Data protection evaluation system based on data acquisition

Abstract

The invention discloses a data protection evaluation system based on data acquisition. The system comprises a data transmission acquisition module, a data extraction acquisition module, a data protection test module, a hardware information acquisition module, a data processing module and an information sending module. The data transmission acquisition module is used for acquiring data transmission related information; the data extraction and acquisition module is used for acquiring data flow direction information after data extraction and identity verification information of a data extraction person; the data protection test module is used for performing protection test on the stored data to obtain protection test information; and the hardware information acquisition module is used for performing relevant information acquisition on data storage hardware to obtain relevant information of the data storage hardware. According to the invention, more comprehensive and more accurate data protection evaluation can be carried out.

Description

Technical Field

[0001] The present invention relates to the field of data security, and in particular to a data protection evaluation system based on data collection. Background Art

[0002] Data protection assessment is a systematic evaluation process that aims to comprehensively examine and analyze the effectiveness of an organization or enterprise's data protection capabilities, strategies and measures. This process not only concerns the security of the data itself, but also involves the protection of data throughout its life cycle, including generation, storage, processing, transmission and destruction;

[0003] During the data security assessment process, the data security assessment system will be used.

[0004] Most of the existing data security assessment systems only conduct security protection assessment on the data storage part. The scoring categories are single and the assessment results are highly biased, which has a certain impact on the use of the data security assessment system. Therefore, a data protection assessment system based on data collection is proposed. Summary of the invention

[0005] The technical problem to be solved by the present invention is: how to solve the problem that the existing data security assessment system only performs security protection assessment on the data storage part, has a single scoring category, and has large deviations in the assessment results, which has brought certain impacts on the use of the data security assessment system. A data protection assessment system based on data collection is provided.

[0006] The present invention solves the above technical problems through the following technical solutions, which include a data transmission acquisition module, a data extraction acquisition module, a data protection test module, a hardware information acquisition module, a data processing module and an information sending module;

[0007] The data transmission collection module is used to collect data transmission related information;

[0008] The data extraction and collection module is used to collect the data flow information after the data is extracted and the identity verification information of the data extractor;

[0009] The data protection test module is used to perform a protection test on the stored data and obtain protection test information;

[0010] The hardware information collection module is used to collect relevant information about the data storage hardware and obtain relevant information about the data storage hardware;

[0011] The data processing module is used to process the data transmission related information, data flow information, identity verification information of the data extractor, protection test information and data storage hardware related information to obtain transmission evaluation information, data call evaluation information, extractor evaluation information, data protection evaluation information and storage hardware evaluation information;

[0012] The information sending module is used to send the transmission evaluation information, data call evaluation information, extractor evaluation information, data protection evaluation information and storage hardware evaluation information to a preset receiving terminal after the above information is generated.

[0013] Furthermore, the transmission evaluation information includes a primary transmission evaluation, a secondary transmission evaluation, and a tertiary transmission evaluation;

[0014] The specific process of obtaining the transmission evaluation information is as follows: extracting the collected data transmission related information, the data transmission related information including transmission data encryption information, transmission data integrity and transmission data port information;

[0015] Conduct a simulated cracking test on the encrypted information of the transmitted data, record the cracking time, process the cracking time, and obtain the first transmission score;

[0016] Verify the integrity of the transmitted data and obtain a second transmission score;

[0017] Score the transmission data port information to obtain a third transmission score;

[0018] Processing the first transmission score, the second transmission score, and the third transmission score to obtain a comprehensive transmission score;

[0019] When the comprehensive transmission score is greater than the preset value a1, a first transmission evaluation is generated;

[0020] When the comprehensive transmission score is between the preset values ​​a1 and a2, a second transmission evaluation is generated;

[0021] When the comprehensive transmission score is less than the preset value a2, a third transmission evaluation is generated;

[0022] a1>a2.

