Safety information grading warning method and system

Abstract

The invention discloses a security information grading warning method and system, and relates to the technical field of data models.The method comprises the steps that a hierarchical protection model is constructed and incorporated into security equipment; the security of the physical layer is ensured through the dynamic security module; the early warning module performs intrusion detection; the security rating module determines an attack grade; and constructing an overall situation awareness layer and an attack traceability layer, obtaining attack source information and executing security protection and counterattack. The system provides different levels of warnings, reduces the false alarm rate, and improves the processing efficiency and safety. The hierarchical warning system dynamically feeds back in real time, quickly identifies and processes problems, continuously monitors the network security state, and dynamically adjusts the security policy to adapt to network threats. According to the invention, network security events can be timely and accurately coped with, the overall security protection capability is improved, the security management process is simplified, and powerful support is provided for modern network security protection.

Description

Technical Field

[0001] The present invention relates to the technical field of data models, and in particular to a security information classification warning method and system. Background Art

[0002] The graded warning system helps users distinguish the severity of the problem by providing different levels of warnings, so that they can take appropriate measures. Such a system design aims to improve the efficiency and effectiveness of problem handling and prevent more serious consequences caused by improper handling. The implementation of the graded warning system usually relies on data received from sensors or other monitoring systems. After these data are analyzed and processed, the corresponding level of warning is triggered according to the set threshold or conditions. For example, the EICAS system receives signals from engine and aircraft system sensors, and completes data processing and display through an embedded real-time operating system.

[0003] In the field of network security, since there are many security points monitored by the server, some security warning modules are prone to the defect of too high warning sensitivity threshold, so there will be a large number of false security alarms, which leads to the defect of high false alarm rate of traditional security defense models. Summary of the invention

[0004] In view of the above-mentioned problems, the present invention is proposed.

[0005] Therefore, the technical problem solved by the present invention is: how to solve the problem of high false alarm rate of traditional security defense models.

[0006] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0007] In a first aspect, an embodiment of the present invention provides a security information hierarchical warning method, comprising:

[0008] Establish a layered protection model and incorporate security devices;

[0009] The dynamic security module of the layered protection model builds a dynamic security patrol layer, receives the IP address of each security device, and ensures the security protection of the physical layer through access authorization codes and detection probes;

[0010] The early warning module based on the layered protection model builds an early warning protection layer, receives access request information and performs intrusion detection;

[0011] The dynamic security patrol layer and the early warning protection layer form a response connection;

[0012] The security rating module based on the layered protection model establishes a security assessment layer; through the vulnerability scanning results, the security device and its firewall level that are connected to the IP address are determined, thereby determining the attack level of the IP address;

[0013] Establish a response connection between the early warning protection layer and the security assessment layer;

[0014] Build an overall situation awareness layer and attack source tracing layer through the security assessment layer to obtain attack source information;

[0015] Perform security protection and counterattack based on the attack source information of the attack tracing layer.

[0016] As a preferred solution of the safety information classification warning method, wherein:

[0017] The dynamic security inspection layer constructed by the dynamic security module of the layered protection model includes:

[0018] Receive the IP address of each security device through the dynamic security patrol layer: Through the IP address call of each security device, physical layer security protection is implemented to prevent unauthorized malicious devices from accessing or modifying data;

[0019] Send access authorization codes and probes to each IP address: Establish an encrypted communication link through the data link, and deploy probes on the communication link to detect and respond to network attacks;

[0020] Utilizes probing probes to detect data flow from security devices;

[0021] Screen data flow based on access authorization codes.

[0022] As a preferred solution of the safety information classification warning method, wherein:

[0023] The dynamic security inspection layer constructed by the dynamic security module of the layered protection model also includes:

[0024] Receive access requests through the dynamic security patrol layer and parse the access authorization code in the access request;

[0025] Determine whether the access authorization code in the access request matches the access authorization code of the corresponding IP address;

[0026] If the access authorization code in the access request does not match the access authorization code of the corresponding IP address, the access request information is passed to the early warning protection layer;

[0027] If the access authorization code in the access request matches the access authorization code of the corresponding IP address, a data flow utilizing the probing probe security device is returned.

