Detection method, device and equipment and readable storage medium

Abstract

The invention discloses a detection method, device and equipment and a readable storage medium in the technical field of security, and the method comprises the steps: obtaining a secret evaluation report, and extracting a password application index from the secret evaluation report; establishing a compliance baseline of the password application of the information system by using the password application index; acquiring a password application log in real time, and extracting password application data from the password application log; and comparing the password application data with the compliance baseline to obtain a password compliance detection result. The method has the technical effects that when the password infrastructure does not provide an effective password guarantee, the effective password guarantee can be found in time through detection, so that the security of an information system can be effectively improved, secret loss and leakage events are avoided, and the possibility of major safety accidents is reduced.

Description

Technical Field

[0001] The present application relates to the field of security technology, and in particular to a detection method, device, equipment and readable storage medium. Background Art

[0002] Generally speaking, if the password application in the information system is compliant, the data security can be effectively protected. However, the actual situation is that the password application in the information system may not be compliant. In order to effectively protect the security of data, it is necessary to test the compliance of the password application.

[0003] At present, commercial cryptographic application security assessments can be carried out regularly to assess the compliance of information system cryptographic application. However, this method can only assess the compliance status of the system's cryptographic application at the time, and cannot guarantee whether the information system is strictly in accordance with the cryptographic application plan during operation. Once the cryptographic infrastructure does not provide effective cryptographic protection, the information system will face huge security risks, and leakage incidents may occur at any time, causing major security accidents.

[0004] To sum up, how to effectively solve problems such as password compliance detection is a technical problem that technical personnel in this field urgently need to solve. Summary of the invention

[0005] The purpose of this application is to provide a detection method, device, equipment and readable storage medium that can perform real-time password compliance detection and promptly discover whether the information system strictly implements the password application plan during operation.

[0006] In order to solve the above technical problems, this application provides the following technical solutions:

[0007] A detection method comprising:

[0008] Obtaining a cryptographic review report, and extracting cryptographic application indicators from the cryptographic review report;

[0009] Using the cryptographic application indicators, establish a compliance baseline for cryptographic application in information systems;

[0010] Acquire password application logs in real time, and extract password application data from the password application logs;

[0011] The password application data is compared with the compliance baseline to obtain a password compliance detection result.

[0012] Preferably, the cryptographic application indicators extracted from the cryptographic review report include:

[0013] According to the commercial cryptographic application security assessment report template, interpret the report outline and obtain the document location characteristics of the key information data of the information system cryptographic application;

[0014] Defining report parsing and data extraction rules using the document location features;

[0015] Extracting data on the use of cryptographic products, the use of cryptographic algorithms, applicable evaluation indicators and compliance status from the cryptographic review report according to the report analysis and the data extraction rules;

[0016] The use of the cryptographic product, the use of the cryptographic algorithm, the applicable evaluation indicators and the compliance data are determined as cryptographic application indicators.

[0017] Preferably, the cryptographic application indicators are used to establish a compliance baseline for information system cryptographic application, including:

[0018] The compliance baseline is established by correlating and fusing data of the cryptographic application indicators.

[0019] Preferably, obtaining password application logs in real time includes:

[0020] By connecting to the password resource pool, the information system password service call logs are collected in real time.

[0021] Preferably, extracting the password application data from the password application log includes:

[0022] Extracting target data from the password application log; the target data is a normal call log of the password service screened by the information system IP address;

[0023] A data cleaning operation is performed on the target data to obtain the cryptographic application data.

[0024] Preferably, comparing the password application data with the compliance baseline to obtain a password compliance detection result includes:

[0025] Performing an index comparison between the cryptographic application data and the compliance baseline to obtain an index comparison result; the index comparison result includes a compliant item set and a non-compliant item set;

[0026] Statistics are collected on the conforming item set and the non-conforming item set to obtain the password compliance detection result.

[0027] Preferably, it also includes:

[0028] Visually output the password compliance detection result;

[0029] For the non-compliant items in the non-compliant item set, risk warnings are issued according to the risk levels.

[0030] A detection device, comprising:

[0031] An indicator acquisition unit, used to acquire a cryptographic review report and extract cryptographic application indicators from the cryptographic review report;

[0032] A baseline establishing unit, used to establish a compliance baseline for information system cryptographic application using the cryptographic application indicator;

[0033] A data acquisition unit, used to acquire a password application log in real time and extract password application data from the password application log;

[0034] The compliance comparison unit is used to compare the password application data with the compliance baseline to obtain a password compliance detection result.

