Security problem tracking and processing method, device and equipment based on complex network

Abstract

The invention provides a security problem tracking and processing method based on a complex network, which can be applied to the field of information security or cloud computing. The method comprises the following steps: acquiring risk data of a business system memory capacity security problem, and extracting a feature vector in the risk data; constructing a complex network based on a data relationship between the risk data, and mapping the feature vectors to nodes and edges of the complex network; analyzing the complex network to obtain an analysis result corresponding to the security problem; and carrying out prompting and early warning processing according to an analysis result. The invention further provides a security problem tracking and processing device and equipment based on the complex network, a storage medium and a program product.

Description

Technical Field

[0001] The present disclosure relates to the field of information security or cloud computing, and more specifically to a method, device, equipment, medium and program product for tracking and handling security issues based on a complex network. Background Art

[0002] As the information security situation becomes increasingly severe, the offensive and defensive situation between security teams and black industry gangs is gradually rising. Security testing and security assessment work has become an important means to improve their own protection capabilities, control the risk of black industry attacks, and maintain customer information and property security. However, in the process of continuous improvement of protection capabilities, security testing and security assessment issues are also constantly accumulating. In order to be able to find the ability to consolidate and develop security capabilities and security risk vectors from massive historical problems, it is often chosen to track past historical problems and formulate corresponding protection capability improvement plans. However, dealing with the large number of security issues with complex factors every year is a huge and difficult task for humans. Summary of the invention

[0003] In view of the above problems, the embodiments of the present disclosure provide a method, apparatus, device, medium and program product for tracking and handling security issues based on a complex network.

[0004] According to the first aspect of the present disclosure, a method for tracking and handling security issues based on a complex network is provided, the method comprising: obtaining risk data of internal security issues in a business system, and extracting feature vectors in the risk data; constructing a complex network based on the data relationship between the risk data, and mapping the feature vectors to the nodes and edges of the complex network; analyzing the complex network to obtain analysis results corresponding to the security issues; and performing prompt and warning processing based on the analysis results.

[0005] According to an embodiment of the present disclosure, the method of obtaining risk data of internal storage security issues in a business system and extracting feature vectors from the risk data includes: obtaining risk data in the business system, cleaning and preprocessing the risk data, and assigning a unique identifier to the risk data; based on the identifier, performing standardized division of the risk data to obtain n types of risk data after division, where n is a positive integer greater than or equal to 1; and extracting feature vectors of the n types of risk data.

[0006] According to an embodiment of the present disclosure, constructing a complex network based on the data relationship between the risk data and mapping the feature vectors to the nodes and edges of the complex network includes: converting the n types of risk data into nodes of the complex network according to their types; establishing corresponding edges of the complex network between each of the nodes based on predefined association rules; and mapping the feature vectors to the nodes and edges of the complex network to construct the complex network reflecting the security characteristics.

[0007] According to an embodiment of the present disclosure, analyzing the complex network to obtain analysis results corresponding to the security issues includes: automatically identifying the complex network through a community discovery algorithm, and dividing the complex network into community structures; extracting features from each of the communities, and calculating the first similarity of attributes of nodes in the community and / or connection patterns between nodes based on the extracted features; and identifying each of the nodes based on the first similarity to obtain the security issues that occur frequently.

[0008] According to an embodiment of the present disclosure, analyzing the complex network to obtain analysis results corresponding to the security issues also includes: obtaining description texts of the nodes in each community and converting the description texts into numerical vectors; and calculating a second similarity between the numerical vectors, and identifying the security issues that occur frequently based on the second similarity.

[0009] According to an embodiment of the present disclosure, the prompting and warning processing according to the analysis result includes: classifying the security issues into risk levels based on the analysis result, and providing corresponding warning prompts according to the risk levels.

[0010] According to an embodiment of the present disclosure, the method also includes: based on the analysis results in the complex network, using a pre-trained risk prediction model to predict the security risks of the newly added application functions of the business system; and based on the predicted security risks, formulating corresponding preventive measures to reduce the probability of occurrence of the security issues.

[0011] The second aspect of the present disclosure provides a security issue tracking and processing device based on a complex network, including: a data processing module, used to obtain risk data of internal security issues in a business system, and extract feature vectors in the risk data; a network integration module, used to construct a complex network based on the data relationship between the risk data, and map the feature vectors to the nodes and edges of the complex network; a network analysis module, used to analyze the complex network to obtain analysis results corresponding to the security issue; and a prompt and warning module, used to perform prompt and warning processing according to the analysis results.

