Computer information security assessment method and system based on big data

Abstract

The invention discloses a computer information security assessment method and system based on big data. The method comprises the steps of data acquisition, data preprocessing, computer information security assessment model construction, model parameter tuning and computer information security real-time assessment. The invention belongs to the technical field of security assessment, and particularly relates to a computer information security assessment method and system based on big data, and the method comprises the steps: determining features through information gain, constructing a random sample subset through a bootstrap method, selecting a first basic classifier based on classification precision, and selecting second to B basic classifiers based on an AdaBoost algorithm and importance. Combining the selected basic classifiers based on weights; a cosine function is used to generate a mapping function to initialize a position, an elite individual and a common individual are divided based on a dynamic elite selection factor, the positions are updated respectively, optimal parameters are found to complete tuning, the robustness and adaptability of the model are enhanced, and the reliability and accuracy of evaluation are improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of security assessment, and specifically refers to a computer information security assessment method and system based on big data. Background Art

[0002] The computer information security assessment method is to analyze and process computer information data through big data technology, evaluate the information security status of computer systems, and provide intuitive information for security managers so that targeted measures can be taken in a timely manner to effectively improve the security and stability of computer information systems. However, the existing computer information security assessment methods have problems such as complex computer information, large data volume and unbalanced samples, which lead to reduced model performance, slower processing speed and reduced accuracy of security assessment; the existing computer information security assessment methods have problems such as rapid changes in network environment and continuous updates of security threats, which lead to inaccurate or delayed assessments. Summary of the invention

[0003] In view of the above situation, in order to overcome the defects of the prior art, the present invention provides a computer information security assessment method and system based on big data. In view of the problems that the existing computer information security assessment method has complex computer information, large data volume and unbalanced samples, which lead to the decline of model performance, slow processing speed and reduced accuracy of security assessment, the scheme uses information gain to determine features, uses the bootstrap method to construct a random sample subset, selects the first basic classifier based on classification accuracy, selects the second to B basic classifiers based on the AdaBoost algorithm and importance, and combines the basic classifiers selected by B training based on weights to obtain a computer information security assessment model. The feature selection method increases the diversity and representativeness of the samples, and obtains a more accurate and comprehensive assessment model through a unique selection and combination method, which better handles the model training. The unbalanced sample problem in training can be solved to improve the reliability and accuracy of the evaluation; in view of the problem that the network environment is rapidly changing and the security threats are constantly updated in the existing computer information security assessment methods, which leads to inaccurate or delayed evaluation, this scheme uses the cosine function to generate the mapping function to initialize the individual position, selects a certain proportion of elite individuals and ordinary individuals based on the dynamic elite selection factor, and updates the positions respectively to find the optimal parameters to complete the tuning. In the iterative process, the number of elite individuals is adjusted according to the current fitness, which can adapt to different search stages. The different update strategies of elite individuals and ordinary individuals by the swarm intelligence algorithm are used to better balance the local search and the global search, which can adapt to the ever-changing network environment and security threats, enhance the robustness and adaptability of the model, and significantly improve the accuracy and stability of the computer information security assessment model.

[0004] The technical solution adopted by the present invention is as follows: The computer information security assessment method based on big data provided by the present invention comprises the following steps:

[0005] Step S1: data collection;

[0006] Step S2: data preprocessing;

[0007] Step S3: construct a computer information security assessment model;

[0008] Step S4: model parameter tuning;

[0009] Step S5: Real-time assessment of computer information security.

[0010] Furthermore, in step S1, the data collection is to collect historical computer information data, and the historical computer information data includes network traffic data, system logs, user behavior data, system configuration data, equipment alarm data and security assessment levels. The security assessment levels include high security level, medium security level and low security level, and the risk assessment level is used as a data label.

[0011] Furthermore, in step S2, the data preprocessing is to perform data cleaning, data conversion, data normalization and data set construction on the collected data; data cleaning includes processing missing values, outliers and duplicate values; data conversion is to convert the data into vector form; data normalization is to unify the data range based on the maximum and minimum normalization method; and data set construction is to construct a training sample set and a test sample set based on the processed data.

