Methods, apparatus, and equipment for tracking and handling security issues based on complex networks

Abstract

This disclosure provides a method for tracking and handling security issues based on complex networks, applicable to information security or cloud computing fields. The method includes: acquiring risk data on memory security issues in a business system and extracting feature vectors from the risk data; constructing a complex network based on the data relationships between the risk data and mapping the feature vectors to nodes and edges of the complex network; analyzing the complex network to obtain analysis results corresponding to the security issues; and providing prompts and warnings based on the analysis results. This disclosure also provides a device, equipment, storage medium, and program product for tracking and handling security issues based on complex networks.

Description

Technical Field

[0001] This disclosure relates to the fields of information security or cloud computing, and more specifically to a method, apparatus, device, medium, and program product for tracking and handling security issues based on complex networks. Background Technology

[0002] As the information security situation becomes increasingly severe, the offensive and defensive dynamics between security teams and cybercriminal groups are also gradually escalating. Security testing and assessment have become crucial means to enhance protection capabilities, control cyberattack risks, and safeguard customer information and assets. However, as protection capabilities continuously improve, security testing and assessment issues also accumulate. To identify and strengthen security capabilities and security risk vectors from a massive amount of historical issues, it is often necessary to track past issues and develop corresponding protection capability improvement plans. However, handling the numerous and complex security issues each year is a huge and difficult task for humans. Summary of the Invention

[0003] In view of the above problems, embodiments of this disclosure provide a method, apparatus, device, medium, and program product for tracking and handling security issues based on complex networks.

[0004] According to a first aspect of this disclosure, a method for tracking and handling security issues based on complex networks is provided. The method includes: acquiring risk data of security issues related to memory usage in a business system and extracting feature vectors from the risk data; constructing a complex network based on the data relationships between the risk data and mapping the feature vectors to nodes and edges of the complex network; analyzing the complex network to obtain analysis results corresponding to the security issues; and providing prompts and warnings based on the analysis results.

[0005] According to embodiments of this disclosure, the step of acquiring risk data on memory security issues in a business system and extracting feature vectors from the risk data includes: acquiring risk data from the business system, cleaning and preprocessing the risk data, and assigning a unique identifier to the risk data; based on the identifier, standardizing and dividing the risk data to obtain n categories of risk data, where n is a positive integer greater than or equal to 1; and extracting feature vectors from the n categories of risk data.

[0006] According to embodiments of this disclosure, constructing a complex network based on the data relationships between the risk data and mapping the feature vectors to the nodes and edges of the complex network includes: converting the n types of risk data into nodes of the complex network according to their types; establishing corresponding edges of the complex network between each node based on predefined association rules; and mapping the feature vectors to the nodes and edges of the complex network to construct the complex network that reflects security characteristics.

[0007] According to embodiments of this disclosure, the step of analyzing the complex network to obtain analysis results corresponding to the security problem includes: automatically identifying the complex network through a community detection algorithm and dividing the complex network into community structures; extracting features from each community and calculating a first similarity of the attributes of nodes within the community and / or the connection patterns between nodes based on the extracted features; and identifying each node based on the first similarity to obtain the frequently occurring security problem.

[0008] According to embodiments of this disclosure, the step of analyzing the complex network to obtain analysis results corresponding to the security problem further includes: obtaining descriptive text of each node in the community and converting the descriptive text into numerical vectors; and calculating a second similarity between each numerical vector and identifying the frequently occurring security problem based on the second similarity.

[0009] According to an embodiment of this disclosure, the step of providing prompts and warnings based on the analysis results includes: classifying the security issues into risk levels based on the analysis results, and providing corresponding warning prompts based on the risk levels.

[0010] According to embodiments of this disclosure, the method further includes: predicting the security risks of newly added application functions of the business system using a pre-trained risk prediction model based on the analysis results in the complex network; and formulating corresponding preventive measures based on the predicted security risks to reduce the probability of the security problems occurring.

[0011] A second aspect of this disclosure provides a security issue tracking and processing apparatus based on complex networks, comprising: a data processing module for acquiring risk data of security issues related to memory usage in a business system and extracting feature vectors from the risk data; a network integration module for constructing a complex network based on the data relationships between the risk data and mapping the feature vectors to nodes and edges of the complex network; a network analysis module for analyzing the complex network to obtain analysis results corresponding to the security issue; and a prompting and warning module for providing prompts and warnings based on the analysis results.

[0012] A third aspect of this disclosure provides an electronic device comprising: one or more processors; and a storage device for storing one or more programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the above-described method for tracking and processing security issues based on complex networks.