[0012] The third aspect of the present disclosure provides an electronic device, comprising: one or more processors; a storage device for storing one or more programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the above-mentioned complex network-based security issue tracking and processing method.

[0013] The fourth aspect of the present disclosure further provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned complex network-based security issue tracking and processing method are implemented.

[0014] The fifth aspect of the present disclosure also provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of the above-mentioned complex network-based security issue tracking and processing method.

[0015] In the embodiments of the present disclosure, complex networks are utilized to automatically collect and process large-scale data, and combined with data analysis, potential security risks and issues can be identified more quickly and efficiently, satisfying the need for automated data integration of a company's massive stock of security testing issues. At the same time, the capabilities of data classification, risk prediction, early warning, and self-repair can be accurately realized, realizing the functions of improving risk analysis and prediction and protection capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The above contents and other purposes, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0017] Figure 1 The application scenario diagram schematically shows the complex network-based security problem tracking and processing method, device, equipment, medium and program product according to the embodiment of the present disclosure;

[0018] Figure 2 A flowchart of a method for tracking and handling security issues based on a complex network according to an embodiment of the present disclosure is schematically shown;

[0019] Figure 3 The following schematically shows a phase flow diagram of a method for tracking and handling security issues based on a complex network according to an embodiment of the present disclosure;

[0020] Figure 4 A structural block diagram of a complex network-based security problem tracking and processing device according to an embodiment of the present disclosure is schematically shown; and

[0021] Figure 5 A block diagram of an electronic device according to a complex network-based security issue tracking and processing method according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0022] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0023] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0024] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification, and should not be interpreted in an idealized or overly rigid manner.

[0025] When using expressions such as "at least one of A, B, and C, etc.", they should generally be interpreted according to the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0026] In the technical solution of the present invention, the user information (including but not limited to user personal information, user image information, user device information, such as location information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved are all information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of relevant data comply with the relevant laws, regulations and standards of relevant countries and regions, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0027] Figure 1 The application scenario diagram of the complex network-based security issue tracking and processing method, device, equipment, medium and program product according to an embodiment of the present disclosure is schematically shown.

[0028] like Figure 1As shown, the application scenario 100 according to this embodiment may include terminal devices 101, 102, 103, a network 104 and a server 105. The network 104 is used to provide a medium for a communication link between the terminal devices 101, 102, 103 and the server 105. The network 104 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0029] Users can use terminal devices 101, 102, 103 to interact with server 105 through network 104 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 101, 102, 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only examples).

[0030] The terminal devices 101 , 102 , and 103 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, and desktop computers.

[0031] The server 105 may be a server that provides various services, such as a background management server (only an example) that provides support for websites browsed by users using the terminal devices 101, 102, and 103. The background management server may analyze and process the received data such as user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal device.

[0032] It should be noted that the security problem tracking and processing method based on a complex network provided in the embodiment of the present disclosure can generally be executed by the server 105. Accordingly, the security problem tracking and processing device based on a complex network provided in the embodiment of the present disclosure can generally be set in the server 105. The security problem tracking and processing method based on a complex network provided in the embodiment of the present disclosure can also be executed by a server or server cluster that is different from the server 105 and can communicate with the terminal devices 101, 102, 103 and / or the server 105. Accordingly, the security problem tracking and processing device based on a complex network provided in the embodiment of the present disclosure can also be set in a server or server cluster that is different from the server 105 and can communicate with the terminal devices 101, 102, 103 and / or the server 105.

[0033] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0034] Embodiments of the present disclosure provide a method, apparatus, device, medium, and program product for tracking and handling security issues based on a complex network.

[0035] The following will be based on Figure 1 The scene described by Figure 2 and Figure 3 The complex network-based security problem tracking and processing method of the disclosed embodiment is described in detail.

[0036] Figure 2 The flowchart of the method for tracking and handling security issues based on a complex network according to an embodiment of the present disclosure is schematically shown.

[0037] like Figure 2 As shown, the complex network-based security issue tracking and processing method of this embodiment includes operations S210 to S240.

[0038] In operation S210, risk data of internal memory security issues in the business system is obtained, and feature vectors in the risk data are extracted.