[0028] As a preferred solution of the safety information classification warning method, wherein:

[0029] The early warning module based on the layered protection model constructs an early warning protection layer, including:

[0030] Receive access request information through the early warning protection layer and perform intrusion detection on the access request information;

[0031] Based on intrusion detection, determine whether the device corresponding to the access request poses a security threat;

[0032] If the device corresponding to the access request does not pose a security threat, the IP address of the device corresponding to the access request is fed back to the security log;

[0033] If the device corresponding to the access request has a security threat, the local data flow of the IP address is further scanned for vulnerabilities;

[0034] Send the results of the vulnerability scan to the security assessment layer.

[0035] As a preferred solution of the safety information classification warning method, wherein:

[0036] The security rating module based on the layered protection model establishes a security assessment layer including:

[0037] Determine the security device that the IP address has established contact with based on the vulnerability scan results through the security assessment layer;

[0038] Select a security device that has established a connection and determine the firewall level of the security device;

[0039] Return to select a connected safety device until all safety devices are selected;

[0040] Select the firewall level with the highest firewall level as the attack level for the IP address.

[0041] As a preferred solution of the safety information classification warning method, wherein:

[0042] The obtaining of attack source information includes:

[0043] Retrieve all data streams of the firewall level corresponding to the attack level, select a data stream, parse the data stream based on the covert channel screening algorithm, and mark the device IP address without access authorization code; return to select a data stream until all data streams are selected;

[0044] The method of parsing the data stream based on the covert channel screening algorithm includes:

[0045] Determine whether the data stream is static information;

[0046] If the data stream is static information, source code analysis and taint analysis are performed on the data stream;

[0047] If the data stream is not static information, determining that the data stream is a real-time interactive data stream;

[0048] performing trace analysis and fuzzy analysis on the data stream;

[0049] Based on the analysis result, determining the data transmission characteristics of the data flow;

[0050] The device IP addresses marked with no access authorization code include:

[0051] Invoke data transfer rules;

[0052] Based on the data transmission characteristics of the data stream and the data classification of the data transmission rules, it is determined whether the data stream has interactive information of abnormal data type transmission;

[0053] If the data flow contains interactive information transmitted with abnormal data types, the IP address of the device outside the layered protection model is marked;

[0054] If the data stream does not contain interactive information transmitted with abnormal data types, determining whether the data stream contains unmarked interactive information;

[0055] If the data flow contains unmarked interactive information, the IP address of the device outside the layered protection model is marked;

[0056] If the data stream does not contain unmarked interactive information, the process of marking the device IP address without the access authorization code is terminated.

[0057] As a preferred solution of the safety information classification warning method, wherein:

[0058] The security protection and counterattack based on the attack source information of the attack tracing layer includes:

[0059] Receive all marked device IP addresses, establish an access blacklist, and include all marked device IP addresses in the access blacklist.

[0060] In a second aspect, an embodiment of the present invention provides a security information classification warning system, including:

[0061] A layered protection model building module is used to build a layered protection model and incorporate security devices;

[0062] Dynamic security patrol layer construction module, used to build a dynamic security patrol layer through the dynamic security module of the layered protection model, receive the IP address of each security device, and ensure the security protection of the physical layer through access authorization code and detection probe;

[0063] An early warning protection layer construction module is used to construct an early warning protection layer based on the early warning module of the layered protection model, receive access request information and perform intrusion detection;

[0064] The first response connection establishment module is used to establish a response connection between the dynamic security patrol layer and the early warning protection layer;

[0065] The security assessment layer building module is used to establish a security assessment layer based on the security rating module of the layered protection model; through the vulnerability scanning results, the security device and its firewall level that are connected to the IP address are determined, thereby determining the attack level of the IP address;

[0066] A second response connection establishment module is used to establish a response connection between the early warning protection layer and the security assessment layer;

[0067] The attack source information acquisition module is used to build an overall situation awareness layer and an attack tracing layer through the security assessment layer to obtain attack source information;

[0068] The security protection and counterattack module is used to perform security protection and counterattack based on the attack source information of the attack tracing layer.