[0035] An electronic device, comprising:

[0036] Memory for storing computer programs;

[0037] A processor is used to implement the steps of the above detection method when executing the computer program.

[0038] A readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the above detection method are implemented.

[0039] Apply the method provided in the embodiment of the present application to obtain a cryptographic review report, extract cryptographic application indicators from the cryptographic review report; use the cryptographic application indicators to establish a compliance baseline for cryptographic application in the information system; obtain cryptographic application logs in real time, and extract cryptographic application data from the cryptographic application logs; compare the cryptographic application data with the compliance baseline to obtain a cryptographic compliance test result.

[0040] In order to conduct real-time password compliance inspection, it is necessary to extract password application indicators from the password review report, and then establish the compliance baseline of the information system password application based on the password application indicators. In this way, the password application log can be obtained in real time, and the password application data can be extracted from the password application log. By comparing the password application data and the compliance baseline, the password compliance test result can be obtained. Since the compliance baseline is established based on the password review report, and the password application data is extracted from the password application log obtained in real time, the password compliance test result can indicate whether the information system password application strictly implements the password application plan during operation.

[0041] Technical effect: When the cryptographic infrastructure fails to provide effective cryptographic protection, it can be discovered in a timely manner through detection, which can effectively improve the security of the information system, avoid information leakage incidents, and reduce the possibility of major security accidents.

[0042] Correspondingly, the embodiments of the present application also provide detection devices, equipment and readable storage media corresponding to the above-mentioned detection method, which have the above-mentioned technical effects and are not repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the drawings required for use in the embodiments or the related technical descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0044] FIG1 is a flow chart of an implementation of a detection method in an embodiment of the present application;

[0045] FIG2 is a schematic diagram of an implementation structure of a detection method in an embodiment of the present application;

[0046] FIG3 is a specific implementation flow chart of a detection method in an embodiment of the present application;

[0047] FIG4 is a schematic diagram of the structure of a detection device in an embodiment of the present application;

[0048] FIG5 is a schematic diagram of the structure of an electronic device in an embodiment of the present application;

[0049] FIG. 6 is a schematic diagram of a specific structure of an electronic device in an embodiment of the present application. DETAILED DESCRIPTION

[0050] In order to enable those skilled in the art to better understand the present application, the present application is further described in detail below in conjunction with the accompanying drawings and specific implementation methods. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application.

[0051] Referring to Figures 1 and 2, the method includes the following steps:

[0052] S101. Obtain a cryptographic review report, and extract cryptographic application indicators from the cryptographic review report.

[0053] Among them, the secret review report is the cryptographic evaluation report. The full name of the secret review report is the commercial cryptographic application security assessment report. It is a professional evaluation report issued by the secret review agency after evaluating the security of commercial cryptographic application in the information system in accordance with the "GB-T 39786-2021 Information Security Technology Basic Requirements for Cryptographic Application of Information Systems".

[0054] There are standardized cryptographic application indicators in the cryptographic review report, so the cryptographic application indicators can be extracted from the cryptographic review report. The cryptographic application indicators can specifically include data such as the use of cryptographic products, the use of cryptographic algorithms, applicable policy indicators and their compliance.

[0055] In one embodiment of the present application, cryptographic application indicators are extracted from the cryptographic review report, including:

[0056] Step 1: According to the commercial cryptographic application security assessment report template, interpret the report outline and obtain the document location characteristics of the key information data of the information system cryptographic application;

[0057] Step 2: Define report parsing and data extraction rules using document location features;

[0058] Step 3: Extract the data on the use of cryptographic products, the use of cryptographic algorithms, applicable evaluation indicators and compliance status from the cryptographic review report according to the report parsing and data extraction rules;

[0059] Step 4: Determine the use of cryptographic products, use of cryptographic algorithms, applicable evaluation indicators and compliance data as cryptographic application indicators.

[0060] For ease of description, the above four steps are combined for explanation below.

[0061] Among them, the cryptographic review report is a standard template, which describes what cryptographic algorithms, cryptographic protocols, cryptographic products, cryptographic services and other information are used by the information system in which application scenarios. The extraction rules are to extract the specific cryptographic algorithms, cryptographic protocols, cryptographic products and cryptographic services used by the information system according to the standard template.

