th monitoring sub-area, dv i It is represented as the traffic transmission rate of the i-th monitoring sub-area.

[0090] Step S202, taking the natural constant as the base, calculating the exponent of the natural constant based on the network anomaly risk and the total amount of data access traffic to construct an exponential operation formula, and multiplying the data asset value by the exponential operation formula to obtain a data security level assessment index.

[0091] Specifically, the natural constant e is used as the base number, and the network abnormality risk vf i And the total amount of data access traffic dz i After performing relevant operations, the numerical value is obtained as the index, so as to construct an index calculation formula, and then the data asset value ds i Multiply by the index calculation formula to calculate the data security level evaluation index. That is, the calculation formula of the data security level evaluation index is as follows:

[0092]

[0093] Among them, α i It is represented as the data security level evaluation index of the i-th monitoring sub-area, ds i is represented by the data asset value of the ith monitoring sub-area, VF0 is represented by the network abnormality risk threshold, and vf i It is represented as the network anomaly risk of the ith monitoring sub-area, DZ0 is represented as the total data access traffic threshold, and dz i It is represented as the total amount of data access traffic in the ith monitoring sub-area, and e is represented as a natural constant.

[0094] Therefore, for each monitoring sub-area, the respective security level data can be substituted into the relevant formula according to this method to calculate the data security level evaluation index of each monitoring sub-area.

[0095] In one embodiment of the present application, a malicious intrusion protection warning index is calculated based on malicious intrusion data, including: performing exponential calculations based on the number of firewall alarms, the number of data accesses during non-working hours, and the number of remote login failures to obtain a malicious intrusion protection warning index.

[0096] Specifically, in this embodiment, the number of firewall alarms, eg i , the number of data accesses during non-working hours ew i and the number of failed remote logins i Relevant operations are performed to calculate an index, and the natural constant is used as the base of the index, so as to construct an exponential operation formula to solve the malicious intrusion protection warning index.

[0097] As an example, the calculation formula of the malicious intrusion protection warning index is as follows:

[0098]

[0099] Among them, β i It is represented as the malicious intrusion protection warning index of the ith monitoring sub-area, e is represented as a natural constant, eg i It is represented by the number of firewall alarms in the i-th monitoring sub-area, EG 预 Indicates the preset number of firewall alarms, ew i It is represented by the number of data accesses during the non-working period of the i-th monitoring sub-area, EW 预 It represents the number of data accesses during the preset non-working period, ed i It is represented by the number of failed remote logins in the i-th monitoring sub-area, ED 预 Indicates the preset number of failed remote login attempts.

[0100] Therefore, for each monitoring sub-area, the malicious intrusion data can be substituted into the above formula according to this method to calculate the malicious intrusion protection warning index of each monitoring sub-area.

[0101] Figure 3 A flowchart of a method for calculating a data security audit warning index proposed in an embodiment of the present application is shown in FIG. Figure 3 As shown, the method comprises the following steps:

[0102] Step S301, calculating vulnerability management efficiency according to the number of vulnerabilities and vulnerability repair time.

[0103] Specifically, the number of vulnerabilities hl i and vulnerability repair timeht i Substitute the following formula to calculate the vulnerability management efficiency:

[0104]

[0105] Among them, lt i It is expressed as the vulnerability management efficiency of the i-th monitoring sub-area, hl i It is expressed as the number of vulnerabilities in the ith monitoring sub-area, ht i It is represented as the vulnerability repair time of the i-th monitoring sub-area, and μ1 is the influencing factor of vulnerability management efficiency.

[0106] Step S302, calculating the data encryption coverage rate according to the amount of encrypted data and the amount of data to be encrypted.

[0107] Specifically, the encrypted data quantity hx i and the amount of data to be encrypted i Substitute the following formula to calculate the data encryption coverage:

[0108]

[0109] Among them, xyi It is expressed as the data encryption coverage of the ith monitoring sub-area, hx i It is expressed as the number of encrypted data in the i-th monitoring sub-area, hy i It is represented as the amount of data to be encrypted in the i-th monitoring sub-area, and μ2 is the influencing factor of data encryption coverage.

[0110] Step S303, calculating the sum of the vulnerability management efficiency and the data encryption coverage, and calculating the data security audit warning index based on the natural logarithm of the sum.

