Information security detection and protection method and storage medium
Through low-frequency behavior extraction and threat probability analysis, the problem that information security detection methods in the existing technology are difficult to adapt to dynamic attack methods is solved, and the security protection capabilities of the information system are improved.
Patent Information
- Application Number
- CN202411566525.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-05
- Publication Date
- 2025-01-21
- Estimated Expiration
- Not applicable · inactive patent
AI Technical Summary
In the prior art, information security detection methods are difficult to adapt to dynamic attack methods, and are less intelligent, which makes it difficult to improve the security protection capabilities of information systems.
Through low -frequency behavior extraction and threat probability analysis, the accuracy of identification of potential threats is improved. Specific methods include: obtain information access threat intelligence, extract information access logs, extract at low frequency behavior based on logs, combine threat probability analysis, associated potential threat behavior, and generate information to refuse access signals during triggering.
It improves the accuracy of identifying potential threats, enhances the security protection capabilities of information systems, and can more effectively respond to dynamic attack methods.
Smart Images
Figure CN119341834A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the technical field related to information security detection, and specifically to an information security detection and protection method and a storage medium. Background Art
[0002] With the rapid development of the Internet and information technology, network security threats are also increasing. Existing information security protection measures mainly rely on known attack characteristics and rules, and it is difficult to detect and defend against unknown threats and complex attack behaviors in a timely and effective manner. Attackers are constantly updating their attack methods, using zero-day vulnerabilities, complex attack chains and low-frequency abnormal behaviors to bypass traditional security protection mechanisms, resulting in serious consequences such as information leakage, data tampering and service interruption.
[0003] Therefore, in the prior art, information security detection methods are difficult to adapt to dynamic attack methods and have low intelligence, resulting in a technical problem that it is difficult to improve the security protection capabilities of information systems. Summary of the invention
[0004] This application provides an information security detection and protection method and storage medium to solve the technical problem that the information security detection method in the prior art is difficult to adapt to dynamic attack methods and has low intelligence, which makes it difficult to improve the security protection capability of the information system. Through low-frequency behavior extraction and threat probability analysis, the accuracy of identifying potential threats is improved, and the security protection capability of the information system is enhanced.
[0005] The present application provides an information security detection and protection method, the method comprising: obtaining information access threat intelligence, wherein the information access threat intelligence includes a first information access behavior and an information access target. According to the information access target, extracting an information access log, wherein the information access log includes a second information access behavior. Based on the second information access behavior, low-frequency behavior extraction is performed on the first information access behavior to obtain a third information access behavior. Threat probability analysis is performed on the third information access behavior and the information access target to obtain an information loss probability. When the information loss probability is greater than or equal to a loss probability threshold, the third information access behavior and the information access target are associated and stored. When access to the information access target is requested and the third information access behavior is triggered, an information access denial signal is generated.
[0006] In the implementation method, low-frequency behaviors are extracted from the first information access behavior based on the second information access behavior to obtain a third information access behavior, including: obtaining a first behavior instruction sequence of the first information access behavior. Obtaining several second behavior instruction sequences of the second information access behavior. Based on the several second behavior instruction sequences, performing single frequent instruction pruning on the first behavior instruction sequence to obtain a first-level behavior instruction sequence pruning result. Based on the several second behavior instruction sequences, performing two frequent instruction pruning on the first-level behavior instruction sequence pruning result to obtain a second-level behavior instruction sequence pruning result. Until performing N frequent instruction pruning on the N-1 level behavior instruction sequence pruning result based on the several second behavior instruction sequences to obtain an N-level behavior instruction sequence pruning result. Adding the N-level behavior instruction sequence pruning result into the third information access behavior.
[0007] In the implementation method, based on the several second behavior instruction sequences, the first behavior instruction sequence is pruned with a single frequent instruction to obtain a first-level behavior instruction sequence pruning result, including: extracting a single instruction from the first behavior instruction sequence to obtain a first behavior instruction. Counting the first trigger frequency of the first behavior instruction in the several second behavior instruction sequences. When the first trigger frequency is greater than or equal to the first trigger frequency threshold, the first behavior instruction is pruned from the first behavior instruction sequence to generate a first behavior instruction update sequence. When all instructions of the first behavior instruction sequence are analyzed, the final first behavior instruction update sequence is set as the first-level behavior instruction sequence pruning result.