[0062] Among them, the compliance data can refer to 41 system evaluation indicators above level 3 of cryptographic evaluation based on the basic requirements and evaluation requirements of 39786 cryptographic applications. The cryptographic evaluation report describes whether the information system meets each indicator and whether it meets the requirements of each indicator.

[0063] Specifically, according to the published "Commercial Cryptography Application Security Assessment Report Template", the report outline can be deeply interpreted, the document location characteristics of key information data of information system cryptography applications can be summarized, and report parsing and data extraction rules can be defined. Then, the latest cryptographic evaluation report of the information system can be obtained, and according to the defined report parsing and data extraction rules, the data on the use of cryptographic products, the use of cryptographic algorithms, applicable evaluation indicators and their compliance in the cryptographic evaluation report can be parsed and extracted, and the extracted data can be used as cryptographic application indicators.

[0064] S102. Use cryptographic application indicators to establish a compliance baseline for cryptographic application in information systems.

[0065] After obtaining the password application indicators, a compliance baseline for information system passwords can be established.

[0066] Each information system has only one compliance baseline, which includes multiple indicators, such as cryptographic algorithms (SM2, SM4), cryptographic protocols (HTTPS), cryptographic services (signature verification services, timestamp services), and cryptographic products (server cryptographic machines, key management systems).

[0067] In one embodiment of the present application, the cryptographic application indicators are used to establish a compliance baseline for the cryptographic application of the information system, including: establishing a compliance baseline by associating and integrating the cryptographic application indicators. Specifically, the various data parsed and extracted can be structured and converted, stored in a database, and then associated with the information system to which it belongs, and for each information system, a cryptographic application compliance baseline belonging to it is established.

[0068] That is, an information system has a compliance baseline for cryptographic applications, which is composed of multiple indicators. For example, the cryptographic application compliance baseline of system A is: {cryptographic algorithms: SM2, SM4, SM3, RSA; cryptographic products: detection server cryptographic machine; cryptographic protocols: HTTPS, SSH; cryptographic services: encryption and decryption services, key management services}.

[0069] For example: You can locate the "Basic Information Table of the Information System Under Test" and "Cryptographic Product Table" in the document in the cryptographic evaluation report, extract the cryptographic products used by the system, the data of the cryptographic algorithm fields used by the system, and the cryptographic product usage list in the table, and obtain the basic information on the use of the information system's cryptographic algorithms, cryptographic products, and cryptographic services. At the same time, you can associate basic data such as the commercial cryptographic product certification list to obtain detailed information such as the national cryptographic certification status of cryptographic products and the purpose of cryptographic products. This will serve as one of the baselines for whether the information system meets the general requirements of GB / T 39786 "Basic Requirements for Cryptographic Application of Information Systems in Information Security Technology" and the compliance of the cryptographic algorithms used, the cryptographic products used, and the cryptographic services used.

[0070] S103: Acquire the password application log in real time, and extract the password application data from the password application log.

[0071] In order to detect whether the information system complies with the regulations in the use of password application in real time, the password application log can be obtained in real time to obtain the password application data. Further, by executing step S104, the real-time detection can be realized.

[0072] Extracting the password application data may specifically include analyzing the password application log to extract valid password application data. The extraction process may be a data screening process, for example, screening conditions may be set to select relevant data from the password application log.

[0073] In one embodiment of the present application, real-time acquisition of cryptographic application logs includes: by connecting with the cryptographic resource pool, real-time collection of information system cryptographic service call logs. That is, by connecting with the cryptographic resource pool, real-time collection of information system cryptographic service call logs is performed to form a cryptographic application data resource pool as a basis for baseline comparison and compliance risk identification. For specific methods of connecting with the cryptographic resource pool, reference can be made to relevant implementation schemes, which will not be described in detail here.

[0074] In one embodiment of the present application, extracting cryptographic application data from a cryptographic application log includes:

[0075] Step 1: Extract target data from the password application log; the target data is the normal call log of the password service filtered out by the information system IP address;

[0076] Step 2: Perform data cleaning operations on the target data to obtain password application data.

[0077] For ease of description, the above two steps are combined for explanation below.

[0078] The target data is to filter out the normal call logs of all types of password services of a certain information through the information system IP address; invalid data refers to log data such as call failure and call timeout.