[0013] A fourth aspect of this disclosure also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the above-described method for tracking and handling security issues based on complex networks.

[0014] The fifth aspect of this disclosure also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the above-described method for tracking and handling security issues based on complex networks.

[0015] In the embodiments of this disclosure, large-scale data collection and processing are automatically performed using complex networks. At the same time, data analysis is combined to identify potential security risks and problems more quickly and efficiently. This satisfies the need for automated data integration of massive existing security testing issues for enterprises. It also enables accurate data classification, risk prediction, early warning and self-repair capabilities, thereby realizing the functions of risk analysis and prediction and protection capability improvement. Attached Figure Description

[0016] The foregoing contents, as well as other objects, features, and advantages of this disclosure, will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0017] Figure 1 The illustration schematically depicts an application scenario of a method, apparatus, device, medium, and program product for tracking and handling security issues based on complex networks according to embodiments of this disclosure.

[0018] Figure 2 A flowchart illustrating a method for tracking and handling security issues based on complex networks according to an embodiment of the present disclosure is shown schematically.

[0019] Figure 3 This illustration schematically shows a phased flow diagram of a security issue tracking and handling method based on complex networks according to an embodiment of the present disclosure;

[0020] Figure 4 This schematically illustrates a structural block diagram of a security issue tracking and processing apparatus based on complex networks according to embodiments of the present disclosure; and

[0021] Figure 5 A block diagram of an electronic device for tracking and handling security issues based on complex networks according to an embodiment of the present disclosure is shown schematically. Detailed Implementation

[0022] The embodiments of the present disclosure will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the disclosure. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of the present disclosure for ease of explanation. However, it will be apparent that one or more embodiments may be practiced without these specific details. Furthermore, descriptions of well-known structures and techniques are omitted in the following description to avoid unnecessarily obscuring the concepts of the present disclosure.

[0023] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit this disclosure. The terms “comprising,” “including,” etc., as used herein indicate the presence of the stated features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0024] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0025] When using expressions such as "at least one of A, B, and C", they should generally be interpreted in accordance with the meaning that is commonly understood by a person skilled in the art (e.g., "a system having at least one of A, B, and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B, and C, etc.).

[0026] In the technical solution of this invention, the user information (including but not limited to user personal information, user image information, user device information, such as location information) and data (including but not limited to data used for analysis, stored data, and displayed data) involved are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of related data all comply with the relevant laws, regulations, and standards of the relevant countries and regions, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entry points for users to choose to authorize or refuse.

[0027] Figure 1 The illustration schematically depicts an application scenario of a method, apparatus, device, medium, and program product for tracking and handling security issues based on complex networks, according to embodiments of the present disclosure.

[0028] like Figure 1As shown, application scenario 100 according to this embodiment may include terminal devices 101, 102, and 103, network 104, and server 105. Network 104 is used as a medium to provide a communication link between terminal devices 101, 102, and 103 and server 105. Network 104 may include various connection types, such as wired or wireless communication links or fiber optic cables, etc.

[0029] Users can use terminal devices 101, 102, and 103 to interact with server 105 via network 104 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 101, 102, and 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc. (for example only).

[0030] Terminal devices 101, 102, and 103 can be various electronic devices with displays and web browsing capabilities, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0031] Server 105 can be a server that provides various services, such as a backend management server that supports websites browsed by users using terminal devices 101, 102, and 103 (for example only). The backend management server can analyze and process data such as received user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices.

[0032] It should be noted that the security problem tracking and processing method based on complex networks provided in this disclosure embodiment can generally be executed by server 105. Correspondingly, the security problem tracking and processing device based on complex networks provided in this disclosure embodiment can generally be located in server 105. The security problem tracking and processing method based on complex networks provided in this disclosure embodiment can also be executed by a server or server cluster that is different from server 105 and capable of communicating with terminal devices 101, 102, 103 and / or server 105. Correspondingly, the security problem tracking and processing device based on complex networks provided in this disclosure embodiment can also be located in a server or server cluster that is different from server 105 and capable of communicating with terminal devices 101, 102, 103 and / or server 105.

[0033] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0034] Embodiments of this disclosure provide a method, apparatus, device, medium, and program product for tracking and handling security issues based on complex networks.

[0035] The following will be based on Figure 1 The described scene, through Figure 2 and Figure 3 The present disclosure provides a detailed description of the method for tracking and handling security issues based on complex networks, according to embodiments of the present disclosure.