[0012] Furthermore, in step S3, the construction of the computer information security assessment model specifically includes the following steps:

[0013] Step S31: generating a random sample subset, including the following steps:

[0014] Step S311: Calculate the information entropy of the training sample set and the information gain of each feature. The formula used is as follows:

[0015] ;

[0016] ;

[0017] In the formula, and They are the training sample set L and the sample set L r The information entropy of , q is the category index, Q is the total number of categories, p q is the proportion of the qth class samples in the training sample set L, is the information gain of feature a on the training sample set L, is the feature index, R is the number of different values ​​of feature a in the training sample set L, r is the value index of feature a in the training sample set L, Lr is the set of samples where feature a takes the value r in the training sample set L, |L| and |L r | are the training sample set L and the sample set L r The number of samples in ;

[0018] Step S312: Construct a random sample subset and pre-set the partition threshold Gain div and the number of random sample subsets F, a fixed feature set is constructed based on features whose information gain is greater than the partition threshold, and a selection feature set is constructed based on the remaining features; F sampling feature sets are extracted from the selection feature set using the bootstrap method, and the fixed feature set and the F sampling feature sets are respectively combined to obtain F random feature sets, and then combined with the training sample set L to obtain F random sample subsets, where the samples in each random sample subset only contain the features in the corresponding random feature set;

[0019] Step S32: training the basic classifier, presetting the maximum number of training times B, and F ≥ B, including the following steps:

[0020] Step S321: Determine the basic classifier for the first training, initialize the usage status of F random sample subsets to 0, and initialize the weight of each sample to , F random sample subsets are trained based on the support vector machine to obtain F pending classifiers, and the classification accuracy of each pending classifier is calculated. The pending classifier with the largest classification accuracy is used as the basic classifier E1 selected for the first training, and the use status of the random sample subset used for the basic classifier training is changed to 1. The formula used to calculate the classification accuracy is as follows:

[0021] ;

[0022] In the formula, is the classification accuracy of the fth undetermined classifier during the first training, f is the undetermined classifier index, k is the sample index, and y k and are the true label of the k-th sample and the label output by the f-th pending classifier; is the indicator function, when When , the function value is 1, otherwise the function value is 0;

[0023] Step S322: Determine the basic classifiers for the second to B trainings, including the following steps:

[0024] Step S3221: Update the sample weights. Input the random sample subset with the usage status of 0 into the basic classifier selected in the last training for classification. Based on the classification results, use the ensemble learning AdaBoost algorithm to update the sample weights. The formula used is as follows:

[0025] ;

[0026] ;

[0027] ;

[0028] In the formula, and are the kth sample x during the bth and b-1th training respectively. k The weight, α b-1 and ε b-1 are the weight and error rate of the basic classifier selected for the b-1th training, b is the training number index, is the output label of the kth sample by the basic classifier selected in the b-1th training; is the indicator function, when When , the function value is 1, otherwise the function value is 0;

[0029] Step S3222: Select a basic classifier, and train the random sample subsets with the usage status of 0 based on the support vector machine according to the weight of the current sample, and obtain F-b+1 undetermined classifiers, calculate the importance of each undetermined classifier, and use the undetermined classifier with the greatest importance as the basic classifier E selected for the b-th training. b , and change the usage status of the random sample subset used for training the basic classifier to 1. The formula used to calculate the importance is as follows:

[0030] ;

[0031] In the formula, is the importance of the fth undetermined classifier in the bth training, β1 and β2 are the classification accuracy weight and diversity weight respectively, is the classification accuracy of the fth pending classifier during the bth training, c is the index of the pending classifier, is the number of different classifications produced by the cth and fth candidate classifiers on the same sample;

[0032] Step S33: Combining, combining the basic classifiers selected from the B trainings based on weights to obtain a computer information security assessment model D, the formula used is as follows:

[0033] ;

[0034] In the formula, α b is the weight of the basic classifier selected for the b-th training.

[0035] Furthermore, in step S4, the model parameter tuning specifically includes the following steps:

[0036] Step S41: Initialization, the division threshold Gain in the computer information security assessment model div , classification accuracy weight β1 and diversity weight β2 to establish a parameter search space, initialize M individual positions in the parameter search space, use individual positions as representatives of computer information security assessment model parameters, and use the exponential loss function of the computer information security assessment model trained based on individual positions for the test sample set as the individual fitness value; generate a mapping function based on the cosine function , multiply by i and take the decimal part Initialize the individual position using the following formula:

[0037] ;

[0038] In the formula, is the initialization position of the jth dimension of the ith individual, i and j are the individual index and the dimension index of the parameter search space, respectively. j and lb j are the upper and lower limits of the jth dimension of the parameter search space, O is the total number of dimensions of the parameter search space, and d is the smallest prime number greater than 2O+3;

[0039] Step S42: Divide the individuals, calculate the fitness values ​​of the individuals, arrange the M individuals in ascending order according to the fitness values, and take the top individuals are elite individuals, and the remaining Each individual is treated as a normal individual, and the formula used is as follows:

[0040] ;