[0069] In a third aspect, an embodiment of the present invention provides a computing device, including:

[0070] Memory and processor;

[0071] The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the one or more programs are executed by the one or more processors, the one or more processors implement the security information classification warning method as described in any embodiment of the present invention.

[0072] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the security information classification warning method.

[0073] Beneficial effects of the present invention: The present invention helps the system to identify and solve problems in a timely manner by providing different levels of warnings, thereby reducing the false alarm rate of security incidents and improving processing efficiency and safety. The hierarchical warning system can provide real-time and dynamic feedback to help the system quickly identify and solve problems. The hierarchical warning system continuously monitors the network security status and implements dynamic adjustment of security policies to adapt to the ever-changing network threats. BRIEF DESCRIPTION OF THE DRAWINGS

[0074] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative labor.

[0075] Figure 1It is an overall flow chart of the security information classification warning method described in the first embodiment of the present invention. DETAILED DESCRIPTION

[0076] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0077] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0078] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The term "in one embodiment" that appears in different places in this specification does not necessarily refer to the same embodiment, nor does it refer to a separate or selective embodiment that is mutually exclusive with other embodiments.

[0079] Example 1

[0080] Reference Figure 1 , which is the first embodiment of the present invention, and provides a security information classification warning method, comprising:

[0081] S1: Establish a layered protection model and incorporate security devices;

[0082] S2: Build a dynamic security patrol layer through the dynamic security module of the layered protection model;

[0083] S3: Build an early warning protection layer based on the early warning module of the layered protection model;

[0084] S4: Establish a response connection between the dynamic security patrol layer and the early warning protection layer.

[0085] S5: Establish a security assessment layer based on the security rating module of the layered protection model;

[0086] S6: Establish a response connection between the early warning protection layer and the security assessment layer;

[0087] S7: Build an overall situation awareness layer and attack tracing layer through the security assessment layer to obtain attack source information;

[0088] S8: Perform security protection and counterattack based on the attack source information of the attack tracing layer.

[0089] It should be noted that incorporating each security device into the layered protection model forms a layered protection model associated with the security devices, thereby improving the comprehensiveness of the security protection of the layered protection model.

[0090] In the embodiment of the present application, the construction of the dynamic security patrol layer by the dynamic security module of the layered protection model in the above step S2 includes:

[0091] Receive the IP address of each security device through the dynamic security patrol layer: Through the IP address call of each security device, physical layer security protection is implemented to prevent unauthorized malicious devices from accessing or modifying data;

[0092] Send access authorization codes and probes to each IP address: Establish an encrypted communication link through the data link, and deploy probes on the communication link to detect and respond to network attacks;

[0093] It should be noted that the access authorization code has two functions: one is encryption and identity authentication, and the other is firewall configuration.

[0094] Utilizes probing probes to detect data flow from security devices;

[0095] It should be noted that the establishment of an encrypted data transmission channel can ensure the confidentiality and integrity of data transmission and implement data flow restrictions. These data have classification characteristics, can be marked, and can also be restricted and detected.

[0096] Screen data flow based on access authorization codes.

[0097] It should be noted that the dynamic security patrol layer, as the first layer of the layered protection model, can conduct preliminary exploration of security threats, thereby preventing false alarms of security vulnerabilities from the root. At the same time, the dynamic security patrol layer can exchange information with each security device, has high flexibility and adaptability, and can adapt to constantly changing security threats.

[0098] In the embodiment of the present application, the construction of the dynamic security inspection layer by the dynamic security module of the layered protection model in the above step S2 also includes:

[0099] Receive access requests through the dynamic security patrol layer and parse the access authorization code in the access request;

[0100] It should be noted that the access authorization code can help the system quickly identify potential illegal intrusions or threats. Through the access authorization code mechanism, security risks can be reduced and the success rate of security threat judgment can be improved.

[0101] Furthermore, the defense level of the access authorization code can be linked with the security level of the firewall, and the access authorization code can be adapted to the actual performance of the security device.