[0036] Figure 2 A flowchart illustrating a method for tracking and handling security issues based on complex networks according to an embodiment of the present disclosure is shown.

[0037] like Figure 2 As shown, the security problem tracking and handling method based on complex networks in this embodiment includes operations S210 to S240.

[0038] In operation S210, risk data on the security issues of the business system's memory volume is obtained, and feature vectors are extracted from the risk data.

[0039] In embodiments of this disclosure, user consent or authorization is obtained before acquiring risk data regarding the security of the business system's memory usage. For example, before operation S210, a request is sent to the user to acquire risk data regarding the security of the business system's memory usage. Operation S210 is executed only if the user consents or authorizes the acquisition of this risk data.

[0040] In operation S220, a complex network is constructed based on the data relationships between the risk data, and the feature vectors are mapped to the nodes and edges of the complex network.

[0041] In operation S230, the complex network is analyzed to obtain analysis results corresponding to the security problem.

[0042] In embodiments of this disclosure, a corresponding operation entry point is provided to the user, allowing the user to choose to agree to or reject the automated decision-making result. That is, before analyzing / processing / making decisions on the complex network, the user's instruction to agree to or reject the processing / decision is obtained through the corresponding operation entry point. If the user agrees to the processing / decision, the complex network is analyzed / processed / made decisions, i.e., step S230 is executed. If the user rejects the processing / decision, the expert decision-making process is initiated.

[0043] In operation S240, prompts and warnings are given based on the analysis results.

[0044] Specifically, when tracking and managing security issues, the process begins by acquiring various types of security risk data from existing business systems. Then, data mining and machine learning techniques are used to extract key feature vectors from the risk data, and a complex network is constructed based on the relationships between these data. In this complex network, nodes represent different types of risk data, while edges represent the relationships between these issues or entities (such as dependencies, attack paths, etc.). Next, the extracted feature vectors are mapped onto the nodes and edges of the complex network, ensuring that each element carries rich security information. After constructing the complex network with feature vectors, complex network analysis techniques are used to extract key information from the network. For example, the importance of security issues is assessed by calculating the degree of a node (i.e., the number of connections); the strength of the correlation between security issues is assessed by calculating the weight of edges; and potential security threats are discovered by detecting abnormal patterns in the network. Finally, alerts and warnings are issued based on the results of the complex network analysis. For example, when the feature value of a node or edge exceeds a preset threshold, the system automatically triggers an alert or warning mechanism to notify administrators or the security team to pay attention to these potential security risks. In addition, the system can also provide corresponding handling suggestions or automated handling solutions based on the analysis results, so as to reduce the workload of administrators and improve handling efficiency.

[0045] Figure 3 The illustration shows a phased flow diagram of a security issue tracking and handling method based on complex networks according to an embodiment of the present disclosure.

[0046] Furthermore, such as Figure 3 As shown in the figure, the security issue tracking and handling method based on complex networks in this disclosure is divided into four stages: data processing stage, network integration stage, network analysis stage, and alert and warning stage. The data processing stage is responsible for collecting and preprocessing existing security issues, related communication records, and the bank's asset architecture within the system, and cleaning the data to remove duplicate and invalid issues and records. Simultaneously, data standardization is carried out, unifying the data into types such as security issues, rectification measures, responsible entities, and rectification stages, and extracting features from the data. The network integration stage is responsible for constructing a complete complex network based on the above data, and constructing the edges of the complex network by combining the relationships between nodes. The network analysis stage is responsible for conducting specific analysis of the constructed complex network, using analysis methods such as network topology analysis and correlation analysis to analyze the complex network, and summarizing various analysis results. The alert and warning stage is responsible for providing alerts on various analysis results, taking measures such as prompts and warnings for existing process issues, and issuing warnings for nodes that may have security risks, preventing the risk of breaches and complete compromise at such nodes.

[0047] Understandably, by combining various technical concepts such as complex networks and topology analysis, the automated data integration and comprehensive analysis of existing security issues can be achieved, thereby improving the ability to predict and protect against risks. This avoids the limitations of manual investigation methods and security risk control systems in handling massive amounts of data and predicting risks, enabling security testers to accurately predict potential security risks and shortcomings in protection capabilities among massive security issues.

[0048] Furthermore, the step of acquiring risk data on memory security issues in the business system and extracting feature vectors from the risk data includes: acquiring risk data from the business system, cleaning and preprocessing the risk data, and assigning a unique identifier to the risk data; based on the identifier, standardizing and dividing the risk data to obtain n categories of risk data, where n is a positive integer greater than or equal to 1; and extracting feature vectors from the n categories of risk data.