[0039] In an embodiment of the present disclosure, before obtaining the risk data of the internal capacity security problem of the business system, the user's consent or authorization is obtained. For example, before operation S210, a request for obtaining the risk data of the internal capacity security problem of the business system is issued to the user. When the user agrees or authorizes that the risk data of the internal capacity security problem of the business system can be obtained, the operation S210 is performed.

[0040] In operation S220, a complex network is constructed based on the data relationship between the risk data, and the feature vector is mapped to the nodes and edges of the complex network.

[0041] In operation S230, the complex network is analyzed to obtain an analysis result corresponding to the security issue.

[0042] In the embodiment of the present disclosure, a corresponding operation entry is provided for the user to choose to agree or reject the automated decision result. That is, before the complex network is analyzed and processed / decided, the user is input through the corresponding operation entry to agree or reject the processing / decision. If the user agrees to perform the processing / decision, the complex network is analyzed and processed / decided, that is, step S230 is executed. If the user refuses to perform the processing / decision, the expert decision process is entered.

[0043] In operation S240, prompt and warning processing is performed according to the analysis result.

[0044] Specifically, when tracking and managing security issues, we first obtain the existing risk data of various types of security issues from the business system. Then, through data mining and machine learning technology, we extract key feature vectors from the risk data, and then build a complex network based on the relationship between these data. In a complex network, nodes can represent different types of risk data, while edges represent the associations between these issues or entities (such as dependencies, attack paths, etc.). Next, the extracted feature vectors are mapped to the nodes and edges of the complex network, so that each element in the network carries rich security information. After building a complex network with feature vectors, we use complex network analysis technology to mine key information in the network. For example, we evaluate the importance of security issues by calculating the degree of nodes (i.e., the number of connections of nodes); we evaluate the strength of association between security issues by calculating the weight of edges; we discover potential security threats by detecting abnormal patterns in the network, etc. Finally, we perform prompts and warnings based on the results of the complex network analysis. For example, when it is found that the feature value of a node or edge exceeds the preset threshold, the system will automatically trigger a prompt or warning mechanism to notify the administrator or security team to pay attention to these potential security risks. At the same time, the system can also give corresponding disposal suggestions or automated disposal plans based on the analysis results to reduce the administrator's workload and improve disposal efficiency.

[0045] Figure 3 The diagram schematically shows a phase flow chart of a complex network-based security issue tracking and processing method according to an embodiment of the present disclosure.

[0046] Furthermore, if Figure 3 As shown, the security problem tracking and processing method based on complex network of the embodiment of the present disclosure is divided into four stages: data processing stage, network integration stage, network analysis stage and prompt warning stage. The data processing stage is responsible for collecting and preprocessing the existing security problems, relevant communication records and the asset structure of the whole bank in the system, and cleaning the above data to remove repeated and invalid problems and record data. At the same time, data standardization is carried out to unify the data types such as security problems, rectification measures, responsible entities and rectification stages, and extract features from the data; the network integration stage is responsible for constructing a full-scale complex network based on the above data, and constructing the edges of the complex network in combination with the association relationship between each node; the network analysis stage is responsible for specific analysis of the constructed complex network, and based on the analysis methods such as network topology analysis and correlation analysis, the complex network is analyzed and summarized. The prompt warning stage is responsible for prompting various analysis results, taking prompts and warnings for existing process problems, and warning nodes that may have security risks to prevent such nodes from breaking through and falling into the risk of being completely.

[0047] It is understandable that by combining multiple technical ideas such as complex network and topology analysis, we can perform automated data integration and comprehensive analysis of existing security issues, thereby improving the predictive and protection capabilities of risk analysis, avoiding the limitations of manual investigation methods and security risk control systems in processing massive data and risk prediction, and enabling security testers to accurately predict potential security risks and protection shortcomings in massive security issues.

[0048] Furthermore, the method of obtaining risk data of internal storage security issues in the business system and extracting feature vectors from the risk data includes: obtaining risk data in the business system, cleaning and preprocessing the risk data, and assigning a unique identifier to the risk data; based on the identifier, performing standardized division of the risk data to obtain n types of risk data after division, wherein n is a positive integer greater than or equal to 1; and extracting feature vectors of the n types of risk data.

