Data center security assessment method and system

Abstract

The invention is suitable for the field of data security assessment, and provides a data center security assessment method and system, and the system comprises a scene library construction module, an event triggering and real-time monitoring module, an event level division recording module, and a summary report generation module. By establishing a scene library, various possible security events and disaster scenes are covered, and the comprehensiveness and systematicness of evaluation are ensured. And each scene is defined and classified in detail, so that the emergency response capability of the data center under different conditions can be comprehensively tested. And the scientificity and objectivity of the evaluation process are ensured by presetting evaluation indexes and result evaluation standards. Each security event and disaster scene has a clear evaluation standard, the evaluation result can be quantified, and the accuracy and repeatability of evaluation are ensured.

Description

Technical Field

[0001] The present invention belongs to the field of data security assessment, and in particular relates to a data center security assessment method and system. Background Art

[0002] Data security assessment is a comprehensive process that aims to comprehensively analyze and evaluate the security status of information systems, networks, and data storage facilities to ensure that they can effectively resist various security threats and attacks. This process includes threat identification and analysis, vulnerability scanning and management, risk assessment, security control assessment, compliance inspection, penetration testing, incident response and recovery, security awareness training, continuous monitoring and auditing, and reporting and improvement. Through these activities, data security assessment can not only identify and quantify potential security threats and vulnerabilities, but also evaluate and improve the system's security control measures, compliance, incident response capabilities, and employee security awareness. In addition, continuous monitoring and auditing mechanisms ensure real-time updates and optimization of security status, while detailed assessment reports provide a basis for continuous improvement of the system. In short, data security assessment is a dynamic and continuous process that aims to ensure the security and stability of information systems and protect sensitive data from various threats through comprehensive assessment and improvement.

[0003] Many existing technologies may only focus on certain types of events during security assessments, and lack comprehensive coverage of all possible security events and disaster scenarios, resulting in one-sided and incomplete assessment results. In addition, during emergency response, security events and disaster scenarios are often not divided into detailed levels, resulting in unreasonable resource allocation and inefficient processing. Summary of the invention

[0004] The purpose of the present invention is to provide a data center security assessment method and system, aiming to solve the technical problems existing in the prior art identified in the background technology.

[0005] The present invention is implemented as follows: a data center security assessment method, the method comprising: Establish a scenario library, which is used to store a number of security incident scenarios and disaster scenarios, and set evaluation indicators and result evaluation standards for each security incident scenario and disaster scenario; Trigger any preset security event scenario or disaster scenario, monitor the changes of various system indicators in real time, and monitor the system's automatic response, including fault detection, alarm generation, recovery process and data recovery measures implementation status, and record the recovery effect and system response status after the simulation is completed; Classify each security incident and disaster scenario into different levels, and record the efficiency in handling security incident scenarios and disaster scenarios of different levels; Generate a summary report based on the recorded efficiency, recovery effect and system response status, including system performance, event results, response time and recovery effect in each simulation scenario.

[0006] Another object of the present invention is to provide a data center security assessment system, the system comprising: A scenario library construction module is used to establish a scenario library, which is used to store a number of security events and disaster scenarios, and to set evaluation indicators and result evaluation standards for each security event and disaster scenario; The event triggering and real-time monitoring module is used to trigger any preset security event scenario or disaster scenario, monitor the changes of various system indicators in real time, and monitor the automatic response of the system, including fault detection, alarm generation, recovery process and data recovery measures implementation status, and record the recovery effect and system response status after the simulation is completed; The event level classification and recording module is used to classify each security event and disaster scenario and record the efficiency in handling security events and disaster scenarios of different levels; The summary report generation module is used to generate a summary report based on the recorded efficiency, recovery effect and system response status, including system performance, event results, response time and recovery effect in each simulation scenario.

[0007] The beneficial effects of the present invention are: By establishing a scenario library, we cover all possible security incidents and disaster scenarios to ensure the comprehensiveness and systematicness of the evaluation. Each scenario is defined and classified in detail, which can fully test the emergency response capabilities of the data center in different situations. And by presetting evaluation indicators and result evaluation standards, we ensure the scientificity and objectivity of the evaluation process. Each security incident and disaster scenario has clear evaluation standards, which can quantify the evaluation results and ensure the accuracy and repeatability of the evaluation.

[0008] During the simulation, each security incident and disaster scenario will be graded and the processing effects of incidents at different levels will be recorded. This hierarchical processing method ensures that the focus is highlighted, and different processing strategies can be adopted for incidents at different risk levels, optimizing resource allocation and improving processing efficiency.