[0049] Specifically, data related to security issues, communication records, the bank's asset structure, and the group's address book are crawled from the security issue system. This data is then cleaned and preprocessed to remove duplicates or invalid data, ensuring a high-quality data foundation for subsequent analysis. Standardized preprocessing is also applied to ensure that data from different sources and of different types can be analyzed within a unified framework. Furthermore, each data entry is assigned a unique identifier for differentiation, facilitating easy tracking, association, and referencing of this data in subsequent analysis and management.

[0050] For example, the above data is standardized and divided into 5 (n=5) categories of risk data: security issues, remedial measures, risk assessments, responsible parties, and architectural assets. The characteristics of these five categories of data are extracted. Security issues should include issue ID, issue description, risk type, attack path, issue discovery time, risk level, and issue status; remedial measures should include measure ID, measure description, responsible person, expected completion time, and actual completion time; risk assessments should include assessment ID, risk description, and remedial recommendations; responsible parties should include personnel ID, name, role, and contact information; and architectural assets should include asset ID, affiliated organization, responsible department, and application channel.

[0051] It should be noted that the security issue ID is automatically generated by the system based on the timestamp; the rectification measure ID and risk assessment ID are randomly generated, and the same rectification measures and risk assessment opinions must be cleaned to remove duplicate content and integrate other attributes to retain uniqueness and integrity; the responsible entity and the related attributes of the architecture assets can be obtained directly from the human resources system and the asset architecture management system.

[0052] Understandably, the process of acquiring risk data on memory security issues in business systems and extracting feature vectors from this risk data can not only improve data quality and consistency, but also better understand and manage this risk data through standardized partitioning and feature extraction, providing strong support for subsequent security analysis and management.

[0053] Furthermore, the step of constructing a complex network based on the data relationships between the risk data and mapping the feature vectors to the nodes and edges of the complex network includes: converting the n types of risk data into nodes of the complex network according to their types; establishing corresponding edges of the complex network between each node based on predefined association rules; and mapping the feature vectors to the nodes and edges of the complex network to construct the complex network that reflects security characteristics.

[0054] Specifically, the data collected and organized during the data processing phase is used to build a network. In this process, the five types of data mentioned above are first converted into nodes, namely security issue nodes, rectification measure nodes, risk assessment nodes, responsible entity nodes, and architectural asset nodes. At the same time, edges are built based on actual circumstances such as work associations and responsibility relationships, or resource management needs.

[0055] It should be noted that the general association rules are as follows: each security issue node can be associated with the other four types of nodes; remedial action nodes can be associated with both security issue nodes and responsible entity nodes; risk assessment nodes and architecture asset nodes can only be associated with security issue nodes; responsible entity nodes can be associated with security issue nodes to represent the application's operational structure, or with remedial action nodes to represent the security issue remediation organization. By mapping the above associations to the construction of nodes and edges, a complex network for security issue tracking and management is built.

[0056] Optionally, as new risk data is added or old data is updated, the structure and feature vectors of the complex network can be dynamically adjusted to maintain the network's timeliness and accuracy.

[0057] Understandably, unlike manual investigation methods, this approach leverages the concept of complex networks to integrate massive amounts of data—that is, to automate large-scale data collection and processing. This cleverly solves the difficulty of integrating and statistically analyzing past security issues within the system, providing a global perspective for observing and analyzing security problems in the business system. This helps to discover potential threats and vulnerabilities and improve the overall security of the business system.

[0058] Furthermore, the analysis of the complex network to obtain the analysis results corresponding to the security problem includes: automatically identifying the complex network through a community detection algorithm and dividing the complex network into community structures; extracting features from each community and calculating a first similarity of the attributes of nodes within the community and / or the connection patterns between nodes based on the extracted features; and identifying each node based on the first similarity to obtain the frequently occurring security problem.