[0041] In the formula, is the dynamic elite selection factor at the tth iteration, and are the initial value and minimum value of the dynamic elite selection factor, t is the iteration number index, is the floor rounding function, γ is the adjustment factor, and γ is used to control the decay speed;

[0042] Step S43: position update, using the swarm intelligence algorithm to update the positions of elite individuals and ordinary individuals respectively, including the following steps:

[0043] Step S431: Update the position of elite individuals. The formula used is as follows:

[0044] ;

[0045] In the formula, is the position of the vth elite individual in the jth dimension at the t+1th iteration, v is the elite individual index, is the position of the global optimal individual in the jth dimension at the tth iteration. The global optimal individual is the individual with the minimum fitness value. T is the maximum number of iterations. z is a random number in the range [0, 1].

[0046] Step S432: Ordinary individual position update, the formula used is as follows:

[0047] ;

[0048] In the formula, and are the positions of the wth common individual in the jth dimension at the t+1th and tth iterations, respectively, where w is the common individual index;

[0049] Step S44: Determine the optimal parameters, pre-set the fitness threshold, and update the individual fitness value. When the fitness value of the global optimal individual is lower than the fitness threshold, the position of the global optimal individual corresponds to the optimal parameter, and the model parameter tuning is completed; otherwise, if the maximum number of iterations is reached, go to step S41 to reinitialize; otherwise, add 1 to the number of iterations and go to step S42 to re-divide the individuals.

[0050] Furthermore, in step S5, the real-time assessment of computer information security is to collect real-time computer information data, wherein the real-time computer information data includes network traffic data, system logs, user behavior data, system configuration data and equipment alarm data; the real-time computer information data is input into a computer information security assessment model constructed based on optimal parameters for classification to obtain the security level of the current computer information.

[0051] The computer information security assessment system based on big data provided by the present invention comprises a data acquisition module, a data preprocessing module, a computer information security assessment model building module, a model parameter tuning module and a computer information security real-time assessment module;

[0052] The data acquisition module acquires historical computer information data and sends the data to the data preprocessing module;

[0053] The data preprocessing module performs data cleaning, data conversion, data normalization and data set construction on the collected data, and sends the data to the computer information security assessment model construction module;

[0054] The computer information security assessment model building module uses information gain to determine features, uses a bootstrap method to build a random sample subset, selects a first basic classifier based on classification accuracy, selects a second to B basic classifiers based on the AdaBoost algorithm and importance, combines the basic classifiers selected by B trainings based on weights to obtain a computer information security assessment model, and sends the data to a model parameter tuning module;

[0055] The model parameter tuning module uses a cosine function to generate a mapping function to initialize individual positions, selects a certain proportion of elite individuals and ordinary individuals based on a dynamic elite selection factor, updates their positions respectively, finds the optimal parameters to complete the tuning, and sends the data to the computer information security real-time assessment module;

[0056] The computer information security real-time assessment module inputs real-time computer information data into a computer information security assessment model constructed based on optimal parameters for classification, thereby obtaining the security level of the current computer information.

[0057] The beneficial effects achieved by the present invention using the above scheme are as follows:

[0058] (1) In view of the problems of existing computer information security assessment methods, such as complex computer information, large data volume and unbalanced samples, which lead to decreased model performance, slow processing speed and decreased accuracy of security assessment, this scheme uses information gain to determine features, uses the bootstrap method to construct random sample subsets, innovatively combines fixed feature sets and sampling feature sets, selects the first basic classifier based on classification accuracy, selects the second to B basic classifiers based on the AdaBoost algorithm and importance, and combines the basic classifiers selected from B training times based on weights to obtain a computer information security assessment model. The feature selection method increases the diversity and representativeness of the samples, improves the learning efficiency and prediction accuracy of the model, and obtains a more accurate and comprehensive assessment model through a unique selection and combination method, which better handles the problem of unbalanced samples in model training and improves the reliability and accuracy of the assessment.

[0059] (2) In view of the problem that the existing computer information security assessment methods have rapid changes in network environment and constantly updated security threats, resulting in inaccurate or delayed assessments, this scheme uses the cosine function to generate a mapping function to initialize individual positions, selects a certain proportion of elite individuals and ordinary individuals based on the dynamic elite selection factor, and updates their positions respectively to find the optimal parameters to complete the tuning. During the iteration process, the number of elite individuals is adjusted according to the current fitness, which can adapt to different search stages and improve the flexibility of selection. The different update strategies for elite individuals and ordinary individuals using swarm intelligence algorithms retain the opportunity for exploration while converging, thereby better balancing local search and global search, being able to adapt to the ever-changing network environment and security threats, enhancing the robustness and adaptability of the model, and significantly improving the accuracy and stability of the computer information security assessment model. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Figure 1 A flowchart of a computer information security assessment method based on big data provided by the present invention;

[0061] Figure 2 A schematic diagram of a computer information security assessment system based on big data provided by the present invention;

[0062] Figure 3 is a schematic flow chart of step S3;

[0063] Figure 4 It is a schematic diagram of the process of step S4.

