Method and system for identifying and analyzing power sensitive data

Abstract

The invention discloses a power sensitive data identification analysis method and system, and relates to the technical field of power data security analysis, and the method comprises the steps: collecting cross-domain data packets in real time, carrying out the preprocessing, extracting the features of the cross-domain data packets, and carrying out the preliminary screening; constructing a sensitive data identification formula to identify sensitive data in real time; a comprehensive sensitivity model is constructed to calculate the comprehensive sensitivity of the sensitive data, grading is carried out, and corresponding measures are made; and marking the high-sensitivity cross-domain data packet as an abnormal behavior and generating an abnormal behavior report. A constructed sensitive data identification formula is combined with multi-dimensional features such as data packet size, protocol type, transmission time interval and access frequency, dynamic identification of sensitive data is realized, the accuracy of data packet classification is improved, a sensitivity model is synthesized to evaluate the complexity of data packets through information entropy, and a relation between a transmission rate and a data volume is combined, so that the accuracy of data packet classification is improved. Accurate grading of sensitive data is realized.

Description

Technical Field

[0001] The present invention relates to the technical field of power data security analysis, and in particular to a method and system for identifying and analyzing power sensitive data. Background Art

[0002] As the power system gradually develops towards intelligence and informatization, the transmission and management of power data have become increasingly complex. Data transmission in traditional power systems often relies on closed internal networks, and data security issues are relatively simple. However, with the introduction of technologies such as smart grids and the Internet of Things, data interaction in power systems has gradually expanded to cross-domain networks, and data packets are frequently transmitted between different subsystems, increasing the risk of data leakage, tampering and theft. Current power data monitoring systems usually use rule-based anomaly detection methods to identify potential sensitive data, but such methods are difficult to cope with dynamic cross-domain data packet transmission scenarios and cannot accurately distinguish between sensitive data and ordinary data, resulting in a slow response speed of the system to sensitive data, and may even miss important information. At the same time, with the increase in the amount of data in the power system, traditional data screening and analysis methods are difficult to efficiently process large-scale data streams, which can easily lead to misjudgments and omissions.

[0003] The main shortcomings of the existing technology are its weak ability to handle the real-time and complexity of cross-domain data packets. Most power data monitoring methods rely on static rule settings and are difficult to adapt to the rapidly changing network environment. The existing methods are relatively rough in assessing the sensitivity of data packets and lack a refined analysis of multi-dimensional features, and are unable to effectively measure the potential risks of data packets. The ability to collect and process cross-domain data packets in real time is crucial, especially the ability to dynamically identify, classify and evaluate sensitive data. Traditional systems often ignore important features such as the time characteristics of data packets and the frequency of data transmission, resulting in inaccurate identification of abnormal data packets. These problems make the existing technology have the limitations of low efficiency, poor accuracy and weak adaptability when processing complex sensitive data. Summary of the invention

[0004] In view of the problems existing in the above-mentioned existing power sensitive data identification and analysis methods and systems, the present invention is proposed.

[0005] Therefore, the problem to be solved by the present invention is that traditional systems often ignore important features such as the time characteristics of data packets and the data transmission frequency, resulting in inaccurate identification of abnormal data packets.

[0006] In order to solve the above technical problems, the present invention provides the following technical solutions: a method for identifying and analyzing power sensitive data, comprising:

[0007] Collect cross-domain data packets in real time and perform pre-processing, extract the features of cross-domain data packets for preliminary screening;

[0008] Build sensitive data identification formula to identify sensitive data in real time;

[0009] Construct a comprehensive sensitivity model to calculate the comprehensive sensitivity of sensitive data, classify it into levels, and formulate corresponding measures;

[0010] Mark highly sensitive cross-domain packets as abnormal behaviors and generate abnormal behavior reports.

[0011] As a preferred solution of the power sensitive data identification and analysis method of the present invention, wherein: the real-time collection of cross-domain data packets refers to determining the cross-domain database that needs to be monitored;

[0012] Select data collection tools based on monitoring requirements and install them on monitoring nodes of cross-domain databases;

[0013] Set the parameters of the data collection tool to collect cross-domain data packets in real time;

[0014] The parameters of the data acquisition tool include the network interface for packet capture, filtering conditions and data packet size.

[0015] As a preferred solution of the power-sensitive data identification and analysis method described in the present invention, the preprocessing refers to filtering damaged, blank and repeated cross-domain data packets, using a protocol parsing tool to unify data under different protocols into a standard format, correcting the timestamp through the network time protocol, and using median interpolation to process missing fields in cross-domain data packets.