[0008] In an implementation, based on the plurality of second behavior instruction sequences, the first-level behavior instruction sequence pruning result is subjected to two frequent instruction pruning to obtain the second-level behavior instruction sequence pruning result, including: the first-level behavior instruction sequence pruning result includes the first multiple behavior instruction sequences, the second multiple behavior instruction sequences, and up to the M-th multiple behavior instruction sequences. The first multiple behavior instruction sequences, the second multiple behavior instruction sequences, and the M-th multiple behavior instruction sequences are traversed to perform two frequent instruction pruning to obtain the second-level behavior instruction sequence pruning result.
[0009] In the implementation method, the first multiple behavior instruction sequences and the second multiple behavior instruction sequences are traversed until the M-th multiple behavior instruction sequence is subjected to two frequent instruction pruning to obtain the pruning result of the secondary behavior instruction sequence, including: extracting two continuous instructions according to the pruning result of the primary behavior instruction sequence to obtain the first continuous instruction. The second triggering frequency of the first continuous instruction in the plurality of second behavior instruction sequences is counted. When the second triggering frequency is greater than or equal to the second triggering frequency threshold, the first behavior instruction is pruned from the first multiple behavior instruction sequence to generate a first multiple behavior instruction update sequence, wherein the second triggering frequency threshold is less than the first triggering frequency threshold. When all instructions of the first multiple behavior instruction sequence are analyzed, the last update sequence of the first multiple behavior instruction is added to the pruning result of the secondary behavior instruction sequence.
[0010] In an implementation, a threat probability analysis is performed on the third information access behavior and the information access target to obtain an information loss probability, including: the third information access behavior includes a first continuous access behavior sequence, a second continuous access behavior sequence, and up to a Qth continuous access behavior sequence, and the number of access behaviors in the continuous access behavior sequence is at least 1. The first information loss probability of the first continuous access behavior sequence, the second continuous access behavior sequence, and up to the Qth continuous access behavior sequence at the information access target are counted, and the second information loss probability and up to the Qth information loss probability are counted respectively. The first continuous access behavior sequence and the first information loss probability are stored in association with each other, and the second continuous access behavior sequence and the second information loss probability and up to the Qth continuous access behavior sequence are stored in association with each other to generate the information loss probability.
[0011] In the implementation, respectively counting the first information loss probability, the second information loss probability, and the Qth information loss probability of the first continuous access behavior sequence at the information access target, the second continuous access behavior sequence, and the Qth information loss probability, includes: counting the amount of security information exposed by the first continuous access behavior sequence at the information access target. When the amount of security information exposed is greater than or equal to the exposure data amount threshold, the first information loss probability is set to 1. When the amount of security information exposed is less than the exposure data amount threshold, the first information loss probability is set to 0.
[0012] The present application provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements an information security detection and protection method provided by the present application.
[0013] The present application proposes an information security detection and protection method and storage medium, which obtains information access threat intelligence, wherein the information access threat intelligence includes a first information access behavior and an information access target. According to the information access target, extract the information access log, wherein the information access log includes a second information access behavior. Based on the second information access behavior, extract the low-frequency behavior of the first information access behavior to obtain a third information access behavior. Perform a threat probability analysis on the third information access behavior and the information access target to obtain the information loss probability. When the information loss probability is greater than or equal to the loss probability threshold, the third information access behavior and the information access target are associated and stored. When access to the information access target is requested and the third information access behavior is triggered, an information access denial signal is generated. The technical problem that the information security detection method in the prior art is difficult to adapt to dynamic attack methods and has low intelligence, resulting in the difficulty in improving the security protection capability of the information system is solved. Through low-frequency behavior extraction and threat probability analysis, the accuracy of identifying potential threats is improved, and the security protection capability of the information system is enhanced. BRIEF DESCRIPTION OF THE DRAWINGS
[0014] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings of the embodiments of the present invention. Obviously, the drawings in the following description only relate to some embodiments of the present invention, but are not intended to limit the present invention.