[0059] For example, network analysis primarily employs three analytical approaches: network topology analysis, correlation analysis, and critical path analysis. Network topology analysis aims to uncover community characteristics in complex networks. It automatically identifies and divides community structures using a community detection algorithm (Louvian), leveraging this algorithm to better discover communities of nodes with high similarity. Then, it extracts and analyzes the characteristics of these communities, identifying similarities in various node attributes or connection patterns, and converts these into a first similarity score to quantify the similarity between different communities. Based on the first similarity score of each security issue node and its connection patterns with related nodes, and simultaneously using text analysis tools to process risk descriptions, it identifies security issues with potentially similar attributes or connection patterns, pinpoints frequently occurring similar security issues, and identifies responsible parties with weak security protection capabilities. The specific design of Louvain's modularity calculation formula is as follows:

[0060]

[0061] Where m is the number of edges in the complex network, and k i k represents the sum of the weights of all edges pointing to node i. j Similarly. A ij δ represents the edge weight between nodes i and j. Δ indicates whether nodes i and j belong to the same community; δ is 1 if they belong to the same community, and 0 otherwise. ∑ is the summation expression. Combining the above formulas, it can be determined that defining the connection patterns between nodes and assigning weights to edges will greatly determine the effectiveness and efficiency of the community detection algorithm. Therefore, the following connection patterns are confirmed: Security issue nodes, rectification measure nodes, and responsible entity nodes are weighted according to the workload reported by the issue development entity in the system, taking a value of 1 * workload percentage; security issue nodes and rectification measure nodes are weighted according to whether the rectification measures are complete or emergency mitigation measures, taking values ​​of 1 and 0.5 respectively; the association between security issue nodes, risk assessment nodes, and architectural asset nodes is unique, so all are assigned the default value of 1. Through the above edge weighting, the community detection algorithm iteratively calculates and obtains the community partition with the highest modularity.

[0062] Understandably, community discovery algorithms and data analysis techniques can identify potential security risks and issues more quickly and efficiently. Furthermore, similarity calculations can more accurately identify frequently occurring security problems, improving the accuracy of the analysis. In addition, the system's natural language processing of risk descriptions and other text avoids the tediousness and errors of manual verification, significantly improving the efficiency of data collection and integration.

[0063] Furthermore, the analysis of the complex network to obtain the analysis results corresponding to the security problem further includes: obtaining the descriptive text of each node in the community and converting the descriptive text into a numerical vector; and calculating the second similarity between each numerical vector, and identifying the frequently occurring security problem based on the second similarity.

[0064] It should be noted that due to the complex network construction principles, the communities it divides will inevitably have similarities in terms of responsible entities or asset structures. Therefore, correlation analysis is used to supplement the limitations of network topology analysis.

[0065] Specifically, correlation analysis is used to focus on the correlation between security issue nodes or the complementarity between rectification measure nodes in different communities. Text similarity analysis is performed on the descriptive text in security issues and rectification measures. However, since the logic of converting text into vectors based on TF-IDF is not suitable for this scenario, this embodiment of the disclosure chooses to use a cosine similarity algorithm based on the bag-of-words model. That is, the text is converted into vectors using word frequency, and then the cosine similarity calculation formula is used.

[0066]

[0067] Where cosθ represents the cosine of the angle between the two vectors, A i and B i Let A and B represent the i-th components of vectors A and B, respectively.

[0068] Therefore, the similarity or complementarity between two texts can be determined by calculating cosθ (i.e., the second similarity). The closer the result is to 1, the higher the similarity between the two texts, while the closer the result is to -1, the stronger the complementarity between the texts. Furthermore, the above results can be used to identify similar problems or rectification work that requires collaboration in different institutions, thereby promoting the rectification of similar problems or complementary collaboration between institutions.

[0069] Through the aforementioned machine learning algorithms and data processing algorithms, we can identify nodes with high node degree in a community, namely super nodes. Due to their node degree, super nodes are considered to have important "social status" in the complex network concept. In the context of security issue management and tracking, this can be understood as responsible entities or rectification measures involving more security issues. This means that the rectification measures are critical measures that will affect many functional applications, or that the responsible entity has been found to have more security issues than similar nodes in the community. Therefore, we need to focus on the responsible entity and urge them to formulate special improvement work in a timely manner.

[0070] Furthermore, critical path analysis identifies which nodes (or tasks) in the project are most critical to the overall project completion time. These nodes constitute the critical path, and any delay in any task along this path will lead to a delay in the entire project. This process first involves analyzing the nodes and links in the network to determine which nodes or links have a significant impact on the overall network performance or security. Then, evaluating the nodes and links on the critical path can identify potential vulnerabilities in the network. Finally, based on the evaluation results, corresponding security measures or contingency plans can be developed to reduce potential risks and ensure the stability and security of the network.

[0071] Understandably, converting descriptive text into numerical vectors and calculating their similarity to identify frequently occurring security issues in complex networks not only overcomes the limitations of topology analysis and more accurately identifies these issues, thus improving the accuracy of the analysis, but also helps to enhance system security.