[0016] As a preferred solution of the power sensitive data identification and analysis method of the present invention, wherein: the extracting the features of the cross-domain data packets for preliminary screening refers to using deep packet inspection technology to extract the features of the pre-processed cross-domain data packets in real time;

[0017] Integrate the features extracted in real time into feature vector X;

[0018] Set sensitive information reference identifier and filter feature vector X;

[0019] The features extracted in real time include data packet size, transmission protocol, data transmission time interval and access frequency;

[0020] The screening refers to identifying each feature of the feature vector X. If there is a feature value in the feature vector that meets the sensitive information reference identifier, the actual identifier of the sensitive information corresponding to the feature value is marked as 1, and the feature vector is used to identify sensitive data. Otherwise, it is 0 and no operation is performed.

[0021] As a preferred solution of the power-sensitive data identification and analysis method described in the present invention, wherein: the construction of a sensitive data identification formula to identify sensitive data in real time refers to improving the logistic regression model based on feature vectors, constructing a sensitive data identification formula, and judging the probability that a cross-domain data packet is sensitive data. The formula is:

[0022]

[0023] Among them, ω v represents the transpose of the weight vector ω, X represents the input feature vector, S represents the data packet size, p c represents the weight of the c-th protocol type, g() represents the linear interaction function between the data packet size and the protocol type weight, ΔT represents the time interval between two cross-domain data packets, f represents the access frequency, h() represents the non-linear interaction function between the transmission time interval and the access frequency, b represents the bias term, and P(y = 1|X) represents the probability that the cross-domain data packet corresponding to this feature vector is sensitive data;

[0024] Set the probability threshold Y of sensitive data;

[0025] If P(y = 1|X) ≥ Y, then judge that the cross-domain data packet corresponding to this feature vector is sensitive data;

[0026] If P(y = 1|X) < Y, then judge that the cross-domain data packet corresponding to this feature vector is non-sensitive data.

[0027] As a preferred solution of the power-sensitive data identification and analysis method described in the present invention, wherein: the construction of a comprehensive sensitivity model to calculate the comprehensive sensitivity of sensitive data, conduct hierarchical classification, and formulate corresponding measures refers to normalizing the feature vectors judged as sensitive data;

[0028] Construct a comprehensive sensitivity model to calculate the comprehensive sensitivity Z of sensitive data. The formula is:

[0029]

[0030] Among them, B represents the actual identification of sensitive information of the feature vector, B ref represents the reference identification of sensitive information of the feature vector, S represents the data packet size, R represents the transmission rate of the data packet, β represents the adjustment parameter, μ is the adjustment parameter, T1 and T2 represent the start time and end time of the acquisition period of the cross-domain data packet, H(S) represents the information entropy of the data packet size, and dT is the time differential element;

[0031] According to the calculated comprehensive sensitivity, set sensitivity thresholds D1 and D2 for hierarchical classification, including,

[0032] If Z ≤ D1, it is determined that the sensitive data has low sensitivity and no protection measures are required;

[0033] If D1 < Z ≤ D2, it is determined that the sensitive data has medium sensitivity and further tracking and analysis of cross-domain data packets are required;

[0034] If Z > D2, it is determined that the sensitive data has high sensitivity and immediate measures should be taken for protection.

[0035] As a preferred solution of the power sensitive data identification and analysis method described in the present invention, wherein: marking the high-sensitivity cross-domain data packet as an abnormal behavior and generating an abnormal behavior report means marking the high-sensitivity cross-domain data packet as an abnormal behavior, summarizing the detailed information of each abnormal behavior, including the characteristics of the cross-domain data packet, the reason for the abnormality and its triggering conditions, and generating an abnormal behavior report. The report content should include the event number, time, data packet details, sensitivity level, risk rating, and recommended handling measures.

[0036] Another object of the present invention is to provide a power sensitive data identification and analysis system, which includes,

[0037] A data acquisition module for real-time acquisition of cross-domain data packets and preprocessing;

[0038] A data screening module for extracting the characteristics of cross-domain data packets for preliminary screening;

[0039] A data identification module for constructing a sensitive data identification formula to identify sensitive data in real time;

[0040] A level division module for constructing a comprehensive sensitivity model to calculate the comprehensive sensitivity of sensitive data for level division and formulating corresponding measures;

[0041] A report generation module for marking high-sensitivity cross-domain data packets as abnormal behaviors and generating abnormal behavior reports.