[0111] Specifically, first calculate the vulnerability management efficiency lt obtained above i and data encryption coverage xy i The sum of the values ​​is then substituted into the natural logarithm function for operation, and then the data security audit warning index is calculated based on the operation result. That is, the calculation formula of the data security audit warning index is as follows:

[0112]

[0113] Among them, γ i It is expressed as the safety audit warning index of the ith monitoring sub-area, lt i It is expressed as the vulnerability management efficiency of the ith monitoring sub-area, xy i It is expressed as the data encryption coverage of the i-th monitoring sub-area.

[0114] Therefore, for each monitoring sub-area, the respective security audit data can be substituted into the above formulas according to this method to calculate the malicious intrusion protection warning index of each monitoring sub-area in turn.

[0115] In order to implement the above embodiment, the present application also proposes a data security management system based on a cross-architecture pipeline. Figure 4 This is a schematic diagram of the structure of a data security management system based on a cross-architecture pipeline proposed in an embodiment of the present application, such as Figure 4 As shown, the system includes a cross-architecture pipeline data partitioning module 100, a cross-architecture pipeline data acquisition module 200, a cross-architecture pipeline data processing module 300, a cross-architecture pipeline data risk processing module 400, a cross-architecture pipeline data analysis module 500 and a cross-architecture pipeline data evaluation module 600.

[0116] Among them, the cross-architecture pipeline data division module 100 is used to divide the data security management cycle of the target data to be managed into multiple monitoring sub-areas according to preset time periods.

[0117] The cross-architecture pipeline data collection module 200 is used to collect various communication security management data of each monitoring sub-area based on the cross-architecture pipeline.

[0118] The cross-architecture pipeline data processing module 300 is used to calculate the corresponding communication security management index for each monitoring sub-area according to each type of communication security management data.

[0119] The cross-architecture pipeline data risk processing module 400 is used to compare each communication security management index of each monitoring sub-area with the corresponding preset index, determine whether there is an abnormality based on the comparison result, and send a risk processing signal to the user in the monitoring sub-area where the abnormality exists.

[0120] The cross-architecture pipeline data analysis module 500 is used to calculate the communication security management efficiency coefficient of the data security management cycle based on all communication security management indexes of each monitoring sub-area.

[0121] The cross-architecture pipeline data evaluation module 600 is used to determine whether the communication security management efficiency coefficient is abnormal, and send a warning signal when the communication security management efficiency coefficient is abnormal.

[0122] In one embodiment of the present application, the cross-architecture pipeline data collection module 200 is specifically used to: collect the data asset value, total data access traffic, traffic transmission rate and traffic transmission peak rate of each monitoring sub-area; collect the number of firewall alarms, the number of data access times during non-working time periods and the number of remote login failures of each monitoring sub-area; collect the number of vulnerabilities, vulnerability repair time, number of encrypted data and number of data to be encrypted of each monitoring sub-area.

[0123] In one embodiment of the present application, the cross-architecture pipeline data processing module 300 is specifically used to: calculate a data security level assessment index based on security level data; calculate a malicious intrusion protection warning index based on malicious intrusion data; and calculate a data security audit warning index based on security audit data.

[0124] In one embodiment of the present application, the cross-architecture pipeline data processing module 300 is specifically used to: calculate the difference between the traffic transmission peak rate and the traffic transmission rate, divide the difference by the traffic transmission peak rate, and calculate the network anomaly risk; use the natural constant as the base, calculate the exponent of the natural constant based on the network anomaly risk and the total amount of data access traffic to construct an exponential operation formula, and multiply the data asset value by the exponential operation formula to obtain a data security level assessment index; perform exponential operations based on the number of firewall alarms, the number of data accesses during non-working hours, and the number of remote login failures to obtain a malicious intrusion protection warning index.

[0125] In one embodiment of the present application, the cross-architecture pipeline data processing module 300 is specifically used to: calculate the vulnerability management efficiency based on the number of vulnerabilities and the vulnerability repair time, and calculate the data encryption coverage based on the number of encrypted data and the number of data to be encrypted; calculate the sum of the vulnerability management efficiency and the data encryption coverage, and calculate the data security audit warning index based on the natural logarithm of the sum.

[0126] In one embodiment of the present application, the cross-architecture pipeline data risk processing module 400 is specifically used to: when the data security level assessment index of any monitoring sub-area is less than a preset data security level assessment index, determine that there is an abnormality in the communication data security risk assessment of any monitoring sub-area; when the malicious intrusion protection warning index of any monitoring sub-area is greater than the preset malicious intrusion protection warning index, determine that there is a malicious intrusion risk in the communication data of any monitoring sub-area; when the data security audit warning index of any monitoring sub-area is greater than the preset data security audit warning index, determine that there is a leakage risk in the communication data of any monitoring sub-area.