[0009] By simulating real-life security incidents and disaster scenarios, the actual emergency response capabilities of the data center are improved. During the simulation process, system defects are found and optimized, and the ability to respond to emergencies and the level of collaboration are improved, ensuring that they can be responded to and handled quickly and accurately when actual incidents occur. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] Figure 1 A flow chart of a data center security assessment method provided by an embodiment of the present invention; Figure 2 A flowchart of establishing a scenario library provided by an embodiment of the present invention, and setting evaluation indicators and result evaluation criteria for each security event scenario and disaster scenario; Figure 3 A flowchart of the embodiment of the present invention for monitoring the changes of various indicators of the system in real time and monitoring the automatic response of the system; Figure 4 A flowchart for classifying each security incident and disaster scenario and recording the efficiency of handling security incident scenarios and disaster scenarios of different levels provided by an embodiment of the present invention; Figure 5 A structural block diagram of a data center security assessment system provided by an embodiment of the present invention; Figure 6 A structural block diagram of a scene library construction module provided in an embodiment of the present invention; Figure 7 A structural block diagram of an event triggering and real-time monitoring module provided in an embodiment of the present invention; Figure 8 This is a structural block diagram of the event level classification and recording module provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0011] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0012] It is understood that the terms "first", "second", etc. used in this application may be used herein to describe various elements, but unless otherwise specified, these elements are not limited by these terms. These terms are only used to distinguish a first element from another element. For example, without departing from the scope of this application, a first xx script may be referred to as a second xx script, and similarly, a second xx script may be referred to as a first xx script.

[0013] Figure 1 A flowchart of a data center security assessment method provided by an embodiment of the present invention is shown in FIG. Figure 1 As shown, the method includes: S100, establishing a scenario library, wherein the scenario library is used to store a number of security incident scenarios and disaster scenarios, and to set evaluation indicators and result evaluation standards for each security incident scenario and disaster scenario; This step will identify the asset information of the data center, and comprehensively understand and record all assets in the data center, including hardware, software, data, and network facilities. Specific operations include the preparation of an asset inventory, listing detailed information of all assets, such as equipment type, manufacturer, model, serial number, installation location, etc., and classifying assets into different levels, such as critical assets, important assets, and general assets, based on their functions, value, and impact on the business. Next, the asset information is screened according to the asset level, and the security requirement level of the screened asset information is defined. Through the screening process, assets are classified and screened according to predefined standards, and then the required security measures are determined for the screened assets, such as access control, data encryption, backup and recovery, etc.

[0014] Then, based on the asset information category, obtain security incidents and disaster events that occurred with the same category of asset information. To this end, it is necessary to collect and analyze historical data, industry reports, accident cases, etc., obtain information and event records of assets of the same category, and analyze the causes, processes, impacts, and recovery measures of these events. Next, classify the acquired security incidents and disaster events according to the disaster type, and define scenario descriptions for each type to clarify the conditions, causes, and scope of impact. The classification process includes classifying the collected events by type (such as cyber attacks, hardware failures, natural disasters, etc.), and defining detailed scenario descriptions for each type of event, including the conditions for occurrence, triggering factors, possible scope of impact, and consequences.

[0015] On this basis, a scenario library is established, and several security incident scenarios and disaster scenarios are established in the scenario library according to the acquired security incidents and disaster incidents. To this end, all defined scenarios need to be entered into the scenario library to ensure the accuracy and completeness of the data, and evaluation indicators are selected for each scenario, such as event response time, loss assessment, recovery effect, etc. Finally, evaluation criteria are formulated for each evaluation indicator, and the result evaluation level under different circumstances is defined. This step includes formulating evaluation criteria for each evaluation indicator according to industry standards and actual conditions, and defining the result evaluation level under different circumstances, such as excellent, good, medium, poor, etc., to help quantify the evaluation results.

[0016] By identifying and classifying the assets of the data center in detail, ensuring a comprehensive understanding of all assets helps improve resource management and utilization efficiency. By defining security requirements according to the asset level, targeted security measures can be formulated for each asset to improve overall security. Using historical data and case analysis can help predict and prevent possible security incidents and disasters in the future and improve prevention capabilities. By classifying and describing various possible event scenarios in detail, it is ensured that they can be quickly identified and responded to when an actual incident occurs, improving emergency response capabilities. Establishing a comprehensive scenario library provides a basis for subsequent simulation tests and evaluations to ensure the comprehensiveness and scientificity of the tests. By formulating clear evaluation standards and evaluation levels, the objectivity and consistency of the evaluation results are ensured, which helps to accurately evaluate the security status of the system and improvement measures.

[0017] like Figure 2 As shown, the establishment of the scenario library and the setting of evaluation indicators and result evaluation standards for each security event scenario and disaster scenario specifically include: Identify the asset information of the data center, filter the asset information according to the asset level, and define the security requirement level of the filtered asset information; According to the asset information category, obtain the security events and disaster events that occurred in the same category of asset information; Classify the acquired security events and disaster events according to the disaster type, and define the scenario description for each type, including the conditions, causes and scope of impact; Establish a scenario library, and in the scenario library, establish a number of security incident scenarios and disaster scenarios based on the acquired security incidents and disaster events, select evaluation indicators for each scenario, and formulate evaluation standards for each evaluation indicator, and define the result evaluation levels under different situations.