[0042] A computer device includes: a memory and a processor; the memory stores a computer program, and when the processor executes the computer program, the steps of the power sensitive data identification and analysis method are implemented.

[0043] A computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the power sensitive data identification and analysis method are implemented.

[0044] The beneficial effects of the present invention are as follows: by constructing a sensitive data identification formula that combines multi-dimensional features such as data packet size, protocol type, transmission time interval and access frequency, dynamic identification of sensitive data is achieved, and the accuracy of data packet classification is improved. The comprehensive sensitivity model evaluates the complexity of data packets through information entropy, and combines the relationship between transmission rate and data volume to achieve accurate grading of sensitive data. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0046] Figure 1 Schematic diagram of the flow chart of the power sensitive data identification and analysis method.

[0047] Figure 2 Schematic diagram of the process for calculating the comprehensive sensitivity of sensitive data, grading it and formulating corresponding measures.

[0048] Figure 3 This is a structural diagram of the power sensitive data identification and analysis system. DETAILED DESCRIPTION

[0049] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific embodiments of the present invention are described in detail below in conjunction with the accompanying drawings.

[0050] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0051] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The term "in one embodiment" that appears in different places in this specification does not necessarily refer to the same embodiment, nor is it a separate or selective embodiment that is mutually exclusive with other embodiments.

[0052] Example 1

[0053] Reference Figure 1 and Figure 2 , which is the first embodiment of the present invention, and provides a method for identifying and analyzing power-sensitive data. The method for identifying and analyzing power-sensitive data includes:

[0054] S1, collect cross-domain data packets in real time and pre-process them, extract the features of cross-domain data packets for preliminary screening;

[0055] Specifically, real-time collection of cross-domain data packets refers to determining the cross-domain databases that need to be monitored (such as servers or cloud services in different regions);

[0056] Select a data collection tool (such as Wireshark) based on monitoring requirements and install it on the monitoring node of the cross-domain database;

[0057] Set the parameters of the data collection tool to collect cross-domain data packets in real time;

[0058] The parameters of the data acquisition tool include the network interface for packet capture, filtering conditions and data packet size.

[0059] Through the steps of real-time collection of cross-domain data packets, the cross-domain database to be monitored is determined, and appropriate data collection tools are used to install them on the monitoring nodes, thus achieving efficient capture of cross-domain data flows. By setting parameters such as network interfaces, filtering conditions, and data packet sizes, data packets that meet monitoring requirements can be accurately filtered and obtained, ensuring that the collected data is complete, relevant, and real-time. This step effectively improves the efficiency and accuracy of cross-domain data packet collection, and provides a high-quality data foundation for subsequent data analysis and sensitive data identification.

[0060] Furthermore, preprocessing refers to filtering damaged, blank and duplicate cross-domain data packets, unifying data under different protocols into a standard format using protocol parsing tools, correcting timestamps through the network time protocol, and using median interpolation to handle missing fields in cross-domain data packets.

[0061] By preprocessing cross-domain data packets and filtering out damaged, blank, and duplicate data packets, the integrity and validity of the data are ensured. Protocol parsing tools are used to unify data under different protocols into a standard format, which improves data consistency and processability. Timestamps are corrected through the network time protocol to ensure the time synchronization of data packets and eliminate analysis errors caused by time differences. Median interpolation technology is used to fill missing fields to avoid the impact of data loss on subsequent analysis.

[0062] In addition, extracting the features of cross-domain data packets for preliminary screening refers to using deep packet inspection technology to extract the features of pre-processed cross-domain data packets in real time;

[0063] Deep packet inspection technology is able to deeply analyze the content of network data packets, from the network layer, transport layer to the application layer, to extract and identify specific data features;

[0064] Integrate the features extracted in real time into feature vector X;

[0065] According to actual needs, set sensitive information reference identifiers and filter feature vector X;

[0066] The features extracted in real time include data packet size, transmission protocol, data transmission time interval and access frequency;

[0067] The screening refers to identifying each feature of the feature vector X. If there is a feature value in the feature vector that meets the sensitive information reference identifier, the actual identifier of the sensitive information corresponding to the feature value is marked as 1, and the feature vector is used to identify sensitive data. Otherwise, it is 0 and no operation is performed.