[0079] Since the call log data formats of different cryptographic vendors are different, some lack information such as IP address, call service type, call failure reason, etc., and need to be completed.

[0080] Formatting refers to the unified processing of the call time format and the unified processing of the call IP address format. For example, some systems use the timestamp format for the call time, while others use the date format. They are all converted into the detection format of x year xx month xx day xx hour xx minute xx second.

[0081] In other words, the collected password service call logs are filtered out according to conditions to obtain target data, and data cleaning steps such as invalid data deletion, field completion, and format standardization are performed to form a basic data source in preparation for compliance comparison calculations.

[0082] S104. Compare the cryptographic application data with the compliance baseline to obtain the cryptographic compliance test result.

[0083] As can be seen from the above, the compliance baseline contains compliance information of several indicators. Therefore, by comparing the password application data with the compliance baseline, the password compliance detection results can be obtained.

[0084] In one embodiment of the present application, the password application data is compared with the compliance baseline to obtain the password compliance detection result, including:

[0085] Step 1: Compare the cryptographic application data with the compliance baseline to obtain the indicator comparison results; the indicator comparison results include a compliant item set and a non-compliant item set;

[0086] Step 2: Count the compliant item sets and non-compliant item sets to obtain the password compliance test results.

[0087] For ease of description, the above two steps are combined for explanation below.

[0088] Compare the cryptographic application data in a standard format with the compliance baseline of the information system cryptographic application, analyze the compliance of indicators at each level of the basic requirements for cryptographic application, and divide the compared indicator results into compliant item sets and non-compliant item sets.

[0089] Then, statistics are collected on the compliant item sets and the non-compliant item sets to obtain the password compliance test results. The password compliance test results can be specific conclusions on compliance or non-compliance of each item, or comparisons, or statistical information, such as the proportion of non-compliant items.

[0090] For example: Analyze the cleaned cryptographic service call log data, aggregate the cryptographic product usage list, algorithm call list and usage scenarios from the dimension of cryptographic devices associated with the cryptographic service, compare them one by one with the established cryptographic product usage baseline, and judge whether the use of cryptographic products during the operation of the information system is consistent with what is listed in the cryptographic evaluation report from the dimensions of whether the cryptographic products are consistent, whether the algorithms are consistent, and whether the purposes are consistent.

[0091] Apply the method provided in the embodiment of the present application to obtain a cryptographic review report, extract cryptographic application indicators from the cryptographic review report; use the cryptographic application indicators to establish a compliance baseline for cryptographic application in the information system; obtain cryptographic application logs in real time, and extract cryptographic application data from the cryptographic application logs; compare the cryptographic application data with the compliance baseline to obtain a cryptographic compliance test result.

[0092] In order to conduct real-time password compliance inspection, it is necessary to extract password application indicators from the password review report, and then establish a compliance baseline for the password application of the information system based on the password application indicators. In this way, the password application log can be obtained in real time, and the password application data can be extracted from the password application log. By comparing the password application data and the compliance baseline, the password compliance test results can be obtained. Since the compliance baseline is established based on the password review report, and the password application data is extracted from the password application log obtained in real time, the password compliance test results can indicate whether the information system password application strictly implements the password application plan during operation. When the password infrastructure does not provide effective password protection, it can be discovered in time through detection, which can effectively improve the security of the information system, avoid the occurrence of leakage incidents, and reduce the possibility of major security accidents.

[0093] It should be noted that, based on the above embodiments, the embodiments of the present application also provide corresponding improved solutions. In the preferred / improved embodiments, the same steps or corresponding steps as those in the above embodiments can be referenced to each other, and the corresponding beneficial effects can also be referenced to each other, which will not be described one by one in the preferred / improved embodiments of this article.

[0094] In one embodiment of the present application, it also includes:

[0095] Visually output password compliance detection results;

[0096] For non-compliant items in the non-compliant item set, risk warnings are issued according to risk levels.

[0097] Please refer to Figure 3. That is to say, after executing the above steps S101 to S104, the password compliance detection results can also be visualized to intuitively present the password application compliance of the information system during operation. Indicators that deviate from the baseline are considered to be non-compliant items, and risk warnings are issued according to risk levels. At the same time, the comparative analysis conclusions are visually output in the form of charts, and the export of analysis result reports is supported.

