Data security policy automatic adjustment method and device, electronic equipment and storage medium

Abstract

The invention relates to a data security policy automatic adjustment method and device, electronic equipment and a storage medium, and the method comprises the steps: obtaining real-time monitoring data and security policy tuning information, and carrying out the preprocessing of the real-time monitoring data; based on a pre-established data analysis model, analyzing the preprocessed real-time monitoring data to generate a security event alarm and risk assessment result; and adjusting the current security policy based on the security policy tuning information, the security event alarm and the risk assessment result. The data security policy automatic adjustment method provided by the invention can adjust the current security policy based on the security policy tuning information, the security event alarm and the risk assessment result, realizes comprehensive monitoring, analysis, adjustment and optimization of the cloud environment security, can adapt to rapidly changing security threats and regulation requirements, and improves the safety of the cloud environment. And an efficient, intelligent and compliant cloud data security management solution is provided for enterprises.

Description

Technical Field

[0001] The present invention relates to the field of electric power safety technology, and in particular to a method, device, electronic equipment and storage medium for automatically adjusting a data security strategy. Background Art

[0002] With the increasing popularity of cloud computing technology, enterprises and organizations are increasingly relying on cloud services to carry critical business and store sensitive data. However, this centralized data storage and processing method also brings new security challenges.

[0003] First, with the continuous changes in regulations, such as the implementation of the EU General Data Protection Regulation (GDPR), cloud service providers need to ensure that their services are not only able to resist cyber attacks, but also comply with data protection regulations in various countries and regions. Second, compliance checks often involve a lot of manual review work, which brings additional complexity and cost to the management of cloud services. Summary of the invention

[0004] The purpose of the present invention is to overcome the above-mentioned technical deficiencies and propose a method, device, electronic device and storage medium for automatic adjustment of data security policies to solve the technical problem that the prior art mainly relies on manual review and is inefficient when responding to compliance requirements.

[0005] In order to achieve the above technical objectives, the present invention adopts the following technical solutions: In a first aspect, the present invention provides a method for automatically adjusting data security policies, comprising the following steps: obtaining real-time monitoring data and security policy tuning information, and preprocessing the real-time monitoring data; analyzing the preprocessed real-time monitoring data based on a pre-established data analysis model to generate security event alarms and risk assessment results; and adjusting the current security policy based on the security policy tuning information, security event alarms and risk assessment results.

[0006] In some embodiments, the training method of the data analysis model is: obtaining historical monitoring data, generating a training set based on the historical monitoring data; establishing an initial model, and training the initial model using the historical monitoring data to obtain a fully trained data analysis model.

[0007] In some embodiments, based on a pre-established data analysis model, the pre-processed real-time monitoring data is analyzed to generate security event alarms and risk assessment results, including: inputting the pre-processed real-time monitoring data into the data analysis model to identify abnormal data in the real-time monitoring data; comparing the abnormal data with a preset risk threshold to generate security event alarms and risk assessment results.

[0008] In some embodiments, the data analysis model is a convolutional neural network model or a recurrent neural network model.

[0009] In some embodiments, the method for acquiring security policy tuning information is: associating with an external policy database, and outputting the security policy tuning information according to the update of the security policy configuration file in the policy database.

[0010] In some embodiments, the optimization method of the data analysis model is: changing the execution strategy of the data analysis model according to the security policy tuning information, and then importing the abnormal data in the real-time monitoring data into the data analysis model for scenario simulation training to self-optimize the data analysis model.

[0011] In some embodiments, security policies include developing or updating firewall rule sets, intrusion detection system parameters, and access control lists.

[0012] In the second aspect, the present invention also provides a data security policy automatic adjustment device, which is used to implement the steps in the data security policy automatic adjustment method, including: a data acquisition unit, used to acquire real-time monitoring data and security policy tuning information, and pre-process the real-time monitoring data; a risk assessment unit, used to analyze the pre-processed real-time monitoring data based on a pre-established data analysis model to generate security event alarms and risk assessment results; a policy adjustment unit, used to adjust the current security policy based on the security policy tuning information, security event alarms and risk assessment results.

[0013] In a third aspect, the present invention further provides an electronic device, comprising: a processor and a memory; the memory stores a computer program executable by the processor; and the processor implements the steps in the method for automatically adjusting data security policies when executing the computer program.

[0014] In a fourth aspect, the present invention further provides a storage medium, characterized in that it comprises: a processor and a memory; a computer program executable by the processor is stored on the memory; and the steps in the method for automatically adjusting the data security policy are implemented when the processor executes the computer program.