[0018] S200, trigger any preset security event scenario or disaster scenario, monitor the changes of various system indicators in real time, and monitor the automatic response of the system, including fault detection, alarm generation, recovery process and data recovery measures implementation status, and record the recovery effect and system response status after the simulation is completed; This step will select the security event or disaster scenario that needs to be triggered from the scenario library. According to the selected scenario, set the trigger conditions and time point to start the simulation test. The specific operations include: browsing and selecting a security event or disaster scenario that is suitable for the current assessment target in the scenario library, and setting the trigger conditions (such as specific network traffic, specific system status, etc.) and trigger time point of the scenario in detail to ensure that the simulation test can be accurately started at the predetermined time and conditions.

[0019] Next, identify and collect the system indicators that need to be monitored. This step includes determining which system indicators need to be monitored during the simulation test, such as CPU usage, memory usage, network traffic, disk I / O, etc. Then, establish a corresponding monitoring mechanism to ensure that data for these indicators can be collected in real time. Monitor the automatic response status of the system in this simulated event, including the matching of fault detection, alarm generation time, recovery process start time, recovery process, and recovery effect. Specific steps include: During the simulation test, monitor the response of the system in real time, check whether the fault detection is accurate and timely, record the time point of alarm generation, observe and record the start time and execution process of the recovery process, and evaluate the implementation effect of the recovery measures.

[0020] During the simulation test, the progress of system recovery needs to be continuously recorded. This includes recording every key time point from the occurrence of the failure to the full recovery of the system, and recording in detail the execution and effect of each step of the recovery measures. According to the preset evaluation criteria, the recovery effect is evaluated, including recovery time, data integrity and service recovery. Specific operations include: according to the pre-set evaluation criteria, evaluating whether the system recovery time is within an acceptable range, checking the integrity of data recovery to ensure that no data is lost or damaged, evaluating the service recovery situation, and ensuring that all key services have resumed normal operation.

[0021] By selecting and triggering preset security events or disaster scenarios from the scenario library, a comprehensive evaluation of the data center in different scenarios can be achieved. By setting trigger conditions and time points, the accuracy and repeatability of the simulation test can be ensured. By identifying and collecting system indicators that need to be monitored, the various performance indicators and response status of the system can be comprehensively evaluated in the simulation test. By real-time monitoring of the system's automatic response to simulated events, deficiencies in the system in fault detection, alarm generation, recovery process and recovery effect can be discovered in a timely manner, providing a basis for improvement. Continuously recording the progress of system recovery and evaluating the recovery effect can fully understand the entire process of system recovery and ensure the effectiveness of recovery measures and the integrity of data.

[0022] This process not only helps identify potential security vulnerabilities and improve the system's emergency response capabilities, but also provides valuable data support for improving and optimizing security measures by recording and evaluating the execution of each step in detail. Through systematic and detailed operations.

[0023] like Figure 3 As shown, the real-time monitoring system monitors the changes in various indicators and the automatic response of the system, including: S210, selecting a security event or disaster scenario to be triggered from the scenario library, setting trigger conditions and time points according to the selected scenario, and starting a simulation test; S220, identifying and collecting system indicators that need to be monitored, and monitoring the automatic response status of the system in this simulated event, including the matching of fault detection, alarm generation time, recovery process start time, recovery process, and recovery effect; S230, continuously record the progress of system recovery, and evaluate the recovery effect according to preset evaluation criteria, including recovery time, data integrity, and service recovery status.

[0024] The progress of system recovery is continuously recorded, and the recovery effect is evaluated according to the preset evaluation criteria, including recovery time, data integrity and service recovery status, including: Assign weights to recovery time, data integrity, and service recovery, respectively. The weights for recovery time are 0.35, for data integrity 0.4, and for service recovery 0.25. Calculating the ratio of the actual recovery time to the maximum recovery time to obtain a first ratio, and calculating a reverse normalized recovery time score according to the first ratio; Perform nonlinear transformation on the actual data integrity and service recovery status to amplify the differences and obtain the data integrity score and service recovery score; Perform weighted calculation on the recovery time score, data integrity score, and service recovery score to obtain a recovery time weighted score, a data integrity weighted score, and a service recovery weighted score; Add the weighted score of recovery time, data integrity, and service recovery, and divide by the sum of all weights to get a comprehensive score. The comprehensive score is nonlinearly adjusted using the sigmoid function to obtain the adjusted score, which is then exponentially amplified and scaled to a range of 0 to 100 to obtain the final score.