[0102] Determine whether the access authorization code in the access request matches the access authorization code of the corresponding IP address;

[0103] If the access authorization code in the access request does not match the access authorization code of the corresponding IP address, the access request information is passed to the early warning protection layer;

[0104] It should be noted that once the dynamic security patrol layer detects a security incident, the early warning protection layer can take prompt action to control and mitigate the impact of the incident.

[0105] If the access authorization code in the access request matches the access authorization code of the corresponding IP address, a data flow utilizing the probing probe security device is returned.

[0106] It should be noted that the dynamic security patrol layer continuously monitors the network security status and dynamically adjusts security policies to adapt to the ever-changing network threats. The dynamic adjustment process of the dynamic security patrol layer relies on real-time warning information to guide response measures.

[0107] In the embodiment of the present application, the early warning module based on the layered protection model in the above step S3 constructs an early warning protection layer, including:

[0108] Receive access request information through the early warning protection layer and perform intrusion detection on the access request information;

[0109] Specifically, intrusion detection is mainly achieved through access rights screening of the firewall and can also be achieved through abnormal traffic monitoring.

[0110] Based on intrusion detection, determine whether the device corresponding to the access request poses a security threat;

[0111] If the device corresponding to the access request does not pose a security threat, the IP address of the device corresponding to the access request is fed back to the security log;

[0112] Specifically, the security log will count the number of accesses to the device corresponding to the IP address.

[0113] If the device corresponding to the access request has a security threat, the local data flow of the IP address is further scanned for vulnerabilities;

[0114] Specifically, local scanning, real-time data collection and transmission to the central management system for analysis and repair. By sending network queries to different ports, analyze which ports are open, closed or filtered to identify potential security vulnerabilities and service configuration errors. Automatically detect the structure of web applications to find security vulnerabilities such as SQL injection and XSS. Use port scanning, network mapping and service identification technology to detect known defects and outdated network application versions throughout the network, including security vulnerabilities of devices such as routers, switches and firewalls.

[0115] Send the results of the vulnerability scan to the security assessment layer.

[0116] It should be noted that the early warning protection layer is not limited to intrusion detection, but also includes real-time monitoring and notification of abnormal behavior. This includes data aggregation and analysis from various sources, such as network traffic logs, security events, and key performance indicators.

[0117] In the embodiment of the present application, the security rating module based on the layered protection model in the above step S5 establishes a security assessment layer, including:

[0118] Determine the security device that the IP address has established contact with based on the vulnerability scan results through the security assessment layer;

[0119] Select a security device that has established a connection and determine the firewall level of the security device;

[0120] Specifically, different security devices have different firewall levels. When it is determined that the IP address of the offensive device has established a communication connection with the security device, it can be determined that the security device has been compromised.

[0121] The highest firewall level among these security devices, such as firewalls, is the attack level of the IP address. By checking the corresponding level of firewalls in the system, you can understand other security vulnerabilities in the system that have not yet been discovered.

[0122] Return to select a connected safety device until all safety devices are selected;

[0123] Select the firewall level with the highest firewall level as the attack level for the IP address.

[0124] It should be noted that when abnormal behavior is detected, the security assessment layer can not only provide real-time security warnings, but also serve as a basis for evaluating the maturity of system security engineering. By analyzing the efficiency and effectiveness of warning processing, the security capabilities of the organization can be quantitatively evaluated to promote continuous improvement of security management.

[0125] In the embodiment of the present application, obtaining the attack source information in the above step S7 includes:

[0126] Retrieve all data streams of the firewall level corresponding to the attack level, select a data stream, parse the data stream based on the covert channel screening algorithm, and mark the device IP address without access authorization code; return to select a data stream until all data streams are selected.

[0127] It should be noted that in a large-scale network environment, through methods such as data analysis, mining and intelligent deduction, the hierarchical warning system can accurately understand and quantify the current security situation in cyberspace. Using the hierarchical warning system structure, various attack events in cyberspace can be effectively detected, and the security factors that cause changes in the situation can be traced. It embodies the concept of multi-dimensional and multi-level security protection. From basic early warning and counterattack, to multi-level comprehensive protection, to the continuous improvement of system security engineering capabilities, and the use of data analysis and intelligent deduction for security situation awareness and attack event tracing, these models and strategies jointly build a comprehensive, dynamic and intelligent network security defense system. This effectively improves the accuracy of security threat judgment and reduces the misjudgment rate.