[0072] Furthermore, the step of providing prompts and warnings based on the analysis results includes: classifying the security issues into risk levels based on the analysis results, and providing corresponding warning prompts based on the risk levels.

[0073] Specifically, issuing alerts requires both escaping the numerous conclusions discovered during the network topology phase and processing the escaped results accordingly.

[0074] For example, during network analysis, for responsible entities with extremely high node degree in the extracted community, early warnings should be issued for these nodes to point out their weaknesses in security development capabilities. Security issues with high similarity should also be flagged, with a focus on preventing the recurrence of similar issues within the same organization, urging the establishment of more comprehensive special improvement plans, and referencing cross-organizational correlation analysis results to prompt other organizations to learn from these examples. Extracting features such as risk descriptions from security issue nodes in a unified community can help analyze similar risks existing in that community and can also be used to warn responsible entities or key maintenance of infrastructure assets within that community. By focusing on analyzing nodes related to responsible entities and asset architecture in complex networks, traversing their respective communities, and analyzing potential deficiencies in the development or rectification capabilities of certain security issues within those communities, a focus should be placed on improving security capabilities.

[0075] Understandably, classifying security issues by risk level allows for a more accurate assessment of the potential impact of each issue. Furthermore, issuing early warnings based on risk levels enables relevant personnel to react quickly when security issues occur, thereby strengthening corresponding protective measures and improving system security and stability.

[0076] In embodiments of this disclosure, the method further includes: predicting the security risks of newly added application functions of the business system using a pre-trained risk prediction model based on the analysis results in the complex network; and formulating corresponding preventive measures based on the predicted security risks to reduce the probability of the security problems occurring.

[0077] After conducting in-depth analysis of complex networks and obtaining detailed analysis results on security issues, these results can be used to predict the security risks that new application functions added to business systems may bring.

[0078] Specifically, before using a risk prediction model to predict the potential security risks of new features, the model must first be trained based on a large amount of historical data and security incidents. This allows the model to identify historical cases similar to the new application features and predict security risks based on these cases. Then, machine learning algorithms such as community detection and correlation analysis are used to analyze the calculation results of the pre-trained risk prediction model on large-scale data. This reveals deficiencies in the development or remediation capabilities for certain security issues, predicts the security risks of new features, and finally, based on the prediction results, corresponding preventative measures are developed to reduce the probability of security problems occurring.

[0079] For example, preventative measures include, but are not limited to: conducting thorough security reviews of new application features to ensure that their functional design, code implementation, and configuration settings meet security requirements; or using automated tools to scan new features for vulnerabilities, promptly identifying and fixing potential security vulnerabilities; or configuring user permissions and access control policies appropriately according to business needs to ensure that only authorized users can access and operate new features.

[0080] Understandably, by leveraging the predictive capabilities of complex networks based on machine learning, it is possible to effectively predict the new application functions developed by the asset architecture or responsible entity, thereby enabling the formulation of preventative measures or capability enhancement plans in advance and reducing the probability of security risks.

[0081] Figure 4 The diagram illustrates a structural block diagram of a security issue tracking and processing apparatus based on a complex network according to an embodiment of the present disclosure.

[0082] like Figure 4 As shown, the security problem tracking and processing device 400 based on complex networks according to this embodiment includes a data processing module 410, a network integration module 420, a network analysis module 430, and an alert and warning module 440.

[0083] The data processing module 410 is used to acquire risk data regarding the memory security issues of the business system and extract feature vectors from the risk data. In one embodiment, the data processing module 410 can be used to perform the operation S210 described above, which will not be repeated here.

[0084] The network integration module 420 is used to construct a complex network based on the data relationships between the risk data, and to map the feature vectors to the nodes and edges of the complex network. In one embodiment, the network integration module 420 can be used to perform the operation S220 described above, which will not be repeated here.

[0085] The network analysis module 430 is used to analyze the complex network and obtain analysis results corresponding to the security problem. In one embodiment, the network analysis module 430 can be used to perform the operation S230 described above, which will not be repeated here.

[0086] The alert and warning module 440 is used to provide alerts and warnings based on the analysis results. In one embodiment, the alert and warning module 440 can be used to perform the operation S240 described above, which will not be repeated here.

[0087] In the embodiments of this disclosure, the data processing module 410 is specifically used for: acquiring risk data from the business system, cleaning and preprocessing the risk data, and assigning a unique identifier to the risk data; standardizing and dividing the risk data based on the identifier to obtain n types of risk data after division, where n is a positive integer greater than or equal to 1; and extracting feature vectors from the n types of risk data.