[0015] Compared with the existing technology, the data security policy automatic adjustment method provided by the present invention can adjust the current security policy based on security policy tuning information, security event alarms and risk assessment results, realize comprehensive monitoring, analysis, adjustment and optimization of cloud environment security, and can adapt to rapidly changing security threats and regulatory requirements, providing enterprises with an efficient, intelligent and compliant cloud data security management solution. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 It is a method flow chart of an embodiment of a method for automatically adjusting a data security policy provided by the present invention; Figure 2 yes Figure 1 Flowchart of the training method of the data analysis model in the figure; Figure 3 yes Figure 1 A method flow chart of an embodiment of step S102; Figure 4 It is a schematic diagram of an embodiment of a data security policy automatic adjustment device provided by the present invention; Figure 5 It is a schematic diagram of the operating environment of an electronic device provided by the present invention. DETAILED DESCRIPTION

[0017] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0018] A specific embodiment of the present invention discloses a method for automatically adjusting data security policies. Figure 1 ,include: S101. Acquire real-time monitoring data and security policy tuning information, and pre-process the real-time monitoring data.

[0019] S102. Based on a pre-established data analysis model, the pre-processed real-time monitoring data is analyzed to generate security event alarms and risk assessment results.

[0020] S103. Adjust the current security policy based on the security policy tuning information, security event alerts, and risk assessment results.

[0021] The data security policy automatic adjustment method provided by the present invention can adjust the current security policy based on security policy tuning information, security event alarms and risk assessment results, realize comprehensive monitoring, analysis, adjustment and optimization of cloud environment security, and can adapt to rapidly changing security threats and regulatory requirements, providing enterprises with an efficient, intelligent and compliant cloud data security management solution.

[0022] In some embodiments, real-time monitoring data can be collected from the cloud environment in real time, such as user access records, network traffic information, and system logs, by connecting to a data collection device set up on site.

[0023] In some embodiments, the method for obtaining security policy tuning information is: associating with an external policy database, and outputting security policy tuning information according to the update of the security policy configuration file in the policy database. The security policy configuration file specifically includes the newly promulgated national security-related laws, regulations, policy documents, major system disaster recovery plans, backup data, system operation logs and other information.

[0024] See also Figure 2 In some embodiments, the training method of the data analysis model is: S201. Obtain historical monitoring data, and generate a training set based on the historical monitoring data.

[0025] S202: Establish an initial model and use historical monitoring data to train the initial model to obtain a fully trained data analysis model.

[0026] In some embodiments, the data analysis model may be a convolutional neural network model or a recursive neural network model.

[0027] See also Figure 3 In some embodiments, step S102 specifically includes: S301: Input the pre-processed real-time monitoring data into a data analysis model to identify abnormal data in the real-time monitoring data.

[0028] S302: Compare the abnormal data with a preset risk threshold to generate a security event alarm and a risk assessment result.

[0029] In some embodiments, specific security policy adjustments include formulating or updating firewall rule sets, intrusion detection system parameters, and access control lists.

[0030] In some embodiments, abnormal data includes user behavior data, security attack behavior, potential security risks, etc. Abnormal data can also be used to optimize the data analysis model. The specific method is: change the execution strategy of the data analysis model according to the security policy tuning information, and then import the abnormal data in the real-time monitoring data into the data analysis model for scenario simulation training to self-optimize the data analysis model.

[0031] Based on the above data security policy automatic adjustment method, the embodiment of the present invention also provides a data security policy automatic adjustment device, see Figure 4 ,include The data acquisition unit 400 is used to acquire real-time monitoring data and security policy tuning information, and pre-process the real-time monitoring data.

[0032] The risk assessment unit 500 is used to analyze the pre-processed real-time monitoring data based on a pre-established data analysis model to generate security event alarms and risk assessment results.

[0033] The policy adjustment unit 600 is used to adjust the current security policy based on the security policy tuning information, security event alarms and risk assessment results.

[0034] In some embodiments, the data acquisition unit 400 includes a data acquisition module 410 and a policy database module 420. The data acquisition module 410 is used to acquire real-time monitoring data, and the policy database module 420 is used to associate with the external policy database 700 to provide security policy tuning information.