[0127] In one embodiment of the present application, the cross-architecture pipeline data analysis module 500 is specifically used to: for each monitoring sub-area, calculate the sum of the malicious intrusion protection warning index and the data security audit warning index, and calculate the quotient of the data security level assessment index and the sum; calculate the cumulative sum of the quotient values ​​corresponding to all monitoring sub-areas to obtain the communication security management efficiency coefficient; the cross-architecture pipeline data evaluation module 600 is specifically used to: when the communication security management efficiency coefficient is less than a preset communication security management efficiency coefficient, determine that the communication security management efficiency coefficient is abnormal.

[0128] It should be noted that the explanation of the embodiment of the data security management method based on the cross-architecture pipeline is also applicable to the system of this embodiment, and will not be repeated here.

[0129] In summary, the data security management system based on the cross-architecture pipeline of the embodiment of the present application improves the efficiency of data collection and data processing in the security management process based on the application of the cross-architecture pipeline, and intelligently classifies and identifies data risk types, reduces the need for manual intervention, and reduces the cost in the data security management process. In addition, the system can more accurately reflect the overall communication security management efficiency status of the data security management cycle of the target data by calculating the communication security management efficiency coefficient by integrating multiple evaluation indexes, and helps to take measures quickly through a timely early warning mechanism, thereby improving the ability to respond to data security risks. Therefore, the system improves the efficiency of data collection and processing by applying a cross-architecture pipeline, and integrates multiple evaluation indicators to improve the comprehensiveness, intelligence and efficiency of data security management.

[0130] In order to implement the above embodiments, the present application also proposes an electronic device, such as Figure 5 As shown, the electronic device 500 includes: a processor 510; a memory 520 for storing executable instructions of the processor 510; wherein the processor 510 is configured to execute instructions to implement a data security management method based on a cross-architecture pipeline as described in any one of the embodiments of the first aspect above.

[0131] In order to implement the above embodiments, the present application also proposes a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, it implements the data security management method based on a cross-architecture pipeline as described in any one of the above first aspect embodiments.

[0132] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.

[0133] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In the description of this application, the meaning of "plurality" is at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

[0134] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, fragment or portion of code comprising one or more executable instructions for implementing the steps of a custom logical function or process, and the scope of the preferred embodiments of the present application includes alternative implementations in which functions may not be performed in the order shown or discussed, including performing functions in a substantially simultaneous manner or in the reverse order depending on the functions involved, which should be understood by technicians in the technical field to which the embodiments of the present application belong.

[0135] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute the instructions), or in combination with these instruction execution systems, devices or apparatuses. For the purpose of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in combination with these instruction execution systems, devices or apparatuses. More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk box (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), a fiber optic device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium and then editing, interpreting or processing in other suitable ways if necessary, and then stored in a computer memory.

[0136] It should be understood that the various parts of the present application can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0137] A person skilled in the art may understand that all or part of the steps in the method for implementing the above-mentioned embodiment may be completed by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, which, when executed, includes one or a combination of the steps of the method embodiment.

[0138] In addition, each functional unit in each embodiment of the present application may be integrated into a processing module, or each unit may exist physically separately, or two or more units may be integrated into one module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium.

[0139] The storage medium mentioned above may be a read-only memory, a magnetic disk or an optical disk, etc. Although the embodiments of the present application have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limiting the present application. A person of ordinary skill in the art may change, modify, replace and modify the above embodiments within the scope of the present application.

Claims

1. A data security management method based on a cross-architecture pipeline, characterized in that: The following steps are involved: Divide the data security management cycle of the target data to be managed into multiple monitoring sub-areas according to a preset time period, and collect multiple communication security management data of each monitoring sub-area based on a cross-architecture pipeline; For each of the monitoring sub-areas, calculating a corresponding communication security management index according to each of the communication security management data; Comparing each of the communication security management indexes of each of the monitoring sub-areas with the corresponding preset index, determining whether there is an abnormality according to the comparison result, and sending a risk handling signal to the user in the monitoring sub-area where the abnormality exists; The communication security management efficiency coefficient of the data security management cycle is calculated based on all the communication security management indexes of each monitoring sub-area, and it is determined whether the communication security management efficiency coefficient is abnormal, and a warning signal is sent when the communication security management efficiency coefficient is abnormal.