[0049] Specifically, by crawling the security issues, communication records, bank-wide asset structure, group address book and other related data in the security issue system, and cleaning and preprocessing the above data, duplicate or invalid data is removed to ensure that the data basis for subsequent analysis is of high quality. At the same time, the above data is preprocessed in a standardized manner to ensure that data from different sources and different types can be analyzed within a unified framework. In addition, each piece of data is given a unique identifier as a distinction, so that the data can be easily tracked, associated and referenced in the subsequent analysis and management process.

[0050] Exemplarily, the above data are standardized and divided into 5 (i.e. n=5) categories of risk data: security issues, corrective measures, risk assessments, responsible entities and architecture assets, and the features of these five types of data are extracted. Security issues must include problem ID, problem description, risk type, attack path, problem discovery time, risk level and problem status; corrective measures must include measure ID, measure description, person in charge, estimated completion time and actual completion time; risk assessments must include assessment ID, risk description and corrective suggestions; responsible entities must include personnel ID, name, role and contact information; architecture assets must include asset ID, affiliated organization, department in charge and application channels.

[0051] It should be noted that the security issue ID is automatically generated by the system based on the timestamp; the corrective measure ID and risk assessment ID are randomly generated, and the same corrective measures and risk assessment opinions need to be cleaned, the same content removed, and other attributes integrated to retain uniqueness and integrity; the responsible party and architecture asset-related attributes can be directly obtained from the human resources system and the asset architecture management system.

[0052] It is understandable that the process of obtaining risk data on internal security issues in business systems and extracting feature vectors from these risk data can not only improve the quality and consistency of the data, but also better understand and manage these risk data through standardized division and feature extraction, providing strong support for subsequent security analysis and management.

[0053] Furthermore, the construction of a complex network based on the data relationship between the risk data and mapping the feature vectors to the nodes and edges of the complex network includes: converting the n types of risk data into nodes of the complex network according to their types; establishing corresponding edges of the complex network between each of the nodes based on predefined association rules; and mapping the feature vectors to the nodes and edges of the complex network to construct the complex network reflecting the security characteristics.

[0054] Specifically, the data collected and sorted in the data processing phase are used to build a network. In this process, the five types of data mentioned above are first converted into nodes, namely, security problem nodes, rectification measures nodes, risk assessment nodes, responsible entity nodes and architecture asset nodes, and edges are built in combination with actual conditions such as work associations and responsibility relationships or resource management needs.

[0055] It should be noted that the general association rules are as follows: each security issue node can be associated with the other four types of nodes; the rectification measure node can be associated with the security issue node and the responsible entity node; the risk assessment node and the architecture asset node can only be associated with the security issue node; the responsible entity node can be associated with the security issue node to represent the operation and maintenance structure of the application, and can also be associated with the rectification measure node to represent the security issue rectification organization. By mapping the above associations to the structure of nodes and edges, a complex network for tracking and managing security issues is built.

[0056] Optionally, as new risk data is added or old data is updated, the structure and feature vectors of the complex network can be dynamically adjusted to maintain the timeliness and accuracy of the network.

[0057] It is understandable that, unlike manual troubleshooting, the use of complex network ideas to integrate massive amounts of data, that is, automated large-scale data collection and processing, cleverly solves the difficulty of being unable to integrate statistics on past security issues in the system, and provides a global perspective to observe and analyze security issues in the business system, which helps to discover potential threats and vulnerabilities and improve the overall security of the business system.

[0058] Furthermore, the analysis of the complex network to obtain analysis results corresponding to the security issues includes: automatically identifying the complex network through a community discovery algorithm, and dividing the complex network into community structures; extracting features from each of the communities, and calculating the first similarity of the attributes of the nodes in the community and / or the connection patterns between the nodes based on the extracted features; and identifying each of the nodes based on the first similarity to obtain the security issues that occur frequently.