[0025] In this step, the data integrity score and service recovery status of the present invention are processed by nonlinear transformation, so that indicators of different dimensions or ranges can be reasonably compared. The reverse normalization of the recovery time ensures that the shorter the time, the higher the score, which is intuitive. And by adjusting the comprehensive score through the sigmoid function, the score can be limited to between 0 and 1, and the resolution of the intermediate value can be improved, making the evaluation result more sensitive to the medium recovery effect. The final score is amplified and scaled to a range of 0 to 100, making the evaluation result more intuitive and easy to read, and facilitating a quick understanding of the pros and cons of the recovery effects of different systems. The identification and collection of system indicators that need to be monitored, the automatic response status of the monitoring system in this simulated event, including the matching of fault detection, alarm generation time, recovery process start time, recovery process and recovery effect, specifically include: Enter the event name and system indicator; The time when the event is triggered is used as the starting point of the whole process for loop simulation; Obtain system indicators in the current cycle, use pre-trained machine learning models to analyze current system indicators, and predict the risk probability of system failure; Set an initial risk probability threshold, and dynamically adjust the initial risk probability threshold of the system indicator according to the predicted risk probability to obtain a dynamically adjusted threshold; Check whether the system indicators exceed the dynamically adjusted thresholds; if any system indicator is found to exceed the threshold, the time of fault detection is recorded; if no fault is detected, the monitoring cycle continues; After a fault is detected, an alarm is generated and the time when the alarm is generated is recorded; After the alarm is generated, the preset recovery process is started according to the predicted risk probability, and the time when the recovery process is started is recorded to complete the simulation event.

[0026] In this step, the present invention predicts fault risks by introducing a machine learning model. The system can identify potential problems in advance to track risk changes and dynamically adjust the indicator threshold according to the real-time risk probability, making monitoring more flexible and adaptable. It can provide more appropriate response strategies under different system states to avoid excessive or insufficient responses. In addition, an adaptive recovery strategy is introduced, and the recovery steps are adjusted according to the real-time risk level, making the recovery process more effective and targeted. This adaptive strategy can reduce downtime and quickly restore the normal operation of the system.

[0027] S300, classifying each security incident and disaster scenario into different levels, and recording the efficiency in handling security incident scenarios and disaster scenarios of different levels; This step will develop event level classification standards based on the impact scope, severity, and recovery difficulty of security incidents and disaster scenarios, and classify each security incident and disaster scenario into different levels; specific operations include: analyzing the impact scope of each security incident or disaster scenario, such as the number of affected users, data volume, service type, etc.; assessing the severity of the incident, such as the impact on business continuity, threats to data integrity, etc.; considering the difficulty of recovery, such as the required technical complexity, resource requirements, etc. Based on these factors, a detailed set of event level classification standards is developed to classify events into different levels, such as high, medium, and low risk levels.

[0028] Next, read the response time for handling each security event or disaster scenario, from event triggering to detection, alarm, processing and recovery. The specific operation includes: after the simulation test is completed, collect and analyze the time data of each link, such as fault detection time, alarm generation time, processing start time, recovery completion time, etc., to ensure that each time point is accurately recorded.

[0029] Then, read the detailed steps for handling each incident, including the measures taken, tools and methods used. Specific operations include: recording in detail the specific measures taken when handling each incident, such as manual intervention, automatic script execution, use of third-party tools, etc., as well as the tools and methods used, to ensure that each step is recorded in detail.

[0030] Next, read the success rate of handling different levels of security events and disaster scenarios, that is, whether the problem was successfully solved and the system was restored. The specific operations include: evaluating the handling results of each event, judging whether the problem was successfully solved and the normal operation of the system was restored, and recording the success rate of each level of events.

[0031] Subsequently, the average response time for handling events of different levels is calculated and recorded, including detection time, alarm time, processing time, and recovery time. The specific operations include: for each level of event, the average response time is calculated, including the average time for each link from event triggering to detection, alarm, processing, and recovery, ensuring that each time is accurately calculated and recorded.

[0032] Finally, evaluate and record resource usage when handling events of different levels. Specific operations include: monitoring and recording the resources used when handling each event, such as CPU, memory, network bandwidth, etc., evaluating resource usage, and ensuring that resource usage for each level of event is recorded in detail.

[0033] In addition, we compare the processing efficiency, response time and resource utilization of events at different levels, and record events with abnormal or inefficient processing efficiency. The specific operations include: conducting comparative analysis on events at different levels, identifying events with abnormal or inefficient processing efficiency, and recording detailed information of these events for subsequent improvement and optimization.

[0034] By developing detailed event level classification standards, security events and disaster scenarios can be scientifically and reasonably classified to ensure that each event receives appropriate attention and processing. By recording and analyzing the response time, processing steps, success rate, and resource utilization rate of each event in detail, the system's emergency response capabilities and resource utilization efficiency can be fully evaluated. By calculating and recording the average response time of events at different levels, the system's response speed and processing efficiency can be quantitatively evaluated. By evaluating and recording resource utilization rates, it is possible to ensure the reasonable allocation and efficient use of resources when handling events.