[0068] By using deep packet inspection technology to extract and preliminarily screen the features of cross-domain data packets, it is possible to deeply analyze the data packet content and comprehensively extract the key features of the data packet from the network layer, transport layer to the application layer, including data packet size, transmission protocol, time interval and access frequency. After integrating the extracted features into feature vectors, they are screened by setting sensitive information reference identifiers to make sensitive information identification more accurate. This step realizes the refined extraction of cross-domain data packet features and dynamic screening of sensitive data, effectively improving the accuracy and efficiency of data identification.

[0069] S2. Construct sensitive data identification formula to identify sensitive data in real time;

[0070] Specifically, constructing a sensitive data identification formula to identify sensitive data in real time refers to building an existing logistic regression model. The basic formula is:

[0071]

[0072] Among them, ω v represents the transpose of the weight vector ω, which is used to combine multiple feature vectors and their corresponding weights to calculate a linear combination result. X represents the input feature vector, b represents the bias term, and P(y=1|X) represents the probability that the cross-domain data packet corresponding to the feature vector is sensitive data;

[0073] In cross-domain data transmission, sensitive data transmission behaviors under certain protocols have significant characteristics. For example, data transmission under the HTTP protocol is more likely to involve sensitive data, especially when the packet size is large. Therefore, we need to consider the interaction between the packet size and the protocol type, expressed as: g(S,p c )=α1S·p c , where S represents the packet size, p c represents the weight of the cth protocol type, represents the sensitivity weights of different protocol types, α1 is the interaction control coefficient, which represents the relative importance of the interaction between packet size and protocol type, and g() represents the linear interaction function between packet size and protocol type weight;

[0074] In the prior art, linear combinations of features are usually processed. By introducing the interaction between the packet size and the protocol type, the behavior of transmitting sensitive data across domains under a specific protocol can be better captured;

[0075] High-frequency packet transmissions, especially within a short period of time, may indicate data leakage or illegal access. For example, transmission behaviors within multiple consecutive short time periods are more likely to contain sensitive information. Therefore, it is necessary to design the interaction relationship between the transmission time interval and the access frequency, and the expression is: where ΔT represents the time interval between two cross-domain packets, f represents the access frequency, α2 represents the interaction control coefficient, indicating the relative importance of the interaction between the transmission time interval and the access frequency, and h() represents the non-linear interaction function between the transmission time interval and the access frequency;

[0076] The shorter the time interval and the higher the access frequency, the larger the value of the interaction term, meaning that the data may contain sensitive information;

[0077] Improve the logistic regression model based on the feature vector, construct a sensitive data recognition formula, and judge the probability that the cross-domain packet is sensitive data. The formula is:

[0078]

[0079] where ω v represents the transpose of the weight vector ω, X represents the input feature vector, S represents the packet size, p c represents the weight of the c-th protocol type, g() represents the linear interaction function between the packet size and the protocol type weight, ΔT represents the time interval between two cross-domain packets, f represents the access frequency, h() represents the non-linear interaction function between the transmission time interval and the access frequency, b represents the bias term, and P(y = 1|X) represents the probability that the cross-domain packet corresponding to this feature vector is sensitive data;

[0080] Set the probability threshold Y for sensitive data;

[0081] If P(y = 1|X) ≥ Y, then judge that the cross-domain packet corresponding to this feature vector is sensitive data;

[0082] If P(y = 1|X) < Y, then judge that the cross-domain packet corresponding to this feature vector is non-sensitive data.

[0083] By constructing a sensitive data identification formula, sensitive data in cross-domain data packets can be identified in real time. Based on the existing logistic regression model, by introducing a linear combination of multiple feature vectors and their weights, it is possible to effectively evaluate whether a cross-domain data packet contains sensitive data. Compared with traditional methods, the present invention not only considers the single characteristics of the size of the data packet and the protocol type, but also introduces the interactive relationship between the size of the data packet and the protocol type. In particular, under protocols such as HTTP, the transmission of large data packets is more likely to involve sensitive information. Through this interactive term, the data transmission behavior in different protocol environments can be captured more accurately, which improves the deficiency of traditional technology that only judges based on linear combination features. By introducing the interaction between the transmission time interval and the access frequency, The problem that high-frequency transmission data is difficult to handle in the prior art is solved. When a data packet is accessed frequently in a short period of time, the system improves the detection accuracy of possible sensitive data by calculating the interaction terms, further reducing the risk of missed judgment, especially when facing transmission behaviors in multiple consecutive short time intervals. The formula can dynamically evaluate its sensitivity and improve the detection capability of data leakage or illegal access. Through the improved logistic regression model, the invention comprehensively considers the interaction between multiple features to form a complete sensitive data identification model. Combined with the probability calculation of sensitive data and setting of appropriate probability thresholds, the accurate distinction between sensitive data and non-sensitive data is achieved, thereby improving the reliability and real-time performance of cross-domain data packet sensitive information identification.