[0064] The accompanying drawings are used to provide further understanding of the present invention and constitute a part of the specification. They are used to explain the present invention together with the embodiments of the present invention and do not constitute a limitation of the present invention. DETAILED DESCRIPTION

[0065] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments; based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0066] In the description of the present invention, it should be understood that terms such as “upper”, “lower”, “front”, “back”, “left”, “right”, “top”, “bottom”, “inside” and “outside” indicating directions or positional relationships are based on the directions or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific direction, be constructed and operated in a specific direction, and therefore should not be understood as limiting the present invention.

[0067] Example 1, see Figure 1 The present invention provides a computer information security assessment method based on big data, which comprises the following steps:

[0068] Step S1: data collection, collecting historical computer information data;

[0069] Step S2: Data preprocessing, data cleaning, data conversion, data normalization and data set construction for the collected data;

[0070] Step S3: construct a computer information security assessment model, determine features using information gain, construct a random sample subset using the bootstrap method, select the first basic classifier based on classification accuracy, select the second to B basic classifiers based on the AdaBoost algorithm and importance, and combine the basic classifiers selected from B trainings based on weights to obtain a computer information security assessment model;

[0071] Step S4: Model parameter tuning, using the cosine function to generate a mapping function to initialize individual positions, selecting a certain proportion of elite individuals and ordinary individuals based on the dynamic elite selection factor, and updating their positions respectively to find the optimal parameters to complete the tuning;

[0072] Step S5: Real-time assessment of computer information security, inputting real-time computer information data into a computer information security assessment model constructed based on optimal parameters for classification, and obtaining the security level of the current computer information.

[0073] Example 2, see Figure 1 This embodiment is based on the above embodiment. In step S1, the historical computer information data includes network traffic data, system logs, user behavior data, system configuration data, device alarm data and security assessment levels. The security assessment levels include high security level, medium security level and low security level. The risk assessment level is used as a data label.

[0074] Example 3, see Figure 1 This embodiment is based on the above embodiment. In step S2, data cleaning includes processing missing values, outliers and duplicate values; data conversion is to convert data into vector form; data normalization is to unify the data range based on the maximum and minimum normalization method; and constructing a data set is to construct a training sample set and a test sample set based on the processed data.

[0075] Example 4, see Figure 1 and Figure 3 Based on the above embodiment, in step S3, building a computer information security assessment model specifically includes the following steps:

[0076] Step S31: generating a random sample subset, including the following steps:

[0077] Step S311: Calculate the information entropy of the training sample set and the information gain of each feature. The formula used is as follows:

[0078] ;

[0079] ;

[0080] In the formula, and They are the training sample set L and the sample set L r The information entropy of , q is the category index, Q is the total number of categories, p q is the proportion of the qth class samples in the training sample set L, is the information gain of feature a on the training sample set L, is the feature index, R is the number of different values ​​of feature a in the training sample set L, r is the value index of feature a in the training sample set L, L r is the set of samples where feature a takes the value r in the training sample set L, |L| and |L r | are the training sample set L and the sample set L r The number of samples in ;

[0081] Step S312: Construct a random sample subset and pre-set the partition threshold Gain div and the number of random sample subsets F, a fixed feature set is constructed based on features whose information gain is greater than the partition threshold, and a selection feature set is constructed based on the remaining features; F sampling feature sets are extracted from the selection feature set using the bootstrap method, and the fixed feature set and the F sampling feature sets are respectively combined to obtain F random feature sets, and then combined with the training sample set L to obtain F random sample subsets, where the samples in each random sample subset only contain the features in the corresponding random feature set;

[0082] Step S32: training the basic classifier, presetting the maximum number of training times B, and F ≥ B, including the following steps:

[0083] Step S321: Determine the basic classifier for the first training, initialize the usage status of F random sample subsets to 0, and initialize the weight of each sample to , F random sample subsets are trained based on the support vector machine to obtain F pending classifiers, and the classification accuracy of each pending classifier is calculated. The pending classifier with the largest classification accuracy is used as the basic classifier E1 selected for the first training, and the use status of the random sample subset used for the basic classifier training is changed to 1. The formula used to calculate the classification accuracy is as follows:

[0084] ;

[0085] In the formula, is the classification accuracy of the fth undetermined classifier during the first training, f is the undetermined classifier index, k is the sample index, and y k and are the true label of the k-th sample and the label output by the f-th pending classifier; is the indicator function, when When , the function value is 1, otherwise the function value is 0;

[0086] Step S322: Determine the basic classifiers for the second to B trainings, including the following steps:

[0087] Step S3221: Update the sample weights. Input the random sample subset with the usage status of 0 into the basic classifier selected in the last training for classification. Based on the classification results, use the ensemble learning AdaBoost algorithm to update the sample weights. The formula used is as follows:

[0088] ;

[0089] ;

[0090] ;

[0091] In the formula, and are the kth sample x during the bth and b-1th training respectively. k The weight, α b-1 and ε b-1 are the weight and error rate of the basic classifier selected for the b-1th training, b is the training number index, is the output label of the kth sample by the basic classifier selected in the b-1th training; is the indicator function, when When , the function value is 1, otherwise the function value is 0;

[0092] Step S3222: Select a basic classifier, and train the random sample subsets with the usage status of 0 based on the support vector machine according to the weight of the current sample, and obtain F-b+1 undetermined classifiers, calculate the importance of each undetermined classifier, and use the undetermined classifier with the greatest importance as the basic classifier E selected for the b-th training. b , and change the usage status of the random sample subset used for training the basic classifier to 1. The formula used to calculate the importance is as follows:

[0093] ;

[0094] In the formula, is the importance of the fth undetermined classifier in the bth training, β1 and β2 are the classification accuracy weight and diversity weight respectively, is the classification accuracy of the fth pending classifier during the bth training, c is the index of the pending classifier, is the number of different classifications produced by the cth and fth candidate classifiers on the same sample;

[0095] Step S33: Combining, combining the basic classifiers selected from the B trainings based on weights to obtain a computer information security assessment model D, the formula used is as follows:

[0096] ;

[0097] In the formula, α b is the weight of the basic classifier selected for the b-th training.

[0098] By performing the above operations, in view of the problems of existing computer information security assessment methods, such as complex computer information, large data volume and unbalanced samples, which lead to decreased model performance, slower processing speed and decreased accuracy of security assessment, this scheme uses information gain to determine features, uses the bootstrap method to construct a random sample subset, innovatively combines the fixed feature set and the sampling feature set, selects the first basic classifier based on classification accuracy, selects the second to B basic classifiers based on the AdaBoost algorithm and importance, and combines the basic classifiers selected from B trainings based on weights to obtain a computer information security assessment model. The feature selection method increases the diversity and representativeness of the samples, improves the learning efficiency and prediction accuracy of the model, and obtains a more accurate and comprehensive assessment model through a unique selection and combination method, better handles the problem of unbalanced samples in model training, and improves the reliability and accuracy of the assessment.

[0099] Example 5, see Figure 1 and Figure 4 This embodiment is based on the above embodiment. In step S4, the model parameter tuning specifically includes the following steps:

[0100] Step S41: Initialization, the division threshold Gain in the computer information security assessment model div , classification accuracy weight β1 and diversity weight β2 to establish a parameter search space, initialize M individual positions in the parameter search space, use individual positions as representatives of computer information security assessment model parameters, and use the exponential loss function of the computer information security assessment model trained based on individual positions for the test sample set as the individual fitness value; generate a mapping function based on the cosine function , multiply by i and take the decimal part Initialize the individual position using the following formula:

[0101] ;

[0102] In the formula, is the initialization position of the jth dimension of the ith individual, i and j are the individual index and the dimension index of the parameter search space, respectively. j and lb j are the upper and lower limits of the jth dimension of the parameter search space, O is the total number of dimensions of the parameter search space, and d is the smallest prime number greater than 2O+3;

[0103] Step S42: Divide the individuals, calculate the fitness values ​​of the individuals, arrange the M individuals in ascending order according to the fitness values, and take the top individuals are elite individuals, and the remaining Each individual is treated as a normal individual, and the formula used is as follows:

[0104] ;

[0105] In the formula, is the dynamic elite selection factor at the tth iteration, and are the initial value and minimum value of the dynamic elite selection factor, t is the iteration number index, is the floor rounding function, γ is the adjustment factor, and γ is used to control the decay speed;

[0106] Step S43: position update, using the swarm intelligence algorithm to update the positions of elite individuals and ordinary individuals respectively, including the following steps:

[0107] Step S431: Update the position of elite individuals. The formula used is as follows:

[0108] ;

[0109] In the formula, is the position of the vth elite individual in the jth dimension at the t+1th iteration, v is the elite individual index, is the position of the global optimal individual in the jth dimension at the tth iteration. The global optimal individual is the individual with the minimum fitness value. T is the maximum number of iterations. z is a random number in the range [0, 1].