[0035] In addition, by comparing the processing efficiency, response time and resource utilization of events at different levels, we can promptly discover abnormal or inefficient events, providing strong data support for improving and optimizing security measures. This process not only improves the scientificity and accuracy of data center security assessments, but also significantly improves the system's emergency response capabilities and resource utilization efficiency, ensuring that when security incidents or disasters actually occur, they can respond and recover quickly and efficiently, minimizing losses and impacts.

[0036] like Figure 4 As shown, each security incident and disaster scenario is classified into different levels, and the efficiency in handling security incident scenarios and disaster scenarios of different levels is recorded, which specifically includes: S310: Develop event level classification standards based on the impact scope, severity, and recovery difficulty of security events and disaster scenarios, and classify each security event and disaster scenario into different levels; S320, read the response time for handling each security incident or disaster scenario, including the time points of each link from event triggering to detection, alarm, processing and recovery; read the detailed steps for handling each incident, including the measures taken, tools and methods used; S330, reading the success rate of handling security events and disaster scenarios at different levels, that is, whether the problem is successfully solved and the system is restored; calculating and recording the average response time for handling events at different levels, including detection time, alarm time, processing time and recovery time; evaluating and recording the resource utilization rate when handling events at different levels; S340, comparing the processing efficiency, response time and resource utilization rate of events of different levels, and recording events with abnormal or inefficient processing efficiency.

[0037] According to the impact scope, severity and recovery difficulty of security incidents and disaster scenarios, the event level classification standards are formulated to classify each security incident and disaster scenario into levels, including: Obtain influencing factors of security incidents and disaster scenarios, including impact scope, severity, and recovery difficulty, and obtain additional factors of security incidents and disaster scenarios, including additional factor historical frequency and chain reaction potential; Normalize the influencing factors and the additional factors respectively, and then perform nonlinear transformation on the normalized results to obtain the fuzzy values ​​of the influencing factors and the additional factors; Perform weighted summation on the influencing factors and the fuzzy values ​​of the additional factors to obtain a comprehensive raw score; The original score is adjusted by using a nonlinear function to adjust the fuzzy boundary, and the adjusted score is obtained; The adjusted score is inversely transformed to map the nonlinear score to a linear range to obtain the final score, and the event level classification standard is formulated. The final score is compared with the event level classification standard to achieve level division.

[0038] In this step, the present invention can handle the uncertainty and ambiguity in the input data through fuzzy transformation and inverse transformation, and thus adapt to more complex and uncertain real-world environments, and is not easily overly sensitive to slight changes in input data. And the introduction of fuzzy decision boundary adjustment makes the score calculation more accurate and non-linear, which can better reflect the subtle differences between events, especially in boundary cases, and the impact on the classification results is more reasonable. Through nonlinear fuzzy transformation and decision boundary adjustment, extreme situations, such as very high or very low input values, can be better handled, avoiding over- or under-reactions common in linear models. The final classification result simplifies the complex calculation into a simple event level representation, which is convenient for users to understand and make decisions, and provides a clear risk indication.

[0039] The comparison of the processing efficiency, response time and resource utilization rate of events of different levels and recording of events with abnormal or inefficient processing efficiency specifically include: Get incident levels, response times, resource usage, and success rates; Calculate the deviation of each response time and resource utilization rate relative to the average value to obtain first deviation data, and then map the obtained first deviation data using a sigmoid function to obtain a normalized result of the response time and resource utilization rate; Assign weights to response time, resource utilization, and success rate, where the weight of response time is 0.4, the weight of resource utilization is 0.3, and the weight of success rate is 0.3; Multiplying the normalized result of the response time by the corresponding weight to obtain a normalized first intermediate result, and then performing a square operation on the normalized first intermediate result to enhance the difference, thereby obtaining a response time efficiency score; The normalized result of the resource utilization rate is multiplied by the corresponding weight to obtain a normalized second intermediate result, and then the normalized second intermediate result is processed by a logarithmic function, and the result of the logarithmic function processing is squared to enhance the difference, thereby obtaining a resource utilization efficiency score; The success rate is multiplied by the corresponding weight to obtain a normalized third intermediate result, and the normalized third intermediate result is squared to enhance the difference, thereby obtaining a success rate efficiency score; The response time efficiency score, resource utilization efficiency score and success rate efficiency score are added together to obtain a preliminary comprehensive efficiency score; The preliminary comprehensive efficiency score is nonlinearly transformed using a hyperbolic tangent function to compress the input value to between -1 and 1 to obtain a transformed score, which is then amplified to a range of 0 to 100 to obtain a final efficiency score; Set an efficiency score threshold, calculate the lower quartile of the final efficiency scores of all event levels as the threshold for inefficient events, compare the final efficiency scores of all event levels with the efficiency score threshold, and mark the event levels whose final efficiency scores are lower than the threshold as inefficient events.