[0035] The risk assessment unit 500 includes a data analysis module 510, a monitoring feedback module 520, and a training data module 530. The data analysis model pre-established in the data analysis module 510 can analyze the pre-processed real-time monitoring data to generate security event alarms and risk assessment results. The monitoring feedback module 520 is used to identify abnormal data from the monitoring data and transmit it back to the data analysis module 510. The data analysis module 510 transmits the abnormal data to the training data module 530 for scenario simulation training and self-optimizes the data analysis model.

[0036] The policy adjustment unit 600 includes a security policy adjustment module 610. As the execution layer of the system, the security policy adjustment module 610 adjusts the current security policy according to the security policy tuning information, security event alarms and risk assessment results, generates a new security adjustment policy and pushes it to the corresponding security components in the cloud environment to perform policy changes and optimizations.

[0037] Specifically, in some embodiments, the data collection module 410 serves as the perception layer of the system, collects key data such as user access records, network traffic information, and system logs from the cloud environment in real time, and provides raw data input.

[0038] The policy database module 420 obtains information on security-related laws and regulations by connecting to an external policy database 700, such as a compliance check device 710 and a disaster recovery drill device 720, and refreshes security policy configuration files in real time, performs compliance checks on national security-related laws and regulations, and provides security policy tuning suggestions for disaster recovery drills.

[0039] The two key components of high availability and scalability, the compliance check device 710 and the disaster recovery drill device 720, support the storage and rapid retrieval of large-scale data, and optimize the machine learning model by regularly collecting and classifying and marking the data in the cloud environment. It records the history of security policies, compliance operation logs, and detailed logs of disaster recovery operations, and uses redundant storage and failover technology to ensure data reliability. It also provides powerful data retrieval capabilities to accelerate troubleshooting and security analysis, ensure the efficiency and reliability of the entire system in data-driven security operations, and integrate with existing IT management tools and cloud service platforms through APIs to automate security management tasks, making it easy to expand to meet the needs of cloud services of different scales.

[0040] The data analysis module 510 involves data processing steps such as data reception, data cleaning, and data preprocessing. It has machine learning models such as convolutional neural networks or recursive neural networks. It mines potential security threats from complex network traffic and system logs through deep learning algorithms, extracts and analyzes features, compares the discovered abnormal data with the risk threshold, generates security event alerts and risk assessment results, and transmits them to the security policy adjustment module 610. At the same time, the behavior analysis model is used to learn user behavior patterns, and the new risk data identified in the monitoring feedback results sent back from the monitoring feedback module 520 is fed back to the training data module 530, and scenario simulation training is automatically performed to optimize and improve the data analysis model.

[0041] The monitoring feedback module 520 is used to monitor the security status and performance indicators of the cloud environment in real time, collect real-time data related to the cloud environment security, and compare the collected real-time data with the performance baseline preset in the data analysis module 510 to evaluate the effectiveness of the current security policy and system performance. For the detected abnormal behavior, detailed monitoring feedback results are generated and sent back to the data analysis module 510. At the same time, based on the feedback data and the analysis results of the abnormal behavior, suggestions for adjusting the security policy are provided to the security policy adjustment module 510.

[0042] The training data module 530 is used to perform scenario simulation training optimization and improve the data analysis model through historical safety data information.

[0043] The security policy adjustment module 610 obtains information such as security event alarms and risk assessment results from the data analysis module 510, determines the security threat level faced by the current cloud environment, formulates or updates security parameters such as firewall rule sets, intrusion detection system parameters, and access control lists, and automatically generates or updates security policies. At the same time, according to the security policy tuning information output by the policy database module 420, a new security adjustment policy is generated and pushed to the corresponding security components in the cloud environment to perform policy changes and optimizations.

[0044] See also Figure 5 Based on the above data security policy automatic adjustment method, the present invention also provides an electronic device, which can be a computing electronic device such as a mobile terminal, a desktop computer, a notebook, a palm computer, and a server. The electronic device includes a processor 810, a memory 820, and a display 830. Figure 5 Only some components of the electronic device are shown, but it should be understood that it is not required to implement all of the components shown, and more or fewer components may be implemented instead.

[0045] In some embodiments, the processor 810 may be a central processing unit (CPU), a microprocessor or other data processing chip, used to run program codes stored in the memory 820 or process data, such as executing a data security policy automatic adjustment method.