[0110] Step S432: Ordinary individual position update, the formula used is as follows:

[0111] ;

[0112] In the formula, and are the positions of the wth common individual in the jth dimension at the t+1th and tth iterations, respectively, where w is the common individual index;

[0113] Step S44: Determine the optimal parameters, pre-set the fitness threshold, and update the individual fitness value. When the fitness value of the global optimal individual is lower than the fitness threshold, the position of the global optimal individual corresponds to the optimal parameter, and the model parameter tuning is completed; otherwise, if the maximum number of iterations is reached, go to step S41 to reinitialize; otherwise, add 1 to the number of iterations and go to step S42 to re-divide the individuals.

[0114] By performing the above operations, in order to solve the problem that the network environment is changing rapidly and security threats are constantly updated in the existing computer information security assessment methods, resulting in inaccurate or delayed assessments, this scheme uses a cosine function to generate a mapping function to initialize individual positions, selects a certain proportion of elite individuals and ordinary individuals based on the dynamic elite selection factor, and updates their positions respectively to find the optimal parameters to complete the tuning. In the iterative process, the number of elite individuals is adjusted according to the current fitness, which can adapt to different search stages and improve the flexibility of selection. The different update strategies for elite individuals and ordinary individuals using swarm intelligence algorithms retain the opportunity for exploration while converging, thereby better balancing local search and global search, being able to adapt to the ever-changing network environment and security threats, enhancing the robustness and adaptability of the model, and significantly improving the accuracy and stability of the computer information security assessment model.

[0115] Example 6, see Figure 1 This embodiment is based on the above embodiment. In step S5, the real-time assessment of computer information security is to collect real-time computer information data, wherein the real-time computer information data includes network traffic data, system logs, user behavior data, system configuration data and equipment alarm data; the real-time computer information data is input into a computer information security assessment model constructed based on optimal parameters for classification to obtain the security level of the current computer information.

[0116] Embodiment 7, see Figure 2 , this embodiment is based on the above embodiment, and the computer information security assessment system based on big data provided by the present invention includes a data acquisition module, a data preprocessing module, a computer information security assessment model building module, a model parameter tuning module and a computer information security real-time assessment module;

[0117] The data acquisition module acquires historical computer information data and sends the data to the data preprocessing module;

[0118] The data preprocessing module performs data cleaning, data conversion, data normalization and data set construction on the collected data, and sends the data to the computer information security assessment model construction module;

[0119] The computer information security assessment model building module uses information gain to determine features, uses a bootstrap method to build a random sample subset, selects a first basic classifier based on classification accuracy, selects a second to B basic classifiers based on the AdaBoost algorithm and importance, combines the basic classifiers selected by B trainings based on weights to obtain a computer information security assessment model, and sends the data to a model parameter tuning module;

[0120] The model parameter tuning module uses a cosine function to generate a mapping function to initialize individual positions, selects a certain proportion of elite individuals and ordinary individuals based on a dynamic elite selection factor, updates their positions respectively, finds the optimal parameters to complete the tuning, and sends the data to the computer information security real-time assessment module;

[0121] The computer information security real-time assessment module inputs real-time computer information data into a computer information security assessment model constructed based on optimal parameters for classification, thereby obtaining the security level of the current computer information.

[0122] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0123] While the embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that many changes, modifications, substitutions and variations can be made to the embodiments without departing from the principles and spirit of the invention.

[0124] The present invention and its embodiments are described above, and such description is not restrictive. The drawings show only one embodiment of the present invention, and the actual structure is not limited thereto. In short, if ordinary technicians in the field are inspired by it, without departing from the purpose of the invention, they can design a structure and embodiment similar to the technical solution without creativity, which should belong to the protection scope of the present invention.

Claims

1. A computer information security assessment method based on big data, characterized by: The method comprises the following steps: Step S1: data collection; Step S2: data preprocessing; Step S3: construct a computer information security assessment model, determine features using information gain, construct a random sample subset using the bootstrap method, select the first basic classifier based on classification accuracy, select the second to B basic classifiers based on the AdaBoost algorithm and importance, and combine the basic classifiers selected from B trainings based on weights to obtain a computer information security assessment model; Step S4: Model parameter tuning, using the cosine function to generate a mapping function to initialize individual positions, selecting a certain proportion of elite individuals and ordinary individuals based on the dynamic elite selection factor, and updating their positions respectively to find the optimal parameters to complete the tuning; Step S5: Real-time assessment of computer information security.