[0040] In this step, the present invention considers multi-dimensional indicators to comprehensively evaluate the efficiency of event processing. This multi-dimensional analysis can provide a more comprehensive perspective to identify deficiencies. In addition, the present invention uses the lower quartile as the efficiency threshold and uses statistical methods to identify inefficient events, providing an objective benchmark rather than simply relying on fixed absolute values. This method can better adapt to the actual distribution of data.

[0041] S400, generating a summary report based on the recorded efficiency, recovery effect and system response status, including system performance, event results, response time and recovery effect in each simulation scenario.

[0042] Figure 5 A structural block diagram of a data center security assessment system provided by an embodiment of the present invention is shown in FIG. Figure 5 As shown, the system comprises: A scenario library construction module 100 is used to establish a scenario library, which is used to store a number of security events and disaster scenarios, and to set evaluation indicators and result evaluation standards for each security event and disaster scenario; The event triggering and real-time monitoring module 200 is used to trigger any preset security event scenario or disaster scenario, monitor the changes of various system indicators in real time, and monitor the automatic response of the system, including fault detection, alarm generation, recovery process and data recovery measures implementation status, and record the recovery effect and system response status after the simulation is completed; The event level classification recording module 300 is used to classify each security event and disaster scenario and record the efficiency in handling security events and disaster scenarios of different levels; The summary report generation module 400 is used to generate a summary report based on the recorded efficiency, recovery effect and system response status, including system performance, event results, response time and recovery effect in each simulation scenario.

[0043] like Figure 6 As shown, the scene library construction module includes: The asset identification and security requirement definition unit 110 is used to identify the asset information of the data center, filter the asset information according to the asset level, and define the security requirement level of the filtered asset information; The same category asset event acquisition unit 120 is used to acquire security events and disaster events that occur to asset information of the same category according to the asset information category; The event classification and scenario description unit 130 is used to classify the acquired security events and disaster events according to the disaster type, and define a scenario description for each type, including the conditions for occurrence, the cause of occurrence and the scope of impact; The scenario library establishment and evaluation standard formulation unit 140 is used to establish a scenario library, and in the scenario library, establish a number of security event scenarios and disaster scenarios according to the acquired security events and disaster events, and select evaluation indicators for each scenario. At the same time, an evaluation standard is formulated for each evaluation indicator to define the result evaluation level under different situations.

[0044] like Figure 7 As shown, the event triggering and real-time monitoring module includes: The simulation test trigger unit 210 is used to select the security event or disaster scenario to be triggered from the scenario library, set the trigger condition and time point according to the selected scenario, and start the simulation test; The system indicator monitoring and response status evaluation unit 220 is used to identify and collect system indicators that need to be monitored, and monitor the automatic response status of the system in this simulated event, including the matching of fault detection, alarm generation time, recovery process start time, recovery process and recovery effect; The recovery progress recording and effect evaluation unit 230 is used to continuously record the progress of system recovery and evaluate the recovery effect according to preset evaluation criteria, including recovery time, data integrity and service recovery status.

[0045] like Figure 8 As shown, the event level classification recording module includes: The event level classification standard formulation unit 310 is used to formulate event level classification standards according to the impact scope, severity and recovery difficulty of security events and disaster scenarios, and classify each security event and disaster scenario into levels; The event response step reading unit 320 is used to read the response time for handling each security event or disaster scenario, from the time point of event triggering to detection, alarm, processing and recovery; read the detailed steps for handling each event, including the measures taken, tools and methods used; The event result recording unit 330 is used to read the success rate of handling security events and disaster scenarios of different levels, that is, whether the problem is successfully solved and the system is restored; calculate and record the average response time for handling events of different levels, including detection time, alarm time, processing time and recovery time; evaluate and record the resource utilization rate when handling events of different levels; The event processing efficiency analysis unit 340 is used to compare the processing efficiency, response time and resource utilization rate of events of different levels, and record events with abnormal or inefficient processing efficiency.

[0046] It should be understood that, although each step in the flow chart of each embodiment of the present invention is shown in sequence according to the indication of the arrow, these steps are not necessarily performed in sequence according to the order indicated by the arrow. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be performed in other orders. Moreover, at least a portion of the steps in each embodiment may include a plurality of sub-steps or a plurality of stages, and these sub-steps or stages are not necessarily performed at the same time, but can be performed at different times, and the execution order of these sub-steps or stages is not necessarily performed in sequence, but can be performed in turn or alternately with at least a portion of other steps or sub-steps or stages of other steps.