2. The method according to claim 1, characterized in that The multiple communication security management data include: security level data, malicious intrusion data and security audit data. Collecting the security level data of each monitoring sub-area includes: collecting the data asset value, total data access traffic, traffic transmission rate and traffic transmission peak rate of each monitoring sub-area; Collecting the malicious intrusion data of each monitoring sub-area, including: collecting the number of firewall alarms, the number of data accesses during non-working hours, and the number of remote login failures of each monitoring sub-area; Collecting the security audit data of each monitoring sub-area includes: collecting the number of vulnerabilities, vulnerability repair time, the number of encrypted data, and the number of data to be encrypted in each monitoring sub-area.

3. The method according to claim 2, characterized in that The calculating a corresponding communication security management index according to each type of communication security management data includes: Calculate a data security level assessment index based on the security level data; Calculate a malicious intrusion protection warning index based on the malicious intrusion data; A data security audit early warning index is calculated based on the security audit data.

4. The method according to claim 3, characterized in that The calculating of the data security level evaluation index according to the security level data comprises: Calculating the difference between the traffic transmission peak rate and the traffic transmission rate, dividing the difference by the traffic transmission peak rate, and calculating the network abnormality risk; Taking the natural constant as the base, calculating the exponent of the natural constant based on the network abnormality risk and the total amount of data access traffic to construct an exponential operation formula, and multiplying the data asset value by the exponential operation formula to obtain the data security level assessment index; The calculating the malicious intrusion protection warning index according to the malicious intrusion data includes: The malicious intrusion protection warning index is obtained by performing exponential calculation based on the number of firewall alarms, the number of data accesses in the non-working time period, and the number of remote login failures.

5. The method according to claim 3, characterized in that: The calculating of the data security audit warning index according to the security audit data includes: Calculate vulnerability management efficiency based on the number of vulnerabilities and the vulnerability repair time, and calculate data encryption coverage based on the number of encrypted data and the number of data to be encrypted; The sum of the vulnerability management efficiency and the data encryption coverage is calculated, and the data security audit warning index is calculated based on the natural logarithm of the sum.

6. The method according to claim 3, characterized in that The step of comparing each of the communication security management indexes of each monitoring sub-area with a corresponding preset index, and determining whether there is an abnormality according to the comparison result, includes: When the data security level assessment index of any monitoring sub-area is less than a preset data security level assessment index, determining that there is an abnormality in the communication data security risk assessment of any monitoring sub-area; When the malicious intrusion protection warning index of any monitoring sub-area is greater than a preset malicious intrusion protection warning index, it is determined that the communication data of any monitoring sub-area has a malicious intrusion risk; When the data security audit warning index of any monitoring sub-area is greater than a preset data security audit warning index, it is determined that there is a risk of leakage of communication data in any monitoring sub-area.

7. The method according to claim 3, characterized in that The calculating the communication security management efficiency coefficient of the data security management cycle includes: For each of the monitoring sub-areas, the sum of the malicious intrusion protection warning index and the data security audit warning index is calculated, and the quotient of the data security level assessment index and the sum is calculated; Calculating the cumulative sum of the quotient values ​​corresponding to all the monitoring sub-areas to obtain the communication security management efficiency coefficient; The determining whether the communication security management efficiency coefficient is abnormal includes: When the communication security management efficiency coefficient is less than a preset communication security management efficiency coefficient, it is determined that the communication security management efficiency coefficient is abnormal.

8. A data security management system based on a cross-architecture pipeline, characterized in that: include: A cross-architecture pipeline data partitioning module is used to divide the data security management cycle of the target data to be managed into multiple monitoring sub-areas according to a preset time period; A cross-architecture pipeline data collection module, used for collecting a variety of communication security management data of each monitoring sub-area based on a cross-architecture pipeline; A cross-architecture pipeline data processing module, configured to calculate, for each of the monitoring sub-areas, a corresponding communication security management index according to each of the communication security management data; A cross-architecture pipeline data risk processing module, used to compare each of the communication security management indexes of each of the monitoring sub-areas with the corresponding preset index, determine whether there is an abnormality according to the comparison result, and send a risk processing signal to the user in the monitoring sub-area where the abnormality exists; A cross-architecture pipeline data analysis module, used to calculate the communication security management efficiency coefficient of the data security management cycle according to all the communication security management indexes of each of the monitoring sub-areas; The cross-architecture pipeline data evaluation module is used to determine whether the communication security management efficiency coefficient is abnormal, and send an early warning signal when the communication security management efficiency coefficient is abnormal.

9. An electronic device, comprising: processor; a memory for storing instructions executable by the processor; The processor is configured to execute the instructions to implement a data security management method based on a cross-architecture pipeline as described in any one of claims 1-7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the data security management method based on a cross-architecture pipeline as described in any one of claims 1 to 7 is implemented.

Images