[0015] Figure 1 A schematic diagram of a process flow of an information security detection and protection method provided in an embodiment of the present application; Figure 2 A flowchart of an information security detection and protection method for obtaining third information access behavior provided in an embodiment of the present application. DETAILED DESCRIPTION
[0016] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below.
[0017] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. The described embodiments should not be regarded as limiting the present application. All other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of this application.
[0018] In the following description, reference is made to "some embodiments", which describe a subset of all possible embodiments, but it is understood that "some embodiments" may be the same subset or different subsets of all possible embodiments, and may be combined with each other without conflict, and the terms "first\second" involved are merely to distinguish similar objects and do not represent a specific ordering of objects. The terms "including" and "having" and any variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product, or server that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or modules that are not clearly listed or inherent to these processes, methods, products, or devices. Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those generally understood by technicians in the technical field of this application. The terms used herein are for the purpose of describing the embodiments of the present application only.
[0019] The present application provides an information security detection and protection method and storage medium. Figure 1 As shown, the method includes: Obtain information access threat intelligence, wherein the information access threat intelligence includes a first information access behavior and an information access target. Extract information access logs according to the information access target, wherein the information access logs include a second information access behavior. Perform low-frequency behavior extraction on the first information access behavior based on the second information access behavior to obtain a third information access behavior.
[0020] Collect information from various security intelligence sources, such as vulnerability databases, network security forums, etc., to obtain information access threat intelligence, wherein the information access threat intelligence includes a first information access behavior and an information access target. Information access threat intelligence refers to information about potential attacks or abnormal behaviors that may threaten the security of the information system, including the first information access behavior, i.e., potential malicious access and the system, data or resource that may be attacked by the information access target. Subsequently, extract all query and operation records of the target database in the past month from the access log of the database server, and extract the information access log according to the information access target, wherein the information access log includes a second information access behavior, the information access log records all access behaviors to the information system, and the second access behavior is the access behavior of the regular access log. Based on the second information access behavior, perform low-frequency behavior extraction on the first information access behavior to obtain a third information access behavior, which is the information access behavior after deleting the behavior instructions in the first access behavior that appear frequently in the behavior instructions of the second access behavior.
[0021] The method provided by the embodiment of the present application also includes: obtaining a first behavior instruction sequence of the first information access behavior. Obtaining several second behavior instruction sequences of the second information access behavior. Based on the several second behavior instruction sequences, performing a single frequent instruction pruning on the first behavior instruction sequence to obtain a first-level behavior instruction sequence pruning result. Based on the several second behavior instruction sequences, performing a two-item frequent instruction pruning on the first-level behavior instruction sequence pruning result to obtain a second-level behavior instruction sequence pruning result. Until, based on the several second behavior instruction sequences, performing N frequent instruction pruning on the N-1 level behavior instruction sequence pruning result to obtain an N-level behavior instruction sequence pruning result. Adding the N-level behavior instruction sequence pruning result to the third information access behavior.
[0022] Based on the second information access behavior, low-frequency behavior extraction is performed on the first information access behavior to obtain a third information access behavior, including: obtaining a first behavior instruction sequence of the first information access behavior, the first behavior instruction sequence is a set of all instructions in the first information access behavior in the first information access behavior in the execution order. Obtaining a plurality of second behavior instruction sequences of the second information access behavior, the second behavior instruction sequence is a set of all instructions in each second information access behavior. Further, based on the plurality of second behavior instruction sequences, a single frequent instruction pruning is performed on the first behavior instruction sequence to obtain a first-level behavior instruction sequence pruning result. Based on the plurality of second behavior instruction sequences, a binary frequent instruction pruning is performed on the first-level behavior instruction sequence pruning result to obtain a second-level behavior instruction sequence pruning result. Until based on the plurality of second behavior instruction sequences, an N-1-level behavior instruction sequence pruning result is performed with N frequent instructions to obtain an N-level behavior instruction sequence pruning result, where N is the number of consecutive instructions and N is a constant, that is, binary, triple, and even N frequent instruction pruning is completed. The N-1-level behavior instruction sequence pruning result is added to the third information access behavior.