[0047] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the program can be stored in a non-volatile computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0048] The technical features of the above-described embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above-described embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0049] The above-mentioned embodiments only express several implementation methods of the present invention, and the description thereof is relatively specific and detailed, but it cannot be understood as limiting the scope of the patent of the present invention. It should be pointed out that, for ordinary technicians in this field, several variations and improvements can be made without departing from the concept of the present invention, which all belong to the protection scope of the present invention. Therefore, the protection scope of the patent of the present invention shall be subject to the attached claims.

[0050] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A data center security assessment method, characterized in that: The method comprises the following steps: Establish a scenario library, which is used to store a number of security incident scenarios and disaster scenarios, and set evaluation indicators and result evaluation standards for each security incident scenario and disaster scenario; Trigger any preset security event scenario or disaster scenario, monitor the changes of various system indicators in real time, and monitor the system's automatic response, including fault detection, alarm generation, recovery process and data recovery measures implementation status, and record the recovery effect and system response status after the simulation is completed; Classify each security incident and disaster scenario into different levels, and record the efficiency in handling security incident scenarios and disaster scenarios of different levels; Generate a summary report based on the recorded efficiency, recovery effect and system response status, including system performance, event results, response time and recovery effect in each simulation scenario; The establishment of the scenario library and the setting of evaluation indicators and result evaluation standards for each security event scenario and disaster scenario specifically include: Identify the asset information of the data center, filter the asset information according to the asset level, and define the security requirement level of the filtered asset information; According to the asset information category, obtain the security events and disaster events that occurred in the same category of asset information; Classify the acquired security events and disaster events according to the disaster type, and define the scenario description for each type, including the conditions, causes and scope of impact; Establish a scenario library, and in the scenario library, establish a number of security incident scenarios and disaster scenarios based on the acquired security incidents and disaster events, select evaluation indicators for each scenario, and formulate evaluation standards for each evaluation indicator, and define the result evaluation levels under different situations.

2. The data center security assessment method according to claim 1, characterized in that: The real-time monitoring system monitors the changes in various indicators and the automatic response of the system, including: Select the security event or disaster scenario that needs to be triggered from the scenario library, set the trigger conditions and time points according to the selected scenario, and start the simulation test; Identify and collect system indicators that need to be monitored, and monitor the system's automatic response status in this simulated event, including the matching of fault detection, alarm generation time, recovery process start time, recovery process, and recovery effect; Continuously record the progress of system recovery and evaluate the recovery effect according to preset evaluation criteria, including recovery time, data integrity and service recovery.

3. The data center security assessment method according to claim 2, characterized in that: The progress of system recovery is continuously recorded, and the recovery effect is evaluated according to the preset evaluation criteria, including recovery time, data integrity and service recovery status, including: Assign weights to recovery time, data integrity, and service restoration; Calculating the ratio of the actual recovery time to the maximum recovery time to obtain a first ratio, and calculating a reverse normalized recovery time score according to the first ratio; Perform nonlinear transformation on the actual data integrity and service recovery status to amplify the differences and obtain the data integrity score and service recovery score; Perform weighted calculation on the recovery time score, data integrity score, and service recovery score to obtain a recovery time weighted score, a data integrity weighted score, and a service recovery weighted score; Add the weighted score of recovery time, data integrity, and service recovery, and divide by the sum of all weights to get a comprehensive score. The comprehensive score is nonlinearly adjusted using the sigmoid function to obtain the adjusted score, which is then exponentially amplified and scaled to a range of 0 to 100 to obtain the final score.

4. The data center security assessment method according to claim 3, characterized in that: The identification and collection of system indicators that need to be monitored, and the automatic response status of the monitoring system in this simulated event, including the matching of fault detection, alarm generation time, recovery process start time, recovery process and recovery effect, specifically include: Enter the event name and system indicator; The time when the event is triggered is used as the starting point of the whole process for loop simulation; Obtain system indicators in the current cycle, use pre-trained machine learning models to analyze current system indicators, and predict the risk probability of system failure; Set an initial risk probability threshold, and dynamically adjust the initial risk probability threshold of the system indicator according to the predicted risk probability to obtain a dynamically adjusted threshold; Check whether the system indicators exceed the dynamically adjusted thresholds; if any system indicator is found to exceed the threshold, the time of fault detection is recorded; if no fault is detected, the monitoring cycle continues; After a fault is detected, an alarm is generated and the time when the alarm is generated is recorded; After the alarm is generated, the preset recovery process is started according to the predicted risk probability, and the time when the recovery process is started is recorded to complete the simulation event.

5. The data center security assessment method according to claim 4, characterized in that: The level classification of each security incident and disaster scenario and the recording of the efficiency in handling security incident scenarios and disaster scenarios of different levels specifically include: According to the impact scope, severity and recovery difficulty of security incidents and disaster scenarios, formulate event level classification standards and classify each security incident and disaster scenario; Read the response time for handling each security incident or disaster scenario, from the time point of event triggering to detection, alarm, processing and recovery; read the detailed steps for handling each incident, including the measures taken, tools and methods used; Read the success rate of handling different levels of security incidents and disaster scenarios, that is, whether the problem is successfully solved and the system is restored; calculate and record the average response time for handling different levels of incidents, including detection time, alarm time, processing time and recovery time; evaluate and record resource utilization when handling different levels of incidents; Compare the processing efficiency, response time and resource utilization of events of different levels, and record events with abnormal or inefficient processing efficiency.