[0023] Furthermore, the specific process of processing the cracking time to obtain the first transmission score is as follows: extracting the obtained cracking time, and when the cracking time is less than a preset value t1, generating a first transmission score, the first transmission score is a preset value b1;

[0024] When the cracking time is between the preset value t1 and t2, a first transmission score is generated, and the first transmission score is a preset value b2;

[0025] When the cracking time is greater than the preset value t2, a first transmission score is generated, and the first transmission score is a preset value b3;

[0026] b3>b2>b1, t2>t1;

[0027] The process of verifying the integrity of the transmitted data and obtaining the second transmission score is as follows: when the integrity of the transmitted data is less than a preset value f1, a second transmission score is generated, and the second transmission score is a preset value c1;

[0028] When the integrity of the transmitted data is between the preset values ​​f1 and f2, a second transmission score is generated, and the second transmission score is a preset value c2;

[0029] When the integrity of the transmitted data is greater than the preset value f2, a second transmission score is generated, and the second transmission score is a preset c3;

[0030] f1<f2,c1<c2<c3;

[0031] The specific process of scoring the transmission data port information and obtaining the third transmission score is as follows: extracting the transmission data port information, where the transmission data port information is to use a vulnerability detection tool to perform vulnerability detection on the transmission data port to obtain the number of vulnerabilities;

[0032] The transmission data port information is scored to obtain a third transmission score. When the transmission data port information is greater than a preset value e1, the third transmission score is a preset value d1.

[0033] When the transmission data port information is between the preset values ​​e1 and e2, the third transmission score is the preset value d2;

[0034] When the transmission data port information is less than the preset value e2, the third transmission score is the preset value d3;

[0035] d3>d2>d1, e1>e2.

[0036] Furthermore, the specific process of obtaining the comprehensive transmission score is as follows:

[0037] Extract the collected first transmission score, second transmission score, and third transmission score, and mark them as K1, K2, and K3;

[0038] Assign a correction value V1 to the first transmission score K1, a correction value V2 to the second transmission score K2, and a correction value V3 to the third transmission score K3, V1+V2+V3=1, V1>V2=V3;

[0039] The comprehensive transmission score Kk is obtained through the formula K1*V1+K2*V2+K3*V3=Kk.

[0040] Furthermore, the data call evaluation information includes normal data call and abnormal data call;

[0041] The data flow information includes the final receiving point of the retrieved data and the number of final receiving points;

[0042] Analyze the final receiving point of the retrieved data to extract the number of unauthorized receiving points;

[0043] The ratio of the number of unauthorized receiving points to the final number of receiving points is calculated to obtain an evaluation ratio. When the evaluation ratio is greater than or equal to a preset value, a data call exception is generated.

[0044] When the evaluation ratio is less than the preset value, the generated data call is normal.

[0045] Furthermore, the extracted person evaluation information includes extracting normal persons and extracting abnormal persons;

[0046] Extract the collected identity verification information of the data extractor, which includes the number of verifications of the data extractor and the time required for each verification to pass;

[0047] The number of verifications of the data extractor and the time required for each verification are calculated and processed to obtain the average verification time information. When the average verification time is greater than or equal to the preset value, an extractor exception is generated;

[0048] When the average verification time is less than the preset value, the generated extractor is normal.

[0049] Furthermore, the data protection evaluation information includes data protection abnormality and data protection normality, and the specific processing process of the data protection evaluation information is as follows:

[0050] Extract the collected protection test information, which includes the total number of tests and the number of protection test breaches;

[0051] Calculate the ratio between the number of defense test breaches and the total number of tests to obtain the defense test evaluation ratio;

[0052] When the protection test evaluation ratio is greater than or equal to the preset value, a data protection exception is generated;

[0053] When the protection test evaluation ratio is less than the preset value, a data protection exception is generated.

[0054] Furthermore, the stored hardware evaluation information includes normal hardware evaluation and abnormal hardware evaluation. The specific acquisition process of the stored hardware evaluation information is as follows:

[0055] Extract the collected data storage hardware related information, which includes the number of data storage write and read times, the temperature information of the data storage hardware, and the number of times data greater than a preset capacity is written to the data storage hardware within a preset time period;

[0056] Calculate the ratio of the real-time write and read times of the data storage hardware to the data storage write and read times to obtain the storage read-write evaluation ratio;

[0057] The temperature information of the data storage hardware is the duration during which the temperature of the data storage hardware is greater than a preset temperature within a preset time period;

[0058] When the storage read-write evaluation ratio is greater than a preset value, the temperature information of the data storage hardware is greater than a preset value, or the temperature information of the data storage hardware is greater than a preset value, a hardware evaluation exception is generated;

[0059] When the storage read-write evaluation ratio is less than a preset value, the temperature information of the data storage hardware is less than a preset value, or the temperature information of the data storage hardware is less than the preset value at the same time, the hardware evaluation is generated normally.