[0046] In some embodiments, the memory 820 may be an internal storage unit of the electronic device, such as a hard disk or memory of the electronic device. In other embodiments, the memory 820 may also be an external storage electronic device of the electronic device, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (SecureDigital, SD) card, a flash card (Flash Card), etc. equipped on the electronic device. Further, the memory 820 may also include both an internal storage unit of the electronic device and an external storage electronic device. The memory 820 is used to store application software and various types of data installed in the electronic device, such as program codes installed in the electronic device. The memory 820 may also be used to temporarily store data that has been output or is to be output. In one embodiment, the data security policy automatic adjustment program 840 is on the memory 820, and the data security policy automatic adjustment program 840 can be executed by the processor 810, thereby realizing the data security policy automatic adjustment method of each embodiment of the present application.

[0047] In some embodiments, the display 830 may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, an OLED (Organic Light-Emitting Diode) touch device, etc. The display 830 provides an interactive interface for the system administrator to display the security posture of the system, compliance information, and the workflow for approving or modifying security policy changes. The components 810-830 of the electronic device communicate with each other through the system bus.

[0048] In a preferred embodiment, it also includes a data acquisition device set up on site, and the data acquisition device includes a network sniffer and a log analysis tool deployed and integrated on the cloud platform.

[0049] Those skilled in the art will appreciate that all or part of the processes of the above-mentioned embodiments can be implemented by instructing related hardware through a computer program, and the program can be stored in a computer-readable storage medium, wherein the computer-readable storage medium is a disk, an optical disk, a read-only storage memory, or a random access memory, etc.

[0050] In practice, a dedicated computer room is configured in the core area of ​​the cloud platform to deploy the core components of this data security policy automatic adjustment system. The internal layout of the computer room is as follows: The data collection device is deployed at the key nodes of the cloud network. It is responsible for capturing raw data such as network traffic, user behavior and system logs in real time, and transmitting them to the data security policy automatic adjustment device of the data processing center through a high-speed network interface.

[0051] The data acquisition module 410 serves as the data input layer of the system, receives data from the data acquisition device, performs preliminary cleaning, verification and formatting to ensure the quality and consistency of the data, and provides standardized input for subsequent analysis.

[0052] At least two management and control system servers are installed with system server software to carry key functions such as business logic processing, data storage, and communication with the data acquisition module 410 and other modules. Hot standby is achieved between servers through high-availability cluster technology to ensure the stability and reliability of the system.

[0053] Deployment in the control center: Equipped with high-performance graphics workstations, installed with client software, including fixed or mobile monitors, providing an intuitive user interface that enables administrators to perform complex interactive operations, monitor security status in real time, view warning information, and adjust policies.

[0054] Administrators are equipped with customized mobile terminals installed with mobile terminal APP software, which support remote access to the system and realize mobile approval of security policies and emergency response.

[0055] Each department office configures corresponding user interface modules and mobile terminals according to business needs to implement customized security policy management and improve cross-departmental collaboration efficiency.

[0056] Key node settings: Data center area: deploy core data processing modules, including data collection module 410, data analysis module 510, monitoring feedback module 520, etc., which constitute the brain of cloud environment security protection.

[0057] Network edge nodes: deploy auxiliary data collection devices to enhance the comprehensiveness and real-time nature of data and improve the breadth and depth of security monitoring.

[0058] In one embodiment, the data collection and monitoring feedback process is as follows: The data acquisition device uses advanced data capture technology to monitor the data flow in the cloud environment in real time and capture key network traffic and system operation logs.

[0059] The data collection module 410 receives the data stream from the data collection device, and performs data cleaning, deduplication and formatting through an efficient data preprocessing algorithm to ensure the accuracy and availability of the data.

[0060] The monitoring feedback module 520 performs 24 / 7 uninterrupted security monitoring of the cloud platform, collects security performance indicators in real time, such as network traffic anomalies, user behavior deviations, etc., and feeds this information back to the data analysis module 510.

[0061] The data analysis and security policy adjustment process is as follows: The data analysis module 510 uses advanced machine learning algorithms, such as convolutional neural networks (CNN) and recurrent neural networks (RNN), to conduct in-depth analysis of the processed data and identify potential security threats and abnormal behavior patterns.

[0062] The security policy adjustment module 610 dynamically adjusts the security policy based on the insights provided by the data analysis module 510, such as updating the firewall rule set (FRS), intrusion detection system parameters (IPSP) and access control list (ACL) in real time to respond to changing security threats.

[0063] The training and strategy optimization process is as follows: The training data module 530 uses historical security event data to continuously train and optimize the data analysis module 510 to improve its ability and accuracy in identifying emerging threats.