[0059] Exemplarily, when conducting network analysis, three main analysis approaches are used: network topology analysis, correlation analysis, and critical path analysis. Network topology analysis is mainly to discover the community characteristics in complex networks. It uses the community discovery algorithm (Louvian) to automatically identify and divide the community structure, and uses the calculation of the algorithm to better discover node communities with higher similarity. Then the divided community features are extracted and analyzed to find the similarities in the attributes of various nodes in the community, or the similarities in the connection patterns, and convert them into the first similarity to quantify the similarity between different communities. Based on the first similarity of each security issue node and the connection pattern with the associated node, text analysis tools are used to perform language processing on the risk description to identify security issues that may have similar attributes or the same connection patterns, find similar security issues that occur frequently, and responsible entities with weak security protection capabilities. Louvain's specific design for the calculation formula of modularity is as follows:

[0060]

[0061] Where m is the number of edges in the complex network, k i represents the sum of the edge weights pointing to node i, k j Similarly. ij Represents the edge weight between nodes i and j. Δ represents whether nodes i and j belong to the same community. That is, when they belong to the same community, δ is 1, otherwise δ is 0. ∑ is a summation formula. Based on the above formula deconstruction, it can be determined that defining the connection mode between nodes and the weighting of edges will greatly determine the effectiveness and efficiency of the community discovery algorithm. To this end, the following connection mode is confirmed: the security problem node, the rectification measure node and the responsible subject node are weighted according to the workload reported by the problem development subject in the system, and the value is taken according to 1*workload percentage; the security problem node and the rectification measure node are weighted according to whether the rectification measures are complete rectification measures or emergency mitigation measures, and the values ​​are 1 and 0.5; the relationship between the security problem node and the risk assessment node and the architecture asset node is unique, so they are all taken according to the default value 1. Through the above-mentioned weighting of the edges, the community discovery algorithm is continuously iterated and calculated to obtain the community division with the highest modularity.

[0062] It is understandable that through community discovery algorithms and data analysis technology, potential security risks and problems can be identified more quickly and efficiently. At the same time, based on the results of similarity calculations, high-frequency security issues can be identified more accurately, improving the accuracy of analysis. In addition, through the system's natural language processing of risk descriptions and other text, the complexity and mistakes of manual self-identification are avoided, greatly improving the efficiency of data collection and integration.

[0063] Furthermore, the analyzing of the complex network to obtain analysis results corresponding to the security issues also includes: obtaining description texts of the nodes in each community and converting the description texts into numerical vectors; and calculating a second similarity between the numerical vectors, and identifying the security issues that occur frequently based on the second similarity.

[0064] It should be noted that due to the construction principles of complex networks, the communities divided by them are bound to have convergence of responsible entities or asset structures, so correlation analysis is used to supplement the limitations of network topology analysis.

[0065] Specifically, correlation analysis is used to focus on the correlation of security problem nodes in different communities or the complementarity between rectification measure nodes. The text similarity analysis is performed on the description texts in security problems and rectification measures. However, because the thinking logic of converting text into vectors based on TF-IDF is not suitable for this scenario, the embodiment of the present disclosure chooses to use the cosine similarity algorithm based on the bag-of-words model, that is, the text is converted into a vector using word frequency, and then the cosine similarity calculation formula is used for calculation.

[0066]

[0067] Among them, cosθ represents the cosine value of the angle between two vectors, A i and B i Represent the i-th component of vectors A and B respectively.

[0068] In this way, the similarity or complementarity between the two can be judged by the calculation result of cosθ (i.e., the second similarity), that is, the closer to 1, the higher the similarity of the two texts, and the closer to -1, the stronger the complementarity of the texts. Then, the above results can be used to discover similar problems in different institutions or rectification work that needs to be completed in collaboration, thereby promoting the rectification of similar problems or complementary collaboration between institutions.

[0069] Through the above-mentioned machine learning algorithm and data processing algorithm, we can obtain nodes with higher node degrees in the community, namely super nodes. Due to their node degrees, super nodes will be identified as nodes with important "social status" in the community in complex network thinking. In terms of security issue management and tracking thinking, they can be understood as responsible entities or rectification measures involving more security issues, which means that the rectification measures are key measures and will affect more functional applications, or the responsible entity has been found to have more security issues than similar nodes in the community. It is necessary to focus on the responsible entity and urge it to formulate special improvement work in a timely manner.

[0070] Furthermore, critical path analysis is used to determine which nodes (or tasks) in the project are most critical to the overall completion time of the project. These nodes constitute the critical path of the project, and any delay in tasks on this path will cause the entire project to be delayed. In this process, the nodes and links in the network are first analyzed to determine which nodes or links have a significant impact on the overall performance or security of the network. Then, the nodes and links on the critical path are evaluated to identify potential vulnerabilities in the network. Finally, based on the evaluation results, corresponding safety measures or emergency plans can be formulated to reduce potential risks and ensure the stability and security of the network.