[0088] In embodiments of this disclosure, the network integration module 420 is specifically used to: convert the n types of risk data into nodes of the complex network according to their types; establish corresponding edges of the complex network between the nodes based on predefined association rules; and map the feature vectors to the nodes and edges of the complex network to construct the complex network that reflects security characteristics.

[0089] In embodiments of this disclosure, the network analysis module 430 is specifically used to: automatically identify the complex network using a community detection algorithm and divide the complex network into community structures; extract features from each community and calculate a first similarity of the attributes of nodes within the community and / or the connection patterns between nodes based on the extracted features; and identify each node based on the first similarity to obtain the frequently occurring security issues.

[0090] In embodiments of this disclosure, the network analysis module 430 may also be used to: obtain descriptive text of nodes within each community and convert the descriptive text into numerical vectors; calculate a second similarity between each numerical vector and identify frequently occurring security issues based on the second similarity.

[0091] In the embodiments of this disclosure, the warning module 440 is specifically used to: classify the security problem into risk levels based on the analysis results, and provide corresponding warning prompts according to the risk levels.

[0092] In the embodiments of this disclosure, the warning module 440 can also be used to: predict the security risks of newly added application functions of the business system based on the analysis results in the complex network using a pre-trained risk prediction model; and formulate corresponding preventive measures according to the predicted security risks to reduce the probability of the security problems occurring.

[0093] According to embodiments of this disclosure, any plurality of modules among the data processing module 410, network integration module 420, network analysis module 430, and alert / warning module 440 may be combined into one module, or any one of these modules may be split into multiple modules. Alternatively, at least some of the functions of one or more of these modules may be combined with at least some of the functions of other modules and implemented in one module. According to embodiments of this disclosure, at least one of the data processing module 410, network integration module 420, network analysis module 430, and alert / warning module 440 may be at least partially implemented as hardware circuitry, such as a field-programmable gate array (FPGA), a programmable logic array (PLA), a system-on-a-chip, a system-on-a-substrate, a system-on-package, an application-specific integrated circuit (ASIC), or implemented in hardware or firmware by any other reasonable means of integrating or packaging the circuitry, or implemented in any one of the three methods of software, hardware, and firmware, or in a suitable combination of any of these. Alternatively, at least one of the data processing module 410, network integration module 420, network analysis module 430, and alert module 440 may be implemented at least partially as a computer program module, which can perform corresponding functions when the computer program module is run.

[0094] Figure 5 A block diagram of an electronic device for tracking and handling security issues based on complex networks according to an embodiment of the present disclosure is shown schematically.

[0095] like Figure 5 As shown, an electronic device 500 according to an embodiment of the present invention includes a processor 501, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 502 or a program loaded from a storage portion 508 into a random access memory (RAM) 503. The processor 501 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 501 may also include onboard memory for caching purposes. The processor 501 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present invention.

[0096] RAM 503 stores various programs and data required for the operation of electronic device 500. Processor 501, ROM 502, and RAM 503 are interconnected via bus 504. Processor 501 executes various operations of the method flow according to embodiments of the present invention by executing programs in ROM 502 and / or RAM 503. It should be noted that the programs may also be stored in one or more memories other than ROM 502 and RAM 503. Processor 501 may also execute various operations of the method flow according to embodiments of the present invention by executing programs stored in said one or more memories.

[0097] According to an embodiment of the present invention, the electronic device 500 may further include an input / output (I / O) interface 505, which is also connected to the bus 504. The electronic device 500 may also include one or more of the following components connected to the I / O interface 505: an input section 506 including a keyboard, mouse, etc.; an output section 507 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 508 including a hard disk, etc.; and a communication section 509 including a network interface card such as a LAN card, modem, etc. The communication section 509 performs communication processing via a network such as the Internet. A drive 510 is also connected to the I / O interface 505 as needed. A removable medium 511, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 510 as needed so that computer programs read from it can be installed into the storage section 508 as needed.

[0098] The present invention also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs, which, when executed, implement the method according to the embodiments of the present invention.

[0099] According to embodiments of the present invention, a computer-readable storage medium may be a non-volatile computer-readable storage medium, such as including, but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of the present invention, a computer-readable storage medium may include ROM 502 and / or RAM 503 and / or one or more memories other than ROM 502 and RAM 503 described above.

[0100] Embodiments of this disclosure also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code enables the computer system to implement the security problem tracking and handling method based on complex networks provided in the embodiments of this disclosure.