[0084] S3. Construct a comprehensive sensitivity model to calculate the comprehensive sensitivity of sensitive data, classify them into levels, and formulate corresponding measures;

[0085] Specifically, constructing a comprehensive sensitivity model to calculate the comprehensive sensitivity of sensitive data for classification and formulating corresponding measures means normalizing the feature vectors judged as sensitive data;

[0086] Information entropy is introduced to measure the uncertainty of data packets and capture their complexity. Information entropy can measure the amount of information contained in a cross-domain data packet, and is particularly suitable for analyzing whether it contains sensitive information. The expression is: Among them, A k It represents the probability of occurrence of a specific field in the kth segment of a cross-domain data packet, such as the probability of a certain protocol type or sensitive identification. m represents the total number of specific fields in a cross-domain data packet. There may be multiple specific fields in a cross-domain data packet that participate in the calculation of information entropy. S represents the size of the data packet. H(S) represents the information entropy of the data packet size, which measures the complexity and uncertainty of the data packet content. The higher the information entropy, the more information the data packet contains and the more sensitive it may be.

[0087] Traditional sensitive data analysis ignores the sensitive information identification in the data packet. The sensitive identification is introduced to dynamically adjust the sensitivity of each data packet. The expression is: |BB ref|, where B represents the actual identifier of the sensitive information of the feature vector, B ref represents the reference identifier of the sensitive information of the feature vector;

[0088] By calculating the actual identifier of the sensitive information and the reference identifier of the sensitive information, it is possible to dynamically capture whether the sensitive information in the cross-domain data packet matches the reference sensitive information, improving the single-dimensional analysis of the sensitive information of the cross-domain data packet in the prior art;

[0089] In traditional analysis, the combined effects of the transmission rate and the data volume of the data packet are rarely considered simultaneously. Here, we introduce the ratio of the data volume to the transmission rate to evaluate the sensitivity of the cross-domain data packet transmission, reflecting the sensitivity of the data volume to the rate change. The expression is: where S represents the data packet size, R represents the transmission rate of the data packet, and the transmission rate of the data packet is obtained through a traffic monitoring tool;

[0090] Construct a comprehensive sensitivity model to calculate the comprehensive sensitivity Z of the sensitive data. The formula is:

[0091]

[0092] where B represents the actual identifier of the sensitive information of the feature vector, B ref represents the reference identifier of the sensitive information of the feature vector, S represents the data packet size, R represents the transmission rate of the data packet, β represents a regulation parameter that controls the influence intensity of the data packet characteristics on the sensitivity. The larger the β value, the more significant the influence of the relationship between the data packet size and the access frequency on the sensitivity. μ is a regulation parameter that controls the influence intensity of the frequency difference on the sensitivity. The larger the value, the more obvious the influence of the access frequency difference on the sensitivity. T1 and T2 represent the start time and end time of the collection period of the cross-domain data packet, H(S) represents the information entropy of the data packet size, and dT is a time differential element, indicating the integration with respect to time T;

[0093] According to the calculated comprehensive sensitivity, set sensitivity thresholds D1 and D2 for level division, including

[0094] If Z ≤ D1, it is determined that the sensitive data has low sensitivity and no protection measures need to be taken;

[0095] If D1 < Z ≤ D2, it is determined that the sensitive data has medium sensitivity, there is certain sensitive information and abnormal behavior, and further tracking and analysis of the cross-domain data packet are required;

[0096] If Z > D2, it is determined that the sensitive data has high sensitivity, there may be potential security threats, and immediate measures need to be taken for protection.