[0071] It can be understood that converting description text into numerical vectors and calculating the similarity between them to identify high-frequency security issues in complex networks not only makes up for the limitations of topological analysis, more accurately identifies high-frequency security issues, improves the accuracy of analysis, but also helps to improve the security of the system.

[0072] Furthermore, the prompting and warning processing according to the analysis result includes: classifying the security issues into risk levels based on the analysis result, and issuing corresponding warning prompts according to the risk levels.

[0073] Specifically, issuing warnings requires not only interpreting the many conclusions discovered in the network topology stage, but also making corresponding warning processing for the interpreted results.

[0074] For example, when conducting network analysis, responsible entities with extremely high node degrees in the extracted communities need to be given early warning prompts for such nodes to point out the weaknesses of such nodes in security development capabilities; security issues with high similarity should also be handled with prompts, focusing on preventing the recurrence of similar problems in the same organization, urging the establishment of more complete special improvement plans, and referring to the results of cross-institutional correlation analysis to prompt other organizations to learn from them; feature extraction of attributes such as risk description of security problem nodes in a unified community can assist in analyzing similar risks in the community, and can also be used to warn responsible entities or architecture assets in the community to focus on maintenance, etc.; by focusing on analyzing responsible entity and asset architecture related information nodes in a complex network, traversing the community where they are located, analyzing the community's potential deficiencies in certain security issue development or rectification capabilities, and focusing on security capability improvement work.

[0075] It is understandable that by classifying security issues into risk levels, the potential impact of each security issue can be assessed more accurately. At the same time, early warning prompts are given according to the risk level, so that relevant personnel can respond quickly when security issues occur, thereby strengthening corresponding protective measures and improving the security and stability of the system.

[0076] In an embodiment of the present disclosure, the method also includes: based on the analysis results in the complex network, using a pre-trained risk prediction model to predict the security risks of the newly added application functions of the business system; and according to the predicted security risks, formulating corresponding preventive measures to reduce the probability of occurrence of the security issues.

[0077] After conducting an in-depth analysis of complex networks and obtaining detailed analysis results on security issues, these results can be used to predict the security risks that may be brought about by new application functions in business systems.

[0078] Specifically, before using the risk prediction model to predict the security risks that may be brought about by the new functions, it is first necessary to train the risk prediction model based on a large amount of historical data and security events so that it can identify historical cases similar to the new application functions and predict security risks based on these cases. Then, using machine learning algorithms such as community discovery and correlation analysis, the pre-trained risk prediction model is used to analyze the calculation results of large-scale data, obtain deficiencies in the development or rectification capabilities of certain security issues, predict the security risks of the new functions, and finally formulate corresponding preventive measures based on the prediction results to reduce the probability of security issues.

[0079] For example, preventive measures include, but are not limited to: conducting a detailed security review of new application functions to ensure that their functional design, code implementation, and configuration settings meet security requirements. Or using automated tools to scan new functions for vulnerabilities to promptly discover and fix potential security vulnerabilities. Or, according to business needs, reasonably configure user permissions and access control policies to ensure that only authorized users can access and operate new functions.

[0080] It is understandable that through the predictive capabilities of complex networks based on machine learning, it is possible to effectively predict the asset architecture or newly developed application functions of the responsible entity, thereby formulating preventive measures or work capacity improvement plans in advance and reducing the probability of security risk outbreaks.

[0081] Figure 4 The structural block diagram of the complex network-based security issue tracking and processing device according to an embodiment of the present disclosure is schematically shown.

[0082] like Figure 4 As shown, the complex network-based security issue tracking and processing device 400 according to this embodiment includes a data processing module 410 , a network integration module 420 , a network analysis module 430 and a prompt warning module 440 .

[0083] The data processing module 410 is used to obtain risk data of the business system memory security problem and extract feature vectors in the risk data. In one embodiment, the data processing module 410 can be used to perform the operation S210 described above, which will not be described in detail here.

[0084] The network integration module 420 is used to construct a complex network based on the data relationship between the risk data and map the feature vector to the nodes and edges of the complex network. In one embodiment, the network integration module 420 can be used to perform the operation S220 described above, which will not be repeated here.

[0085] The network analysis module 430 is used to analyze the complex network to obtain analysis results corresponding to the security issues. In one embodiment, the network analysis module 430 can be used to perform the operation S230 described above, which will not be described in detail here.