[0101] When the computer program is executed by the processor 501, it performs the functions defined in the system / apparatus of this disclosure embodiments. According to embodiments of this disclosure, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0102] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and may be downloaded and installed via the communication section 509, and / or installed from a removable medium 511. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0103] In such an embodiment, the computer program can be downloaded and installed from a network via communication section 509, and / or installed from removable medium 511. When the computer program is executed by processor 501, it performs the functions defined in the system of this disclosure embodiment. According to embodiments of this disclosure, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0104] According to embodiments of this disclosure, program code for executing the computer programs provided in embodiments of this disclosure can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can execute entirely on the user's computing device, partially on the user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0105] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0106] Those skilled in the art will understand that the features described in the various embodiments and / or claims of this disclosure can be combined or combined in various ways, even if such combinations or combinations are not explicitly described in this disclosure. In particular, the features described in the various embodiments and / or claims of this disclosure can be combined or combined in various ways without departing from the spirit and teachings of this disclosure. All such combinations and / or combinations fall within the scope of this disclosure.

[0107] The embodiments of this disclosure have been described above. However, these embodiments are for illustrative purposes only and are not intended to limit the scope of this disclosure. Although various embodiments have been described above, this does not mean that the measures in the various embodiments cannot be used advantageously in combination. The scope of this disclosure is defined by the appended claims and their equivalents. Various substitutions and modifications can be made by those skilled in the art without departing from the scope of this disclosure, and all such substitutions and modifications should fall within the scope of this disclosure.

Claims

1. A method for tracking and handling security issues based on complex networks, characterized in that, The method includes: Obtain risk data on memory security issues in the business system, and extract feature vectors from the risk data; A complex network is constructed based on the data relationships between the risk data, and the feature vectors are mapped to the nodes and edges of the complex network. The complex network is analyzed to obtain analysis results corresponding to the security problem; and Based on the analysis results, prompts and warnings will be issued.

2. The method according to claim 1, characterized in that, The process of acquiring risk data regarding the memory security of the business system and extracting feature vectors from the risk data includes: Obtain risk data from the business system, clean and preprocess the risk data, and assign a unique identifier to the risk data. Based on the identifier, the risk data is standardized and divided into n categories, where n is a positive integer greater than or equal to 1; and Extract the feature vectors of the n types of risk data.

3. The method according to claim 2, characterized in that, The process of constructing a complex network based on the data relationships between the risk data and mapping the feature vectors to the nodes and edges of the complex network includes: The n types of risk data are converted into nodes of the complex network according to their types; Based on predefined association rules, corresponding edges are established between the nodes in the complex network; and The feature vectors are mapped to the nodes and edges of the complex network to construct the complex network that reflects security characteristics.

4. The method according to claim 1, 2 or 3, characterized in that, The analysis of the complex network to obtain analysis results corresponding to the security problem includes: The complex network is automatically identified using a community detection algorithm, and the complex network is divided into community structures. Feature extraction is performed on each of the communities, and a first similarity is calculated based on the extracted features for the attributes of nodes within the community and / or the connection patterns between nodes; and Based on the first similarity, each node is identified to obtain the frequently occurring security issues.

5. The method according to claim 4, characterized in that, The analysis of the complex network to obtain the analysis results corresponding to the security problem further includes: Obtain the description text of each node within the community, and convert the description text into a numerical vector; and Calculate a second similarity between each of the numerical vectors, and identify the frequently occurring security issues based on the second similarity.

6. The method according to claim 1, characterized in that, The process of providing prompts and warnings based on the analysis results includes: Based on the analysis results, the security issues are classified into risk levels, and corresponding early warning prompts are issued according to the risk levels.

7. The method according to claim 1 or 6, characterized in that, The method further includes: Based on the analysis results in the complex network, a pre-trained risk prediction model is used to predict the security risks of newly added application functions in the business system; and Based on the predicted security risks, corresponding preventive measures will be formulated to reduce the probability of the security problems occurring.

8. A security issue tracking and processing device based on complex networks, characterized in that, The device includes: The data processing module is used to acquire risk data on memory security issues in the business system and extract feature vectors from the risk data. A network integration module is used to construct a complex network based on the data relationships between the risk data, and to map the feature vectors to the nodes and edges of the complex network; A network analysis module is used to analyze the complex network and obtain analysis results corresponding to the security issue; and The alert module is used to provide alerts and warnings based on the analysis results.

9. An electronic device, comprising: One or more processors; Storage device for storing one or more computer programs. The characteristic feature is that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the computer program implements the steps of the method according to any one of claims 1 to 7.

Images