2. The computer information security assessment method based on big data according to claim 1 is characterized in that: In step S3, the construction of the computer information security assessment model specifically includes the following steps: Step S31: Generate a random sample subset; Step S32: training the basic classifier, presetting the maximum number of training times B, and F ≥ B, where F is the number of random sample subsets, including the following steps: Step S321: Determine the basic classifier for the first training, initialize the usage status of F random sample subsets to 0, and initialize the weight of each sample to , F random sample subsets are trained based on the support vector machine to obtain F pending classifiers, and the classification accuracy of each pending classifier is calculated. The pending classifier with the largest classification accuracy is used as the basic classifier E1 selected for the first training, and the use status of the random sample subset used for the basic classifier training is changed to 1. The formula used to calculate the classification accuracy is as follows: ； In the formula, is the classification accuracy of the fth undetermined classifier during the first training, f is the undetermined classifier index, k is the sample index, and y k and are the true label of the kth sample and the label output by the fth pending classifier, respectively, and |L| is the number of samples in the training sample set L; is the indicator function, when When , the function value is 1, otherwise the function value is 0; Step S322: Determine the basic classifiers for the second to B trainings; Step S33: Combining, combining the basic classifiers selected from the B trainings based on weights to obtain a computer information security assessment model D, the formula used is as follows: ； In the formula, α b is the weight of the basic classifier selected for the bth training, b is the training number index, E b It is the basic classifier selected for the b-th training.

3. The computer information security assessment method based on big data according to claim 2 is characterized in that: In step S31, generating a random sample subset specifically includes the following steps: Step S311: Calculate the information entropy of the training sample set and the information gain of each feature. The formula used is as follows: ； ； In the formula, and They are the training sample set L and the sample set L r The information entropy of , q is the category index, Q is the total number of categories, p q is the proportion of the qth class samples in the training sample set L, is the information gain of feature a on the training sample set L, is the feature index, R is the number of different values ​​of feature a in the training sample set L, r is the value index of feature a in the training sample set L, L r is the set of samples where feature a takes the value r in the training sample set L, |L| and |L r | are the training sample set L and the sample set L r The number of samples in ; Step S312: Construct a random sample subset and pre-set the partition threshold Gain div and the number of random sample subsets F, construct a fixed feature set based on the features whose information gain is greater than the partition threshold, and construct a selection feature set based on the remaining features; use the bootstrap method to extract F sampling feature sets from the selection feature set, combine the fixed feature set and the F sampling feature sets to obtain F random feature sets, and then combine them with the training sample set L to obtain F random sample subsets, and the samples in each random sample subset only contain the features in the corresponding random feature set.

4. The computer information security assessment method based on big data according to claim 2 is characterized in that: In step S322, determining the basic classifiers for the second to B trainings specifically includes the following steps: Step S3221: Update the sample weights. Input the random sample subset with the usage status of 0 into the basic classifier selected in the last training for classification. Based on the classification results, use the ensemble learning AdaBoost algorithm to update the sample weights. The formula used is as follows: ； ； ； In the formula, and are the kth sample x during the bth and b-1th training respectively. k The weight, α b-1 and ε b-1 are the weight and error rate of the basic classifier selected for the b-1th training, b is the training number index, is the output label of the kth sample by the basic classifier selected in the b-1th training; is the indicator function, when When , the function value is 1, otherwise the function value is 0; Step S3222: Select a basic classifier, and train the random sample subsets with the usage status of 0 based on the support vector machine according to the weight of the current sample, and obtain F-b+1 undetermined classifiers, calculate the importance of each undetermined classifier, and use the undetermined classifier with the greatest importance as the basic classifier E selected for the b-th training. b , and change the usage status of the random sample subset used for training the basic classifier to 1. The formula used to calculate the importance is as follows: ； In the formula, is the importance of the fth undetermined classifier in the bth training, β1 and β2 are the classification accuracy weight and diversity weight respectively, is the classification accuracy of the fth pending classifier during the bth training, c is the index of the pending classifier, It is the number of different classifications produced by the cth and fth candidate classifiers on the same sample.