[0086] The prompt and warning module 440 is used to perform prompt and warning processing according to the analysis result. In one embodiment, the prompt and warning module 440 can be used to perform the operation S240 described above, which will not be repeated here.

[0087] In an embodiment of the present disclosure, the data processing module 410 is specifically used to: obtain risk data in the business system, clean and preprocess the risk data, and assign a unique identifier to the risk data; based on the identifier, standardize and divide the risk data to obtain n types of risk data after division, where n is a positive integer greater than or equal to 1; and extract feature vectors of the n types of risk data.

[0088] In an embodiment of the present disclosure, the network integration module 420 is specifically used to: convert the n types of risk data into nodes of the complex network according to their types; establish corresponding edges of the complex network between each of the nodes based on predefined association rules; and map the feature vectors to the nodes and edges of the complex network to construct the complex network that reflects the security characteristics.

[0089] In an embodiment of the present disclosure, the network analysis module 430 is specifically used to: automatically identify the complex network through a community discovery algorithm, and divide the complex network into a community structure; extract features for each of the communities, and calculate the first similarity of the attributes of the nodes in the community and / or the connection patterns between the nodes based on the extracted features; and identify each of the nodes based on the first similarity to obtain the security issues that occur frequently.

[0090] In an embodiment of the present disclosure, the network analysis module 430 can also be used to: obtain the description text of each node in the community and convert the description text into a numerical vector; and calculate the second similarity between each numerical vector, and identify the security issues that occur frequently based on the second similarity.

[0091] In the embodiment of the present disclosure, the prompt and warning module 440 is specifically used to: classify the security issues into risk levels based on the analysis results, and provide corresponding warning prompts according to the risk levels.

[0092] In an embodiment of the present disclosure, the prompt warning module 440 can also be used to: based on the analysis results in the complex network, use a pre-trained risk prediction model to predict the security risks of the new application functions of the business system; and formulate corresponding preventive measures based on the predicted security risks to reduce the probability of occurrence of the security issues.

[0093] According to an embodiment of the present disclosure, any multiple modules of the data processing module 410, the network integration module 420, the network analysis module 430 and the prompt warning module 440 can be combined into one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the data processing module 410, the network integration module 420, the network analysis module 430 and the prompt warning module 440 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware and firmware or in an appropriate combination of any of them. Alternatively, at least one of the data processing module 410, the network integration module 420, the network analysis module 430 and the prompt warning module 440 can be at least partially implemented as a computer program module, and when the computer program module is executed, the corresponding function can be executed.

[0094] Figure 5 A block diagram of an electronic device according to a complex network-based security issue tracking and processing method according to an embodiment of the present disclosure is schematically shown.

[0095] like Figure 5 As shown, the electronic device 500 according to an embodiment of the present invention includes a processor 501, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 502 or a program loaded from a storage part 508 into a random access memory (RAM) 503. The processor 501 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 501 may also include an onboard memory for caching purposes. The processor 501 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present invention.

[0096] In RAM 503, various programs and data required for the operation of electronic device 500 are stored. Processor 501, ROM 502 and RAM 503 are connected to each other via bus 504. Processor 501 performs various operations of the method flow according to the embodiment of the present invention by executing the program in ROM 502 and / or RAM 503. It should be noted that the program can also be stored in one or more memories other than ROM 502 and RAM 503. Processor 501 can also perform various operations of the method flow according to the embodiment of the present invention by executing the program stored in the one or more memories.

[0097] According to an embodiment of the present invention, the electronic device 500 may further include an input / output (I / O) interface 505, which is also connected to the bus 504. The electronic device 500 may further include one or more of the following components connected to the I / O interface 505: an input portion 506 including a keyboard, a mouse, etc.; an output portion 507 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 508 including a hard disk, etc.; and a communication portion 509 including a network interface card such as a LAN card, a modem, etc. The communication portion 509 performs communication processing via a network such as the Internet. A drive 510 is also connected to the I / O interface 505 as needed. A removable medium 511, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 510 as needed, so that a computer program read therefrom is installed into the storage portion 508 as needed.

[0098] The present invention also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiment; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present invention is implemented.