[0098] Among them, yes, the password compliance test results will indicate which indicators are compliant and which are not compliant. They can be identified and visualized to show which indicators do not meet the requirements during the operation of the information system and issue alarms.

[0099] In addition, the status of the current commercial cryptographic product certification can be combined with other factors to comprehensively determine whether the information system has compliance risks in the use of cryptographic products.

[0100] Corresponding to the above method embodiment, the embodiment of the present application further provides a detection device, and the detection device described below and the detection method described above can be referred to each other.

[0101] As shown in FIG4 , the device includes the following modules:

[0102] The indicator acquisition unit 101 is used to obtain the cryptographic review report and extract the cryptographic application indicator from the cryptographic review report;

[0103] A baseline establishing unit 102, for establishing a compliance baseline for information system cryptographic application using cryptographic application indicators;

[0104] The data acquisition unit 103 is used to acquire the password application log in real time and extract the password application data from the password application log;

[0105] The compliance comparison unit 104 is used to compare the cryptographic application data with the compliance baseline to obtain a cryptographic compliance detection result.

[0106] Use the device provided in the embodiment of the present application to obtain a cryptographic review report, extract cryptographic application indicators from the cryptographic review report; use the cryptographic application indicators to establish a compliance baseline for cryptographic application in the information system; obtain cryptographic application logs in real time, and extract cryptographic application data from the cryptographic application logs; compare the cryptographic application data with the compliance baseline to obtain a cryptographic compliance test result.

[0107] In order to conduct real-time password compliance inspection, it is necessary to extract password application indicators from the password review report, and then establish a compliance baseline for the password application of the information system based on the password application indicators. In this way, the password application log can be obtained in real time, and the password application data can be extracted from the password application log. By comparing the password application data and the compliance baseline, the password compliance test results can be obtained. Since the compliance baseline is established based on the password review report, and the password application data is extracted from the password application log obtained in real time, the password compliance test results can indicate whether the information system password application strictly implements the password application plan during operation. When the password infrastructure does not provide effective password protection, it can be discovered in time through detection, which can effectively improve the security of the information system, avoid the occurrence of leakage incidents, and reduce the possibility of major security accidents.

[0108] In one embodiment of the present application, the indicator acquisition unit is specifically used to interpret the report outline according to the commercial cryptographic application security assessment report template, and obtain the document location characteristics of the key information data of the information system cryptographic application; use the document location characteristics to define report parsing and data extraction rules; according to the report parsing and data extraction rules, extract the use of cryptographic products, the use of cryptographic algorithms, applicable evaluation indicators and compliance data from the cryptographic evaluation report; determine the use of cryptographic products, the use of cryptographic algorithms, applicable evaluation indicators and compliance data as cryptographic application indicators.

[0109] In one embodiment of the present application, the baseline establishing unit is specifically used to establish a compliance baseline by performing data association and fusion on cryptographic application indicators.

[0110] In one embodiment of the present application, the data acquisition unit is specifically used to collect information system cryptographic service call logs in real time by docking with a cryptographic resource pool.

[0111] In one embodiment of the present application, the data acquisition unit is specifically used to extract target data from the cryptographic application log; the target data is the normal call log of the cryptographic service screened out by the IP address of the information system; and the target data is cleansed to obtain the cryptographic application data.

[0112] In one embodiment of the present application, the compliance comparison unit is specifically used to perform an indicator comparison between the cryptographic application data and the compliance baseline to obtain an indicator comparison result; the indicator comparison result includes a compliant item set and a non-compliant item set; the compliant item set and the non-compliant item set are counted to obtain a cryptographic compliance detection result.

[0113] In one embodiment of the present application, it also includes:

[0114] The compliance detection result processing unit is used to visually output the password compliance detection results; for non-compliant items in the non-compliant item set, risk warnings are issued according to risk levels.

[0115] Corresponding to the above method embodiment, the embodiment of the present application further provides an electronic device. The electronic device described below and the detection method described above can refer to each other.

[0116] As shown in FIG5 , the electronic device includes:

[0117] A memory 332, for storing computer programs;

[0118] The processor 322 is used to implement the steps of the detection method of the above method embodiment when executing the computer program.