[0060] Compared with the prior art, the present invention has the following advantages: the data protection evaluation system based on data collection can understand the protection effect status of data transmission through the generated transmission evaluation information, and then make different security protection adjustments according to the actual data transmission security protection status; through the generated data call evaluation information, it can be understood whether the data is used illegally after the call; through the generated extractor evaluation information, it can be understood whether there is any abnormality in the data extractor, and then make corresponding data security protection adjustments or data extractor authority adjustments according to whether the data is used illegally and the status of the caller; through the data protection evaluation information, it can be understood whether the security measures for data security storage are in place; through the generated storage hardware evaluation information, it can be understood whether there is any impact on the data storage hardware, and then a more comprehensive understanding of whether the data security protection is in place and whether the security protection means need to be upgraded and adjusted, thereby achieving a more comprehensive data protection evaluation, obtaining evaluation results with higher accuracy and reliability, and making the system more worthy of popularization and use. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] Figure 1 It is a system block diagram of the present invention. DETAILED DESCRIPTION

[0062] The following is a detailed description of an embodiment of the present invention. This embodiment is implemented on the premise of the technical solution of the present invention, and a detailed implementation method and a specific operation process are given, but the protection scope of the present invention is not limited to the following embodiment.

[0063] like Figure 1As shown, this embodiment provides a technical solution: a data protection evaluation system based on data collection, including a data transmission collection module, a data extraction collection module, a data protection test module, a hardware information collection module, a data processing module and an information sending module;

[0064] The data transmission collection module is used to collect data transmission related information;

[0065] The data extraction and collection module is used to collect the data flow information after the data is extracted and the identity verification information of the data extractor;

[0066] The data protection test module is used to perform a protection test on the stored data and obtain protection test information;

[0067] The hardware information collection module is used to collect relevant information about the data storage hardware and obtain relevant information about the data storage hardware;

[0068] The data processing module is used to process the data transmission related information, data flow information, identity verification information of the data extractor, protection test information and data storage hardware related information to obtain transmission evaluation information, data call evaluation information, extractor evaluation information, data protection evaluation information and storage hardware evaluation information;

[0069] The information sending module is used to send the transmission evaluation information, data call evaluation information, extractor evaluation information, data protection evaluation information and storage hardware evaluation information to a preset receiving terminal after the above information is generated.

[0070] The transmission evaluation information includes a first-level transmission evaluation, a second-level transmission evaluation, and a third-level transmission evaluation;

[0071] The specific process of obtaining the transmission evaluation information is as follows: extracting the collected data transmission related information, the data transmission related information including transmission data encryption information, transmission data integrity and transmission data port information;

[0072] Conduct a simulated cracking test on the encrypted information of the transmitted data, record the cracking time, process the cracking time, and obtain the first transmission score;

[0073] Verify the integrity of the transmitted data and obtain a second transmission score;

[0074] Score the transmission data port information to obtain a third transmission score;

[0075] Processing the first transmission score, the second transmission score, and the third transmission score to obtain a comprehensive transmission score;

[0076] When the comprehensive transmission score is greater than the preset value a1, a first transmission evaluation is generated;

[0077] When the comprehensive transmission score is between the preset values ​​a1 and a2, a second transmission evaluation is generated;

[0078] When the comprehensive transmission score is less than the preset value a2, a third transmission evaluation is generated;

[0079] a1>a2;

[0080] The first transmission evaluation means that data transmission security protection is in place and continuous attention is needed to ensure the protection strength;

[0081] The second transmission evaluation indicates that there are certain problems with data transmission security protection, and some protection measures need to be adjusted;

[0082] The third transmission evaluation indicates that there are major problems with data transmission security protection, and overall protection measures need to be adjusted.

[0083] The specific process of processing the cracking time to obtain the first transmission score is as follows: extracting the obtained cracking time, and when the cracking time is less than the preset value t1, generating the first transmission score, the first transmission score is the preset value b1;

[0084] When the cracking time is between the preset value t1 and t2, a first transmission score is generated, and the first transmission score is a preset value b2;

[0085] When the cracking time is greater than the preset value t2, a first transmission score is generated, and the first transmission score is a preset value b3;

[0086] b3>b2>b1, t2>t1;

[0087] The process of verifying the integrity of the transmitted data and obtaining the second transmission score is as follows: when the integrity of the transmitted data is less than a preset value f1, a second transmission score is generated, and the second transmission score is a preset value c1;

[0088] When the integrity of the transmitted data is between the preset values ​​f1 and f2, a second transmission score is generated, and the second transmission score is a preset value c2;

[0089] When the integrity of the transmitted data is greater than the preset value f2, a second transmission score is generated, and the second transmission score is a preset c3;

[0090] f1<f2,c1<c2<c3;

[0091] The specific process of scoring the transmission data port information and obtaining the third transmission score is as follows: extracting the transmission data port information, where the transmission data port information is to use a vulnerability detection tool to perform vulnerability detection on the transmission data port to obtain the number of vulnerabilities;

[0092] The transmission data port information is scored to obtain a third transmission score. When the transmission data port information is greater than a preset value e1, the third transmission score is a preset value d1.