[0023] like Figure 2 As shown, the method provided by the embodiment of the present application also includes: extracting a single instruction from the first behavior instruction sequence to obtain a first behavior instruction. Counting the first trigger frequency of the first behavior instruction in the plurality of second behavior instruction sequences. When the first trigger frequency is greater than or equal to the first trigger frequency threshold, pruning the first behavior instruction from the first behavior instruction sequence to generate a first behavior instruction update sequence. When all instructions of the first behavior instruction sequence are analyzed, the final first behavior instruction update sequence is set as the pruning result of the first-level behavior instruction sequence.
[0024] Based on the several second behavior instruction sequences, the first behavior instruction sequence is subjected to single frequent instruction pruning to obtain the first level behavior instruction sequence pruning result, including: extracting a single instruction from the first behavior instruction sequence to obtain a first behavior instruction, wherein the first behavior instruction is a random instruction in the first behavior instruction sequence. Subsequently, the first trigger frequency of the first behavior instruction in the several second behavior instruction sequences is counted, wherein the second behavior instruction sequence is a set of instruction sequences of the second information access behavior extracted from the access log of a normal user, representing daily operation behavior. The first trigger frequency is the ratio of the number of times the first behavior instruction appears in all second behavior instruction sequences to the total number of instruction sequences, reflecting the frequency of occurrence of the instruction in normal operation. Traverse all second behavior instruction sequences, count the number of times the first behavior instruction appears, and calculate the trigger frequency of the first behavior instruction, that is, the number of times the first behavior instruction appears divided by the total number of second behavior instruction sequences. If the first behavior instruction only exists in 3 of the 10 information access behaviors, the first trigger frequency is 0.3. When the first trigger frequency is greater than or equal to the first trigger frequency threshold, the first behavior instruction is pruned from the first behavior instruction sequence, that is, the trigger frequency of the first behavior instruction is compared with the threshold. If the trigger frequency of the instruction is greater than or equal to the threshold, the first behavior instruction is removed from the first behavior instruction sequence, and the remaining instructions constitute the first behavior instruction update sequence to generate the first behavior instruction update sequence. The first trigger frequency threshold is a pre-set trigger frequency threshold, which is used to determine whether the instruction appears frequently in normal behavior. It is generally set to a higher percentage, such as 80% or 90%. When all instructions of the first behavior instruction sequence are pruned, the pruned first behavior instruction update sequence is used as the first-level behavior instruction sequence pruning result. By pruning all single instruction sequences in the first behavior instruction sequence, the finally generated pruning result contains low-frequency instructions corresponding to the behavior, thereby providing support for the subsequent identification of the first information access behavior.
[0025] The method provided in the embodiment of the present application also includes: the first-level behavior instruction sequence pruning result includes a first multiple behavior instruction sequence, a second multiple behavior instruction sequence, and up to an M-th multiple behavior instruction sequence. The first multiple behavior instruction sequence, the second multiple behavior instruction sequence, and the M-th multiple behavior instruction sequence are traversed to perform two frequent instruction pruning to obtain the second-level behavior instruction sequence pruning result.
[0026] Based on the several second behavior instruction sequences, the first-level behavior instruction sequence pruning result is subjected to two frequent instruction pruning to obtain the second-level behavior instruction sequence pruning result, including: the first-level behavior instruction sequence pruning result includes the first multiple behavior instruction sequence, the second multiple behavior instruction sequence until the M-th multiple behavior instruction sequence, M is the number of the remaining multiple behavior instruction sequences, and M is a constant. That is, after the first-level behavior instruction sequence pruning result is obtained, there are multiple multiple behavior instruction sequences in the first-level behavior instruction sequence pruning result, and the multiple behavior instruction sequence is a behavior instruction sequence composed of two or more consecutive instructions. Further, the first multiple behavior instruction sequence, the second multiple behavior instruction sequence until the M-th multiple behavior instruction sequence are traversed to perform two frequent instruction pruning, and the two frequent instruction pruning is to remove the frequent items of the behavior instruction sequence composed of two instructions in the first-level behavior instruction sequence pruning result to obtain the second-level behavior instruction sequence pruning result.