6. The data center security assessment method according to claim 5, characterized in that: According to the impact scope, severity and recovery difficulty of security incidents and disaster scenarios, the event level classification standards are formulated to classify each security incident and disaster scenario into levels, including: Obtain influencing factors of security incidents and disaster scenarios, including impact scope, severity, and recovery difficulty, and obtain additional factors of security incidents and disaster scenarios, including additional factor historical frequency and chain reaction potential; Normalize the influencing factors and the additional factors respectively, and then perform nonlinear transformation on the normalized results to obtain the fuzzy values ​​of the influencing factors and the additional factors; Perform weighted summation on the influencing factors and the fuzzy values ​​of the additional factors to obtain a comprehensive raw score; The original score is adjusted by using a nonlinear function to adjust the fuzzy boundary, and the adjusted score is obtained; The adjusted score is inversely transformed to map the nonlinear score to a linear range to obtain the final score, and the event level classification standard is formulated. The final score is compared with the event level classification standard to achieve level division.

7. The data center security assessment method according to claim 6, characterized in that: The comparison of the processing efficiency, response time and resource utilization rate of events of different levels and recording of events with abnormal or inefficient processing efficiency specifically include: Get incident levels, response times, resource usage, and success rates; Calculate the deviation of each response time and resource utilization rate relative to the average value to obtain first deviation data, and then map the first deviation data using a sigmoid function to obtain a normalized result of the response time and resource utilization rate; Assign weights to response time, resource utilization, and success rate; Multiplying the normalized result of the response time by the corresponding weight to obtain a normalized first intermediate result, and then performing a square operation on the normalized first intermediate result to enhance the difference, thereby obtaining a response time efficiency score; The normalized result of the resource utilization rate is multiplied by the corresponding weight to obtain a normalized second intermediate result, and then the normalized second intermediate result is processed by a logarithmic function, and the result of the logarithmic function processing is squared to enhance the difference, thereby obtaining a resource utilization efficiency score; The success rate is multiplied by the corresponding weight to obtain a normalized third intermediate result, and the normalized third intermediate result is squared to enhance the difference, thereby obtaining a success rate efficiency score; The response time efficiency score, resource utilization efficiency score and success rate efficiency score are added together to obtain a preliminary comprehensive efficiency score; The preliminary comprehensive efficiency score is nonlinearly transformed using a hyperbolic tangent function to compress the input value to between -1 and 1 to obtain a transformed score, which is then amplified to a range of 0 to 100 to obtain a final efficiency score; Set an efficiency score threshold, calculate the lower quartile of the final efficiency scores of all event levels as the threshold for inefficient events, compare the final efficiency scores of all event levels with the efficiency score threshold, and mark the event levels whose final efficiency scores are lower than the threshold as inefficient events.

8. A data center security assessment system, the system being applied to the data center security assessment method according to any one of claims 1 to 7, characterized in that: The system comprises: A scenario library construction module is used to establish a scenario library, which is used to store a number of security events and disaster scenarios, and to set evaluation indicators and result evaluation standards for each security event and disaster scenario; The event triggering and real-time monitoring module is used to trigger any preset security event scenario or disaster scenario, monitor the changes of various system indicators in real time, and monitor the automatic response of the system, including fault detection, alarm generation, recovery process and data recovery measures implementation status, and record the recovery effect and system response status after the simulation is completed; The event level classification and recording module is used to classify each security event and disaster scenario and record the efficiency in handling security events and disaster scenarios of different levels; The summary report generation module is used to generate a summary report based on the recorded efficiency, recovery effect and system response status, including system performance, event results, response time and recovery effect in each simulation scenario.

9. The data center security assessment system according to claim 8, characterized in that: The scene library construction module includes: The asset identification and security requirement definition unit is used to identify the asset information of the data center, screen the asset information according to the asset level, and define the security requirement level of the screened asset information; The same category asset event acquisition unit is used to acquire security events and disaster events that occur to the same category asset information according to the asset information category; The event classification and scenario description unit is used to classify the acquired security events and disaster events according to the disaster type, and define the scenario description for each type, including the conditions for occurrence, causes of occurrence and scope of impact; The scenario library establishment and evaluation standard formulation unit is used to establish a scenario library, and in the scenario library, establish a number of security incident scenarios and disaster scenarios based on the acquired security incidents and disaster incidents, select evaluation indicators for each scenario, and formulate evaluation standards for each evaluation indicator, defining the result evaluation level under different situations.

Images