[0093] When the transmission data port information is between the preset values ​​e1 and e2, the third transmission score is the preset value d2;

[0094] When the transmission data port information is less than the preset value e2, the third transmission score is the preset value d3;

[0095] d3>d2>d1, e1>e2;

[0096] Through the above process, more accurate and objective evaluation scores of corresponding protection items can be obtained, and then it can be understood whether there are abnormalities in the corresponding evaluated protection items.

[0097] The specific process of obtaining the comprehensive transmission score is as follows:

[0098] Extract the collected first transmission score, second transmission score, and third transmission score, and mark them as K1, K2, and K3;

[0099] Assign a correction value V1 to the first transmission score K1, a correction value V2 to the second transmission score K2, and a correction value V3 to the third transmission score K3, V1+V2+V3=1, V1>V2=V3;

[0100] The comprehensive transmission score Kk is obtained through the formula K1*V1+K2*V2+K3*V3=Kk;

[0101] Through the above process, more accurate relevant scores can be obtained to ensure the accuracy of the final evaluation results.

[0102] The data call evaluation information includes normal data call and abnormal data call;

[0103] The data flow information includes the final receiving point of the retrieved data and the number of final receiving points;

[0104] Analyze the final receiving point of the retrieved data to extract the number of unauthorized receiving points;

[0105] The ratio of the number of unauthorized receiving points to the final number of receiving points is calculated to obtain an evaluation ratio. When the evaluation ratio is greater than or equal to a preset value, a data call exception is generated.

[0106] When the evaluation ratio is less than the preset value, the generated data call is normal;

[0107] Through the above process, we can ensure that the data is used properly. By verifying the purpose of data calls, we can avoid data abuse or abnormal dissemination, prevent data leakage, and clarify the purpose of data calls, which can reduce unnecessary data access and transmission, thereby reducing the risk of data leakage. When data is only called for clear purposes, it is easier to track and monitor the use of data, and timely discover and prevent potential data leakage.

[0108] The evaluation information of the extractor includes whether the extractor is normal or abnormal;

[0109] Extract the collected identity verification information of the data extractor, which includes the number of verifications of the data extractor and the time required for each verification to pass;

[0110] The number of verifications of the data extractor and the time required for each verification are calculated and processed to obtain the average verification time information. When the average verification time is greater than or equal to the preset value, an extractor exception is generated;

[0111] When the average verification time is less than the preset value, the generated extractor is normal;

[0112] The duration of user identity authentication may be that when someone else steals the user's identity information for identity authentication, it may take a longer time for them to import the identity information because they are not familiar with it. Therefore, this item can be used to determine the status of the data extractor. Even if the data has not been stolen, the data extractor is not familiar with his or her identity information, which may lead to a decrease in the data security protection effect.

[0113] The data protection evaluation information includes data protection abnormality and data protection normality. The specific processing process of the data protection evaluation information is as follows:

[0114] Extract the collected protection test information, which includes the total number of tests and the number of protection test breaches;

[0115] Calculate the ratio between the number of defense test breaches and the total number of tests to obtain the defense test evaluation ratio;

[0116] When the protection test evaluation ratio is greater than or equal to the preset value, a data protection exception is generated;

[0117] When the protection test evaluation ratio is less than the preset value, a data protection exception is generated;

[0118] Through the above process, simulation testing of data security protection functions can improve data security and timely discover potential vulnerabilities. Simulation testing can simulate various attack scenarios to help organizations discover potential vulnerabilities and weaknesses in their data protection systems. These vulnerabilities may be difficult to detect in daily operations, but once exploited by attackers, they may cause serious data leakage or damage, which can verify the effectiveness of protection measures. Through simulation testing, organizations can verify whether their existing data protection measures are effective. This includes whether security measures such as firewalls, intrusion detection systems, and data encryption can play a role in actual attacks, so as to promptly repair or adjust deficiencies.