[0027] The method provided by the embodiment of the present application also includes: extracting two continuous instructions according to the pruning result of the first-level behavior instruction sequence to obtain a first continuous instruction. Counting the second trigger frequency of the first continuous instruction in the plurality of second behavior instruction sequences. When the second trigger frequency is greater than or equal to the second trigger frequency threshold, pruning the first behavior instruction from the first plurality of behavior instruction sequences to generate a first plurality of behavior instruction update sequence, wherein the second trigger frequency threshold is less than the first trigger frequency threshold. When all instructions of the first plurality of behavior instruction sequences are analyzed, adding the last first plurality of behavior instruction update sequence to the pruning result of the second-level behavior instruction sequence.
[0028] Traversing the first multiple behavior instruction sequences, the second multiple behavior instruction sequences until the Mth multiple behavior instruction sequence performs two frequent instruction pruning to obtain the pruning result of the secondary behavior instruction sequence, including: extracting two continuous instructions according to the pruning result of the primary behavior instruction sequence to obtain a first continuous instruction, wherein the two continuous instructions are a sequence of two random continuous behavior instructions in the pruning result of the primary behavior instruction sequence, and obtaining the first continuous instruction. Counting the second triggering frequency of the first continuous instruction in the plurality of second behavior instruction sequences. When the second triggering frequency is greater than or equal to the second triggering frequency threshold, pruning the first behavior instruction from the first multiple behavior instruction sequence to generate a first multiple behavior instruction update sequence, wherein the second triggering frequency threshold is less than the first triggering frequency threshold. Finally, when all instructions of the first multiple behavior instruction sequence are analyzed, that is, the frequent item analysis of all two continuous instructions in the pruning result of the primary behavior instruction sequence is completed, and the last first multiple behavior instruction update sequence is added to the pruning result of the secondary behavior instruction sequence.
[0029] Perform threat probability analysis on the third information access behavior and the information access target to obtain information loss probability. When the information loss probability is greater than or equal to a loss probability threshold, associate the third information access behavior with the information access target and store it. When access to the information access target is requested and the third information access behavior is triggered, generate an information access denial signal.
[0030] Perform threat probability analysis on the third information access behavior and the information access target to obtain the information loss probability. The information loss probability includes each continuous access behavior sequence and the associated stored information loss probability. When the information loss probability is greater than or equal to the loss probability threshold, the loss probability threshold is a preset threshold value for the number of continuous access behavior sequences with information loss. When it is greater than the threshold, the corresponding information loss probability data loss is large, and the third information access behavior and the information access target are associated and stored. Finally, all information access requests in the system are monitored in real time, and the instruction sequence of the information access request is obtained. When the information access target is requested to be accessed, it is checked whether it matches the stored third information access behavior, and an information access denial signal is generated. The technical problem that the information security detection method in the prior art is difficult to adapt to dynamic attack methods and has low intelligence, resulting in the difficulty in improving the security protection capability of the information system, is solved. Through low-frequency behavior extraction and threat probability analysis, the accuracy of identifying potential threats is improved, and the security protection capability of the information system is enhanced.
[0031] The method provided by the embodiment of the present application also includes: the third information access behavior includes a first continuous access behavior sequence, a second continuous access behavior sequence, and up to the Qth continuous access behavior sequence, and the number of access behaviors in the continuous access behavior sequence is at least 1. The first information loss probability of the first continuous access behavior sequence, the second continuous access behavior sequence, and up to the Qth continuous access behavior sequence at the information access target are counted respectively, and the second information loss probability and up to the Qth information loss probability are counted. The first continuous access behavior sequence and the first information loss probability are stored in association with each other, and the second continuous access behavior sequence and the second information loss probability and up to the Qth continuous access behavior sequence and the Qth information loss probability are stored in association with each other to generate the information loss probability.
[0032] Performing threat probability analysis on the third information access behavior and the information access target to obtain information loss probability, including: the third information access behavior includes a first continuous access behavior sequence, a second continuous access behavior sequence, and up to the Qth continuous access behavior sequence, Q is the remaining continuous access behavior sequence, and Q is a constant, and the number of access behaviors in the continuous access behavior sequence is at least 1. Based on the information access log, the first information loss probability of the first continuous access behavior sequence, the second continuous access behavior sequence, and up to the Qth continuous access behavior sequence at the information access target, and the second information loss probability and up to the Qth information loss probability are counted respectively. The first continuous access behavior sequence and the first information loss probability are associated and stored, and the second continuous access behavior sequence and the second information loss probability and up to the Qth continuous access behavior sequence are associated and stored, to generate the information loss probability.