5. The computer information security assessment method based on big data according to claim 1 is characterized in that: In step S4, the model parameter tuning specifically includes the following steps: Step S41: Initialization, the division threshold Gain in the computer information security assessment model div , classification accuracy weight β1 and diversity weight β2 to establish a parameter search space, initialize M individual positions in the parameter search space, use individual positions as representatives of computer information security assessment model parameters, and use the exponential loss function of the computer information security assessment model trained based on individual positions for the test sample set as the individual fitness value; generate a mapping function based on the cosine function , multiply by i and take the decimal part Initialize the individual position using the following formula: ； In the formula, is the initialization position of the jth dimension of the ith individual, i and j are the individual index and the dimension index of the parameter search space, respectively. j and lb j are the upper and lower limits of the jth dimension of the parameter search space, O is the total number of dimensions of the parameter search space, and d is the smallest prime number greater than 2O+3; Step S42: Divide the individuals, calculate the fitness values ​​of the individuals, arrange the M individuals in ascending order according to the fitness values, and take the top individuals are elite individuals, and the remaining Each individual is treated as a normal individual, and the formula used is as follows: ； In the formula, is the dynamic elite selection factor at the tth iteration, and are the initial value and minimum value of the dynamic elite selection factor, t is the iteration number index, is the floor rounding function, γ is the adjustment factor, and γ is used to control the decay speed; Step S43: position update, using swarm intelligence algorithm to update the positions of elite individuals and ordinary individuals respectively; Step S44: Determine the optimal parameters, pre-set the fitness threshold, and update the individual fitness value. When the fitness value of the global optimal individual is lower than the fitness threshold, the position of the global optimal individual corresponds to the optimal parameter, and the model parameter tuning is completed; otherwise, if the maximum number of iterations is reached, go to step S41 to reinitialize; otherwise, add 1 to the number of iterations and go to step S42 to re-divide the individuals.

6. The computer information security assessment method based on big data according to claim 5 is characterized in that: In step S43, the location update specifically includes the following steps: Step S431: Update the position of elite individuals. The formula used is as follows: ； In the formula, is the position of the vth elite individual in the jth dimension at the t+1th iteration, v is the elite individual index, is the position of the global optimal individual in the jth dimension at the tth iteration. The global optimal individual is the individual with the minimum fitness value. T is the maximum number of iterations. z is a random number in the range [0, 1]. Step S432: Ordinary individual position update, the formula used is as follows: ； In the formula, and are the positions of the wth common individual in the jth dimension at the t+1th and tth iterations respectively, and w is the common individual index.

7. The computer information security assessment method based on big data according to claim 1 is characterized in that: In step S5, the real-time computer information security assessment is to collect real-time computer information data, and the real-time computer information data includes network flow data, system logs, user behavior data, system configuration data and device alarm data; The real-time computer information data is input into the computer information security assessment model constructed based on the optimal parameters for classification to obtain the security level of the current computer information.

8. The computer information security assessment method based on big data according to claim 1 is characterized in that: In step S1, the data collection is to collect historical computer information data, and the historical computer information data includes network traffic data, system logs, user behavior data, system configuration data, equipment alarm data and security assessment levels. The security assessment levels include high security level, medium security level and low security level, and the risk assessment level is used as a data label.

9. The computer information security assessment method based on big data according to claim 1 is characterized in that: In step S2, the data preprocessing is to perform data cleaning, data conversion, data normalization and data set construction on the collected data; data cleaning includes processing missing values, outliers and duplicate values; Data conversion is to convert data into vector form; data normalization is to unify the data range based on the maximum and minimum normalization method; and data set construction is to construct training sample sets and test sample sets based on the processed data.

10. A computer information security assessment system based on big data, used to implement the computer information security assessment method based on big data as described in any one of claims 1 to 9, characterized in that: It includes data acquisition module, data preprocessing module, computer information security assessment model building module, model parameter tuning module and computer information security real-time assessment module; The data acquisition module acquires historical computer information data and sends the data to the data preprocessing module; The data preprocessing module performs data cleaning, data conversion, data normalization and data set construction on the collected data, and sends the data to the computer information security assessment model construction module; The computer information security assessment model building module uses information gain to determine features, uses a bootstrap method to build a random sample subset, selects a first basic classifier based on classification accuracy, selects a second to B basic classifiers based on the AdaBoost algorithm and importance, combines the basic classifiers selected by B trainings based on weights to obtain a computer information security assessment model, and sends the data to a model parameter tuning module; The model parameter tuning module uses a cosine function to generate a mapping function to initialize individual positions, selects a certain proportion of elite individuals and ordinary individuals based on a dynamic elite selection factor, updates their positions respectively, finds the optimal parameters to complete the tuning, and sends the data to the computer information security real-time assessment module; The computer information security real-time assessment module inputs real-time computer information data into a computer information security assessment model constructed based on optimal parameters for classification, thereby obtaining the security level of the current computer information.

Images