[0119] It can also optimize the protection strategy and provide improvement suggestions: The results of the simulation test can provide valuable improvement suggestions for the organization. Based on the test results, the organization can evaluate the rationality and effectiveness of its protection strategy and formulate a more scientific and reasonable protection strategy accordingly.

[0120] The stored hardware evaluation information includes normal hardware evaluation and abnormal hardware evaluation. The specific acquisition process of the stored hardware evaluation information is as follows:

[0121] Extract the collected data storage hardware related information, which includes the number of data storage write and read times, the temperature information of the data storage hardware, and the number of times data greater than a preset capacity is written to the data storage hardware within a preset time period;

[0122] Calculate the ratio of the real-time write and read times of the data storage hardware to the data storage write and read times to obtain the storage read-write evaluation ratio;

[0123] The temperature information of the data storage hardware is the duration during which the temperature of the data storage hardware is greater than a preset temperature within a preset time period;

[0124] When the storage read-write evaluation ratio is greater than a preset value, the temperature information of the data storage hardware is greater than a preset value, or the temperature information of the data storage hardware is greater than a preset value, a hardware evaluation exception is generated;

[0125] When the storage read-write evaluation ratio is less than the preset value, the temperature information of the data storage hardware is less than the preset value, or the temperature information of the data storage hardware is less than the preset value at the same time, the hardware evaluation is generated to be normal;

[0126] Through the above process, the status of the data storage hardware is evaluated, and the hard disk usage strategy can be adjusted according to the evaluation results of the read and write times. For example, for data that is frequently read and written, you can consider using a faster and more durable hard disk; for data that is not frequently accessed, you can use a lower-cost storage solution.

[0127] Hard disks running in high temperature environments are prone to data damage or loss. By evaluating the temperature information of hard disks, overheating problems can be discovered and handled in a timely manner to ensure the security and integrity of data.

[0128] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In the description of the present invention, the meaning of "plurality" is at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

[0129] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.

[0130] Although the embodiments of the present invention have been shown and described above, it is to be understood that the above embodiments are exemplary and are not to be construed as limitations of the present invention. A person skilled in the art may change, modify, replace and vary the above embodiments within the scope of the present invention.

Claims

1. A data protection evaluation system based on data collection, characterized in that: It includes data transmission and collection module, data extraction and collection module, data protection test module, hardware information collection module, data processing module and information sending module; The data transmission collection module is used to collect data transmission related information; The data extraction and collection module is used to collect the data flow information after the data is extracted and the identity verification information of the data extractor; The data protection test module is used to perform a protection test on the stored data and obtain protection test information; The hardware information collection module is used to collect relevant information about the data storage hardware and obtain relevant information about the data storage hardware; The data processing module is used to process the data transmission related information, data flow information, identity verification information of the data extractor, protection test information and data storage hardware related information to obtain transmission evaluation information, data call evaluation information, extractor evaluation information, data protection evaluation information and storage hardware evaluation information; The information sending module is used to send the transmission evaluation information, data call evaluation information, extractor evaluation information, data protection evaluation information and storage hardware evaluation information to a preset receiving terminal after the above information is generated.

2. According to claim 1, a data protection evaluation system based on data collection is characterized in that: The transmission evaluation information includes a first-level transmission evaluation, a second-level transmission evaluation, and a third-level transmission evaluation; The specific process of obtaining the transmission evaluation information is as follows: extracting the collected data transmission related information, the data transmission related information including transmission data encryption information, transmission data integrity and transmission data port information; Conduct a simulated cracking test on the encrypted information of the transmitted data, record the cracking time, process the cracking time, and obtain the first transmission score; Verify the integrity of the transmitted data and obtain a second transmission score; Score the transmission data port information to obtain a third transmission score; Processing the first transmission score, the second transmission score, and the third transmission score to obtain a comprehensive transmission score; When the comprehensive transmission score is greater than the preset value a1, a first transmission evaluation is generated; When the comprehensive transmission score is between the preset values ​​a1 and a2, a second transmission evaluation is generated; When the comprehensive transmission score is less than the preset value a2, a third transmission evaluation is generated; a1>a2.