[0033] The method provided by the embodiment of the present application further includes: counting the amount of security information exposed by the first continuous access behavior sequence at the information access target. When the amount of security information exposed is greater than or equal to the exposure data amount threshold, the first information loss probability is set to 1. When the amount of security information exposed is less than the exposure data amount threshold, the first information loss probability is set to 0.
[0034] The amount of security information exposed data, i.e., the total amount of sensitive or important information leaked, contained in the first continuous access behavior sequence in the information access target is counted in the information access log, usually in units of Byte, KB, MB, etc. When the amount of security information exposed data is greater than or equal to the exposure data amount threshold, the first information loss probability is set to 1. When the amount of security information exposed data is less than the exposure data amount threshold, the first information loss probability is set to 0. The exposure data amount threshold is a pre-set data amount critical value used to determine whether the amount of security information exposed data is sufficient to constitute an information loss risk.
[0035] The technical solution provided by the embodiment of the present invention obtains information access threat intelligence, wherein the information access threat intelligence includes a first information access behavior and an information access target. According to the information access target, extract the information access log, wherein the information access log includes a second information access behavior. Based on the second information access behavior, extract the low-frequency behavior of the first information access behavior to obtain a third information access behavior. Perform threat probability analysis on the third information access behavior and the information access target to obtain the information loss probability. When the information loss probability is greater than or equal to the loss probability threshold, the third information access behavior and the information access target are associated and stored. When access to the information access target is requested and the third information access behavior is triggered, an information access denial signal is generated. The technical problem that the information security detection method in the prior art is difficult to adapt to dynamic attack methods and has low intelligence, resulting in the difficulty in improving the security protection capability of the information system is solved. Through low-frequency behavior extraction and threat probability analysis, the accuracy of identifying potential threats is improved, and the security protection capability of the information system is enhanced.
[0036] In the above, refer to Figure 1 A method for detecting and protecting information security according to an embodiment of the present invention is described in detail. Next, a computer-readable storage medium according to an embodiment of the present invention is described.
[0037] The computer-readable storage medium can be used to store software programs, computer executable programs and modules, such as program instructions / modules corresponding to an information security detection and protection method in an embodiment of the present invention. The computer processor executes various functional applications and data processing of the computer device by running the software programs, instructions and modules stored in a computer-readable storage medium, that is, realizing the above-mentioned distributed database high-speed retrieval method.
[0038] Note that the above are only preferred embodiments of the present invention and the technical principles used. Those skilled in the art will understand that the present invention is not limited to the specific embodiments described herein, and that various obvious changes, readjustments and substitutions can be made by those skilled in the art without departing from the scope of protection of the present invention. Therefore, although the present invention has been described in more detail through the above embodiments, the present invention is not limited to the above embodiments, and may include more other equivalent embodiments without departing from the concept of the present invention, and the scope of the present invention is determined by the scope of the appended claims.
Claims
1. An information security detection and protection method, characterized in that: include: Obtaining information access threat intelligence, wherein the information access threat intelligence includes a first information access behavior and an information access target; Extracting an information access log according to the information access target, wherein the information access log includes a second information access behavior; Extracting low-frequency behaviors from the first information access behavior based on the second information access behavior to obtain a third information access behavior; Performing threat probability analysis on the third information access behavior and the information access target to obtain information loss probability; When the information loss probability is greater than or equal to a loss probability threshold, storing the third information access behavior in association with the information access target; When access to the information access target is requested and the third information access behavior is triggered, an information access denial signal is generated.