[0097] This invention calculates and divides the levels of sensitive data by constructing a comprehensive sensitivity model, which significantly improves the sensitivity identification accuracy of power data. It normalizes the characteristic vectors of sensitive data so that data of different dimensions can be calculated under a unified standard, ensuring the stability of the model and the comparability of data. It introduces information entropy to measure the uncertainty and complexity of data packets. This method can effectively capture specific fields contained in data packets, such as protocol types or the probability of occurrence of sensitive identifiers, so as to comprehensively evaluate the sensitivity of data packets. The higher the information entropy, the larger the amount of information in the data packet, the higher the complexity, and the stronger the sensitivity. In this way, the problem of ignoring the sensitive information identifiers inside the data packet in traditional sensitive data analysis is solved, making the sensitivity evaluation more comprehensive and further introducing sensitive information. The comparison between the identifier and the reference identifier can dynamically capture sensitive information in cross-domain data packets and match it with the standard, which significantly improves the limitations of the single-dimensional analysis of sensitive information in the prior art. By simultaneously considering the joint impact of data packet size and transmission rate, the invention further improves the accuracy of sensitivity assessment. The ratio of data volume to rate can accurately reflect the changes in sensitivity during cross-domain data packet transmission. Based on this, the comprehensive sensitivity model calculates the sensitivity score of the data packet through time integration, and divides it into levels according to the set threshold, and formulates corresponding security protection measures for each level. This process not only improves the real-time response capability to potential security threats, but also effectively reduces misjudgments and missed judgments, greatly enhancing the system's adaptability and protection capabilities in complex network environments.

[0098] S4, marking highly sensitive cross-domain data packets as abnormal behaviors and generating abnormal behavior reports;

[0099] Specifically, marking highly sensitive cross-domain data packets as abnormal behaviors and generating abnormal behavior reports means marking highly sensitive cross-domain data packets as abnormal behaviors, summarizing the detailed information of each abnormal behavior, including the characteristics of the cross-domain data packets, the causes of the abnormalities and their triggering conditions, and generating abnormal behavior reports. The report content should include the event number, time, data packet details, sensitivity level, risk rating and recommended handling measures.

[0100] By marking highly sensitive cross-domain data packets as abnormal behaviors and generating abnormal behavior reports, the present invention can timely identify and record potential security threats. The abnormal behavior reports summarize in detail the characteristics of the data packets, the causes of the abnormalities and their triggering conditions, including event numbers, time, data packet details, sensitivity levels, risk ratings and recommended processing measures. This process enables the system to respond quickly to abnormal behaviors, provide comprehensive risk analysis and decision support, and significantly improve the efficiency and accuracy of the power system in processing and preventing data leakage and illegal access.

[0101] Example 2

[0102] Reference Figure 3 , which is the second embodiment of the present invention. This embodiment is different from the previous embodiment and provides a power sensitive data identification and analysis system.

[0103] Data collection module, used to collect cross-domain data packets in real time and perform pre-processing;

[0104] Data screening module, used to extract the features of cross-domain data packets for preliminary screening;

[0105] Data identification module, used to build sensitive data identification formula to identify sensitive data in real time;

[0106] The grading module is used to build a comprehensive sensitivity model to calculate the comprehensive sensitivity of sensitive data, grading it and formulating corresponding measures;

[0107] The report generation module is used to mark highly sensitive cross-domain data packets as abnormal behaviors and generate abnormal behavior reports.

[0108] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc., which can store program codes.

[0109] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0110] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0111] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, any one of the following technologies known in the art or a combination thereof can be used to implement: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0112] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A method for identifying and analyzing power sensitive data, characterized in that: Including Real-time collect cross-domain data packets and perform preprocessing, extract the characteristics of cross-domain data packets for preliminary screening; Construct a sensitive data recognition formula to recognize sensitive data in real time; Construct a comprehensive sensitivity model to calculate the comprehensive sensitivity of sensitive data for grading and formulate corresponding measures; Mark cross-domain data packets with high sensitivity as abnormal behaviors and generate abnormal behavior reports.

2. The power sensitive data identification and analysis method according to claim 1, characterized in that: The real-time collection of cross-domain data packets refers to determining the cross-domain databases to be monitored; Select a data collection tool based on the monitoring requirements and install it on the monitoring nodes of the cross-domain databases; Set the parameters of the data collection tool to collect cross-domain data packets in real time; The parameters of the data collection tool include the network interface for packet capture, filtering conditions, and packet size.

3. The power sensitive data identification and analysis method according to claim 2, characterized in that: The preprocessing refers to filtering damaged, blank, and duplicate cross-domain data packets, using a protocol parsing tool to unify the data under different protocols into a standard format, correcting the time stamp through the Network Time Protocol, and using median imputation to process the missing fields in the cross-domain data packets.