[0099] According to an embodiment of the present invention, the computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present invention, the computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus or a device. For example, according to an embodiment of the present invention, the computer-readable storage medium may include the ROM 502 and / or RAM 503 described above and / or one or more memories other than ROM 502 and RAM 503.

[0100] The embodiment of the present disclosure also includes a computer program product, which includes a computer program, and the computer program includes a program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the security problem tracking and processing method based on a complex network provided by the embodiment of the present disclosure.

[0101] The above functions defined in the system / device of the embodiment of the present disclosure are performed when the computer program is executed by the processor 501. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0102] In one embodiment, the computer program may rely on tangible storage media such as optical storage devices, magnetic storage devices, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of signals on a network medium, and downloaded and installed through the communication part 509, and / or installed from the removable medium 511. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0103] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 509, and / or installed from the removable medium 511. When the computer program is executed by the processor 501, the above functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the system, device, means, module, unit, etc. described above can be implemented by a computer program module.

[0104] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0105] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0106] It will be appreciated by those skilled in the art that the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations and / or combinations are not explicitly described in the present disclosure. In particular, the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways without departing from the spirit and teachings of the present disclosure. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0107] The embodiments of the present disclosure are described above. However, these embodiments are only for illustrative purposes and are not intended to limit the scope of the present disclosure. Although the embodiments are described above separately, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. The scope of the present disclosure is defined by the attached claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art may make a variety of substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A security problem tracking and processing method based on complex networks, characterized in that: The method comprises: Obtain risk data of internal memory security issues in the business system, and extract feature vectors from the risk data; Building a complex network based on the data relationship between the risk data, and mapping the feature vectors to the nodes and edges of the complex network; Analyzing the complex network to obtain analysis results corresponding to the security issue; and Prompt and early warning processing is performed according to the analysis results.

2. The method according to claim 1, characterized in that: The step of obtaining risk data of internal storage security issues in the business system and extracting feature vectors from the risk data includes: Acquire risk data in the business system, clean and pre-process the risk data, and assign a unique identifier to the risk data; Based on the identifier, the risk data is standardized and divided to obtain n types of risk data after division, wherein n is a positive integer greater than or equal to 1; and Extracting feature vectors of the n types of risk data.

3. The method according to claim 2, characterized in that The step of constructing a complex network based on the data relationship between the risk data and mapping the feature vectors to the nodes and edges of the complex network includes: Converting the n types of risk data into nodes of the complex network according to their types; Based on predefined association rules, establishing corresponding edges of the complex network between the nodes; and The feature vectors are mapped to the nodes and edges of the complex network to construct the complex network reflecting the security characteristics.

4. The method according to claim 1, 2 or 3, characterized in that: The analyzing the complex network to obtain an analysis result corresponding to the security issue includes: Automatically identifying the complex network through a community discovery algorithm and dividing the complex network into community structures; Extracting features from each of the communities, and calculating the first similarity of attributes of nodes in the community and / or connection patterns between nodes based on the extracted features; and Based on the first similarity, each of the nodes is identified to obtain the security issues that occur frequently.

5. The method according to claim 4, characterized in that The analyzing the complex network to obtain an analysis result corresponding to the security issue further includes: Obtaining description text of each node in the community, and converting the description text into a numerical vector; and A second similarity between each of the numerical vectors is calculated, and the security issues that occur frequently are identified according to the second similarity.

6. The method according to claim 1, characterized in that The prompting and warning processing according to the analysis result includes: Based on the analysis results, the security issues are classified into risk levels, and corresponding early warning prompts are given according to the risk levels.

7. The method according to claim 1 or 6, characterized in that: The method further comprises: Based on the analysis results in the complex network, using a pre-trained risk prediction model to predict the security risks of the application functions newly added to the business system; and Based on the predicted security risks, formulate corresponding preventive measures to reduce the probability of occurrence of the security issues.

8. A security problem tracking and processing device based on a complex network, characterized in that: The device comprises: A data processing module, used to obtain risk data of business system memory security issues and extract feature vectors from the risk data; A network integration module, used to construct a complex network based on the data relationship between the risk data, and map the feature vectors to the nodes and edges of the complex network; A network analysis module, used to analyze the complex network to obtain analysis results corresponding to the security issues; and The prompt and warning module is used to perform prompt and warning processing according to the analysis results.

9. An electronic device, comprising: one or more processors; a storage device for storing one or more computer programs, It is characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images