2. The method according to claim 1, characterized in that Extracting low-frequency behaviors from the first information access behavior based on the second information access behavior to obtain a third information access behavior includes: Obtain a first behavior instruction sequence of the first information access behavior; Obtaining a plurality of second behavior instruction sequences of the second information access behavior; Based on the plurality of second behavior instruction sequences, pruning the first behavior instruction sequence by a single frequent instruction to obtain a primary behavior instruction sequence pruning result; Based on the plurality of second behavior instruction sequences, performing two frequent instruction pruning on the first-level behavior instruction sequence pruning result to obtain a second-level behavior instruction sequence pruning result; Until, based on the plurality of second behavior instruction sequences, N frequent instructions are pruned on the N-1 level behavior instruction sequence pruning result to obtain the N level behavior instruction sequence pruning result; The pruning result of the N-level behavior instruction sequence is added into the third information access behavior.
3. The method according to claim 2, characterized in that Based on the plurality of second behavior instruction sequences, single frequent instruction pruning is performed on the first behavior instruction sequence to obtain a primary behavior instruction sequence pruning result, including: Extracting a single instruction from the first behavior instruction sequence to obtain a first behavior instruction; Counting the first triggering frequency of the first behavior instruction in the plurality of second behavior instruction sequences; When the first trigger frequency is greater than or equal to a first trigger frequency threshold, pruning the first behavior instruction from the first behavior instruction sequence to generate a first behavior instruction update sequence; After all instructions of the first behavior instruction sequence are analyzed, the last update sequence of the first behavior instruction sequence is set as the pruning result of the first-level behavior instruction sequence.
4. The method according to claim 2, characterized in that Based on the plurality of second behavior instruction sequences, performing two frequent instruction pruning on the first-level behavior instruction sequence pruning result to obtain a second-level behavior instruction sequence pruning result, including: The first-level behavior instruction sequence pruning result includes the first multiple behavior instruction sequences, the second multiple behavior instruction sequences, and up to the Mth multiple behavior instruction sequences; The first multiple behavior instruction sequences and the second multiple behavior instruction sequences are traversed until the M-th multiple behavior instruction sequences are subjected to two frequent instruction pruning to obtain the secondary behavior instruction sequence pruning result.
5. The method according to claim 4, characterized in that Traversing the first multiple behavior instruction sequences, the second multiple behavior instruction sequences until the M-th multiple behavior instruction sequences perform two frequent instruction pruning to obtain the secondary behavior instruction sequence pruning result, including: Extract two consecutive instructions according to the pruning result of the first-level behavior instruction sequence to obtain a first consecutive instruction; Counting the second triggering frequency of the first continuous instruction in the plurality of second behavior instruction sequences; When the second trigger frequency is greater than or equal to a second trigger frequency threshold, pruning the first behavior instruction from the first plurality of behavior instruction sequences to generate a first plurality of behavior instruction update sequences, wherein the second trigger frequency threshold is less than the first trigger frequency threshold; After all instructions of the first plurality of behavior instruction sequences are analyzed, the last update sequence of the first plurality of behavior instruction sequences is added to the secondary behavior instruction sequence pruning result.
6. The method according to claim 1, characterized in that Performing threat probability analysis on the third information access behavior and the information access target to obtain information loss probability includes: The third information access behavior includes a first continuous access behavior sequence, a second continuous access behavior sequence, and up to a Qth continuous access behavior sequence, and the number of access behaviors in the continuous access behavior sequence is at least 1; Count the first information loss probability, the second information loss probability, and the Qth information loss probability of the first continuous access behavior sequence, the second continuous access behavior sequence, and the Qth continuous access behavior sequence at the information access target respectively; The first continuous access behavior sequence and the first information loss probability are associated and stored, and the second continuous access behavior sequence and the second information loss probability are associated and stored, and so on until the Qth continuous access behavior sequence and the Qth information loss probability are associated and stored, to generate the information loss probability.
7. The method according to claim 1, characterized in that The first information loss probability, the second information loss probability, and the Qth information loss probability of the first continuous access behavior sequence, the second continuous access behavior sequence, and the Qth continuous access behavior sequence at the information access target are respectively counted, including: Counting the amount of security information exposed by the first continuous access behavior sequence in the information access target; When the amount of security information exposed data is greater than or equal to the exposure data amount threshold, setting the first information loss probability to 1; When the amount of exposed data of the security information is less than the exposure data amount threshold, the first information loss probability is set to 0.
8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, an information security detection and protection method as described in any one of claims 1 to 7 is implemented.