4. The power sensitive data identification and analysis method according to claim 3, characterized in that: The extraction of the characteristics of cross-domain data packets for preliminary screening refers to using deep packet inspection technology to extract the characteristics of the preprocessed cross-domain data packets in real time; Integrate the characteristics extracted in real time into a feature vector X; Set a sensitive information reference identifier to screen the feature vector X; The characteristics extracted in real time include packet size, transmission protocol, data transmission time interval, and access frequency; The screening refers to identifying each feature of the feature vector X. If there is a feature value in the feature vector that conforms to the sensitive information reference identifier, the actual identifier of the sensitive information corresponding to the feature value is marked as 1, and the feature vector is used for sensitive data recognition, otherwise it is 0 and no operation is performed.

5. The power sensitive data identification and analysis method according to claim 4, characterized in that: The construction of a sensitive data recognition formula to recognize sensitive data in real time refers to improving the logistic regression model based on the feature vector, constructing a sensitive data recognition formula, and judging the probability that a cross-domain data packet is sensitive data. The formula is: Among them, ω v represents the transpose of the weight vector ω, X represents the input feature vector, S represents the packet size, and p c represents the weight of the cth protocol type, g() represents the linear interaction function between the packet size and the protocol type weight, ΔT represents the time interval between two cross-domain packets, f represents the access frequency, h() represents the nonlinear interaction function between the transmission time interval and the access frequency, b represents the bias term, and P(y=1|X) represents the probability that the cross-domain packet corresponding to the feature vector is sensitive data; Set a probability threshold Y for sensitive data; If P(y = 1|X) ≥ Y, then judge that the cross-domain data packet corresponding to the feature vector is sensitive data; If P(y = 1|X) < Y, then judge that the cross-domain data packet corresponding to the feature vector is non-sensitive data.

6. The power sensitive data identification and analysis method according to claim 5, characterized in that: The construction of a comprehensive sensitivity model to calculate the comprehensive sensitivity of sensitive data for grading and formulate corresponding measures refers to normalizing the feature vectors judged to be sensitive data; Construct a comprehensive sensitivity model to calculate the comprehensive sensitivity Z of sensitive data. The formula is: Among them, B represents the actual identification of sensitive information of the feature vector, B ref represents the sensitive information reference identifier of the feature vector, S represents the data packet size, R represents the transmission rate of the data packet, β represents the adjustment parameter, μ represents the adjustment parameter, T1 and T2 represent the start time and end time of the collection period of the cross-domain data packet, H(S) represents the information entropy of the data packet size, and dT is the time differential element; According to the calculated comprehensive sensitivity, set sensitivity thresholds D1 and D2 for grading, including If Z ≤ D1, then judge that the sensitive data is of low sensitivity and no protection measures need to be taken; If D1 < Z ≤ D2, then judge that the sensitive data is of medium sensitivity and further tracking and analysis of the cross-domain data packets are required; If Z > D2, then judge that the sensitive data is of high sensitivity and immediate measures need to be taken for protection.

7. The power sensitive data identification and analysis method according to claim 6, characterized in that: The marking of highly sensitive cross-domain data packets as abnormal behaviors and generating abnormal behavior reports refers to marking highly sensitive cross-domain data packets as abnormal behaviors, summarizing the detailed information of each abnormal behavior, including the characteristics of the cross-domain data packets, the causes of the abnormalities and their triggering conditions, and generating abnormal behavior reports. The report content should include event number, time, data packet details, sensitivity level, risk rating and recommended handling measures.

8. A power sensitive data identification and analysis system based on the power sensitive data identification and analysis method according to any one of claims 1 to 7, characterized in that: include, Data collection module, used to collect cross-domain data packets in real time and perform pre-processing; Data screening module, used to extract the features of cross-domain data packets for preliminary screening; Data identification module, used to build sensitive data identification formula to identify sensitive data in real time; The grading module is used to build a comprehensive sensitivity model to calculate the comprehensive sensitivity of sensitive data, grading it and formulating corresponding measures; The report generation module is used to mark highly sensitive cross-domain data packets as abnormal behaviors and generate abnormal behavior reports.

9. A computer device comprising: Memory and processor; The memory stores a computer program, wherein the processor implements the steps of the power sensitive data identification and analysis method according to any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the power sensitive data identification and analysis method according to any one of claims 1 to 7 are implemented.

Images