[0119] Specifically, please refer to FIG. 6, which is a schematic diagram of the specific structure of an electronic device provided in this embodiment. The electronic device may have relatively large differences due to different configurations or performances, and may include one or more processors (central processing units, CPU) 322 (for example, one or more processors) and a memory 332, and the memory 332 stores one or more computer programs 342 or data 344. Among them, the memory 332 can be a temporary storage or a permanent storage. The program stored in the memory 332 may include one or more modules (not shown in the figure), and each module may include a series of instruction operations in the data processing device. Furthermore, the processor 322 can be configured to communicate with the memory 332 to execute a series of instruction operations in the memory 332 on the electronic device 301.

[0120] The electronic device 301 may further include one or more power supplies 326 , one or more wired or wireless network interfaces 350 , one or more input and output interfaces 358 , and / or one or more operating systems 341 .

[0121] The steps in the detection method described above can be implemented by the structure of an electronic device.

[0122] Corresponding to the above method embodiment, the embodiment of the present application further provides a readable storage medium. The readable storage medium described below and the detection method described above can refer to each other.

[0123] A readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the detection method of the above method embodiment are implemented.

[0124] The readable storage medium may specifically be a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, or other readable storage medium that can store program codes.

[0125] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0126] Those skilled in the art may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented with electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0127] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0128] Finally, it should be noted that, in this article, relationships such as first and second, etc. are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms include, include or any other variations are intended to cover non-exclusive inclusion, so that a process, method, article or device that includes a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0129] Specific examples are used herein to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method and core idea of ​​the present application. At the same time, for those skilled in the art, according to the idea of ​​the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A detection method, characterized in that: include: Obtaining a cryptographic review report, and extracting cryptographic application indicators from the cryptographic review report; Using the cryptographic application indicators, establish a compliance baseline for cryptographic application in information systems; Acquire password application logs in real time, and extract password application data from the password application logs; The password application data is compared with the compliance baseline to obtain a password compliance detection result.

2. The method according to claim 1, characterized in that Extract cryptographic application indicators from the cryptographic review report, including: According to the commercial cryptographic application security assessment report template, interpret the report outline and obtain the document location characteristics of the key information data of the information system cryptographic application; Defining report parsing and data extraction rules using the document location features; Extracting data on the use of cryptographic products, the use of cryptographic algorithms, applicable evaluation indicators and compliance status from the cryptographic review report according to the report analysis and the data extraction rules; The use of the cryptographic product, the use of the cryptographic algorithm, the applicable evaluation indicators and the compliance data are determined as cryptographic application indicators.

3. The method according to claim 1, characterized in that Using the above cryptographic application indicators, establish a compliance baseline for information system cryptographic application, including: The compliance baseline is established by correlating and fusing data of the cryptographic application indicators.

4. The method according to claim 1, characterized in that: Obtain password application logs in real time, including: By connecting to the password resource pool, the information system password service call logs are collected in real time.

5. The method according to claim 1, characterized in that Extracting password application data from the password application log includes: Extracting target data from the password application log; the target data is a normal call log of the password service screened by the information system IP address; A data cleaning operation is performed on the target data to obtain the cryptographic application data.

6. The method according to claim 1, characterized in that Compare the password application data with the compliance baseline to obtain a password compliance test result, including: Performing an index comparison between the cryptographic application data and the compliance baseline to obtain an index comparison result; the index comparison result includes a compliant item set and a non-compliant item set; Statistics are collected on the conforming item set and the non-conforming item set to obtain the password compliance detection result.

7. The method according to any one of claims 1 to 6, characterized in that: Also includes: Visually output the password compliance detection result; For the non-compliant items in the non-compliant item set, risk warnings are issued according to the risk levels.

8. A detection device, characterized in that: include: An indicator acquisition unit, used to acquire a cryptographic review report and extract cryptographic application indicators from the cryptographic review report; A baseline establishing unit, used to establish a compliance baseline for information system cryptographic application using the cryptographic application indicator; A data acquisition unit, used to acquire a password application log in real time and extract password application data from the password application log; The compliance comparison unit is used to compare the password application data with the compliance baseline to obtain a password compliance detection result.

9. An electronic device, characterized in that: include: Memory for storing computer programs; A processor, configured to implement the steps of the detection method according to any one of claims 1 to 7 when executing the computer program.

10. A readable storage medium, characterized in that: The readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the detection method according to any one of claims 1 to 7 are implemented.

Images