3. The data protection evaluation system based on data collection according to claim 2 is characterized in that: The specific process of processing the cracking time to obtain the first transmission score is as follows: extracting the obtained cracking time, and when the cracking time is less than the preset value t1, generating the first transmission score, the first transmission score is the preset value b1; When the cracking time is between the preset value t1 and t2, a first transmission score is generated, and the first transmission score is a preset value b2; When the cracking time is greater than the preset value t2, a first transmission score is generated, and the first transmission score is a preset value b3; b3>b2>b1, t2>t1; The process of verifying the integrity of the transmitted data and obtaining the second transmission score is as follows: when the integrity of the transmitted data is less than a preset value f1, a second transmission score is generated, and the second transmission score is a preset value c1; When the integrity of the transmitted data is between the preset values ​​f1 and f2, a second transmission score is generated, and the second transmission score is a preset value c2; When the integrity of the transmitted data is greater than the preset value f2, a second transmission score is generated, and the second transmission score is a preset c3; f1<f2,c1<c2<c3; The specific process of scoring the transmission data port information and obtaining the third transmission score is as follows: extracting the transmission data port information, where the transmission data port information is to use a vulnerability detection tool to perform vulnerability detection on the transmission data port to obtain the number of vulnerabilities; The transmission data port information is scored to obtain a third transmission score. When the transmission data port information is greater than a preset value e1, the third transmission score is a preset value d1. When the transmission data port information is between the preset values ​​e1 and e2, the third transmission score is the preset value d2; When the transmission data port information is less than the preset value e2, the third transmission score is the preset value d3; d3>d2>d1, e1>e2.

4. The data protection evaluation system based on data collection according to claim 2 is characterized in that: The specific process of obtaining the comprehensive transmission score is as follows: Extract the collected first transmission score, second transmission score, and third transmission score, and mark them as K1, K2, and K3; Assign a correction value V1 to the first transmission score K1, a correction value V2 to the second transmission score K2, and a correction value V3 to the third transmission score K3, V1+V2+V3=1, V1>V2=V3; The comprehensive transmission score Kk is obtained through the formula K1*V1+K2*V2+K3*V3=Kk.

5. The data protection evaluation system based on data collection according to claim 1 is characterized in that: The data call evaluation information includes normal data call and abnormal data call; The data flow information includes the final receiving point of the retrieved data and the number of final receiving points; Analyze the final receiving point of the retrieved data to extract the number of unauthorized receiving points; The ratio of the number of unauthorized receiving points to the final number of receiving points is calculated to obtain an evaluation ratio. When the evaluation ratio is greater than or equal to a preset value, a data call exception is generated. When the evaluation ratio is less than the preset value, the generated data call is normal.

6. The data protection evaluation system based on data collection according to claim 1 is characterized in that: The evaluation information of the extractor includes whether the extractor is normal or abnormal; Extract the collected identity verification information of the data extractor, which includes the number of verifications of the data extractor and the time required for each verification to pass; The number of verifications of the data extractor and the time required for each verification are calculated and processed to obtain the average verification time information. When the average verification time is greater than or equal to the preset value, an extractor exception is generated; When the average verification time is less than the preset value, the generated extractor is normal.

7. The data protection evaluation system based on data collection according to claim 1 is characterized in that: The data protection evaluation information includes data protection abnormality and data protection normality. The specific processing process of the data protection evaluation information is as follows: Extract the collected protection test information, which includes the total number of tests and the number of protection test breaches; Calculate the ratio between the number of defense test breaches and the total number of tests to obtain the defense test evaluation ratio; When the protection test evaluation ratio is greater than or equal to the preset value, a data protection exception is generated; When the protection test evaluation ratio is less than the preset value, a data protection exception is generated.

8. The data protection evaluation system based on data collection according to claim 1 is characterized in that: The stored hardware evaluation information includes normal hardware evaluation and abnormal hardware evaluation. The specific acquisition process of the stored hardware evaluation information is as follows: Extract the collected data storage hardware related information, which includes the number of data storage write and read times, the temperature information of the data storage hardware, and the number of times data greater than a preset capacity is written to the data storage hardware within a preset time period; Calculate the ratio of the real-time write and read times of the data storage hardware to the data storage write and read times to obtain the storage read-write evaluation ratio; The temperature information of the data storage hardware is the duration during which the temperature of the data storage hardware is greater than a preset temperature within a preset time period; When the storage read-write evaluation ratio is greater than a preset value, the temperature information of the data storage hardware is greater than a preset value, or the temperature information of the data storage hardware is greater than a preset value, a hardware evaluation exception is generated; When the storage read-write evaluation ratio is less than a preset value, the temperature information of the data storage hardware is less than a preset value, or the temperature information of the data storage hardware is less than the preset value at the same time, the hardware evaluation is generated normally.

Images