[0064] The policy database module 420 synchronizes the latest security-related laws, regulations and policy documents in real time, and provides compliance support and policy tuning suggestions for the security policy adjustment module 610 through intelligent association and analysis.

[0065] The process of user interface display and mobile terminal linkage is as follows: Monitor 830 uses a high-resolution display screen to dynamically display the security situation map of the cloud environment, including key information such as security event distribution, risk assessment and trend prediction, to provide decision support for administrators.

[0066] The mobile terminal is connected to the display 830 through a secure wireless network, so that the administrator can receive security policy adjustment information in a mobile state and respond to security events in real time.

[0067] The exception handling and emergency response process is as follows: When the monitoring feedback module 520 detects abnormal behavior or security incidents, the system automatically triggers the emergency plan generation process, and quickly formulates a response strategy by intelligently analyzing the nature and level of the current threat.

[0068] The security policy adjustment module 610 quickly adjusts the security policy according to the emergency plan, such as enabling a backup firewall rule set and isolating the infected network area to curb the spread of the threat.

[0069] Display 830 and mobile terminals display emergency response information in real time, provide clear operation guidelines and steps, and guide administrators and operators to take corresponding measures to minimize the impact of safety incidents.

[0070] Through this series of refined and automated processes, this data security policy automatic adjustment system can not only realize comprehensive monitoring, analysis, adjustment and optimization of cloud environment security, but also adapt to rapidly changing security threats and regulatory requirements, providing enterprises with an efficient, intelligent and compliant cloud data security management solution.

[0071] The above specific implementations of the present invention do not constitute a limitation on the protection scope of the present invention. Any other corresponding changes and modifications made based on the technical concept of the present invention should be included in the protection scope of the claims of the present invention.

Claims

1. A method for automatically adjusting a data security policy, characterized in that: The steps include: Obtain real-time monitoring data and security policy tuning information, and pre-process the real-time monitoring data; Based on the pre-established data analysis model, the pre-processed real-time monitoring data is analyzed to generate security event alerts and risk assessment results; Adjust the current security policy based on security policy tuning information, security event alerts and risk assessment results.

2. The method for automatically adjusting data security policies according to claim 1, characterized in that: The training method of the data analysis model is: Obtain historical monitoring data and generate a training set based on the historical monitoring data; Establish an initial model and use historical monitoring data to train the initial model to obtain a fully trained data analysis model.

3. The method for automatically adjusting data security policies according to claim 1, characterized in that: Based on the pre-established data analysis model, the pre-processed real-time monitoring data is analyzed to generate security event alerts and risk assessment results, including: Input the preprocessed real-time monitoring data into the data analysis model to identify abnormal data in the real-time monitoring data; Compare abnormal data with preset risk thresholds to generate security incident alerts and risk assessment results.

4. The method for automatically adjusting data security policies according to claim 1, characterized in that: The data analysis model is a convolutional neural network model or a recurrent neural network model.

5. The method for automatically adjusting data security policies according to claim 1, characterized in that: The method for obtaining security policy tuning information is as follows: Associated with the external policy database, output security policy tuning information based on updates to the security policy configuration files in the policy database.

6. The method for automatically adjusting data security policies according to claim 1, characterized in that: The optimization method of the data analysis model is: change the execution strategy of the data analysis model according to the security policy tuning information, and then import the abnormal data in the real-time monitoring data into the data analysis model for scenario simulation training to self-optimize the data analysis model.

7. The method for automatically adjusting data security policies according to claim 1, characterized in that: Security policies include developing or updating firewall rule sets, intrusion detection system parameters, and access control lists.

8. A data security policy automatic adjustment device, characterized in that: The method is used to implement the steps in the method for automatically adjusting the data security policy as described in any one of claims 1 to 7, including: A data acquisition unit is used to acquire real-time monitoring data and security policy tuning information, and to pre-process the real-time monitoring data; A risk assessment unit, which is used to analyze the pre-processed real-time monitoring data based on a pre-established data analysis model to generate security event alarms and risk assessment results; The policy adjustment unit is used to adjust the current security policy based on security policy tuning information, security event alarms and risk assessment results.

9. An electronic device, characterized in that: include: Processor and memory; The memory stores a computer program executable by the processor; When the processor executes the computer program, the steps in the method for automatically adjusting the data security policy as described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium, characterized in that: include: Processor and memory; The memory stores a computer program executable by the processor; When the processor executes the computer program, the steps in the method for automatically adjusting the data security policy as described in any one of claims 1 to 7 are implemented.

Images