[0128] In the embodiment of the present application, the above-mentioned analysis of the data stream based on the covert channel screening algorithm includes:

[0129] Determine whether the data stream is static information;

[0130] It should be noted that attacks often occur through covert channels. Covert channels are abnormal communication paths in computer systems that may be used to transmit unauthorized information. Data flow screening can effectively identify and block such channels, thereby preventing potential security risks.

[0131] By using the information flow model, strict data transmission rules can be set, such as through data classification, labeling and flow restrictions, to ensure that sensitive information can only be accessed by authorized entities, greatly reducing the risk of information leakage.

[0132] If the data stream is static information, source code analysis and taint analysis are performed on the data stream;

[0133] Specifically, static analysis focuses on the source code and static characteristics of the program, such as source code analysis and taint analysis.

[0134] Since the data flow monitors the information interaction device and the information through the data link, the communication legitimacy of the information interaction device can be determined through source code analysis and taint analysis.

[0135] If the data stream is not static information, determining that the data stream is a real-time interactive data stream;

[0136] Specifically, dynamic analysis focuses on runtime status, including trace analysis and fuzz testing.

[0137] performing trace analysis and fuzzy analysis on the data stream;

[0138] It should be noted that tracking analysis and fuzzy analysis can collect analysis information through data transmission control, transmission channel control, and access object control, and can also be monitored through the amount of overall traffic.

[0139] Based on the analysis result, the data transmission characteristics of the data flow are determined.

[0140] Specifically, data transmission features are composed of classification features, marking features, and flow direction features.

[0141] For example, if a data set does not belong to the SQL input items and does not have a query mark, but flows to the SQL database, then the IP address of the sending device of this data set will be marked.

[0142] In another possible implementation, the data stream can be parsed by transmitting different probe scripts to the suspected device through the data channel in the form of data packets, traversing the database of the suspected device through the probe, and returning the detection conclusion through the communication channel between the suspected device and the system.

[0143] In the embodiment of the present application, the device IP address marked without the access authorization code includes:

[0144] Invoke data transfer rules;

[0145] Specifically, common data transmission rules include big-endian and small-endian modes, transmitted data types, protocol compatibility and corresponding access interfaces, encryption rules, etc.

[0146] Based on the data transmission characteristics of the data stream and the data classification of the data transmission rules, it is determined whether the data stream has interactive information of abnormal data type transmission;

[0147] Specifically, since the data type transmitted by the local database is specific, an illegal connection may result in an error message about the data type of the stored information. Based on the error message, the data sending device can be traced back.

[0148] If the data flow contains interactive information transmitted with abnormal data types, the IP address of the device outside the layered protection model is marked;

[0149] If the data stream does not contain interactive information transmitted with abnormal data types, determining whether the data stream contains unmarked interactive information;

[0150] If the data flow contains unmarked interactive information, the IP address of the device outside the layered protection model is marked;

[0151] Specifically, in some security protection systems, when untagged data appears, it indicates that the sending device of the data stream does not have an access authorization code.

[0152] If the data stream does not contain unmarked interactive information, the process of marking the device IP address without the access authorization code is terminated.

[0153] It should be noted that the assessment information of the security assessment layer can construct the overall situation awareness layer and the attack tracing layer. Through methods such as data analysis, mining and intelligent deduction, the hierarchical warning system can accurately understand and quantify the current security situation in cyberspace. This not only includes warnings for existing threats, but also predicts the development trend of future security situations, provides strategic guidance for network security, and greatly reduces the false alarm rate of security risks. The overall situation awareness layer can effectively detect various attack events in cyberspace and trace the security factors that cause situation changes. By providing different levels of warnings to help the system identify and solve problems in a timely manner, the false alarm rate of security incidents is reduced, thereby improving processing efficiency and security. The hierarchical warning system can provide real-time and dynamic feedback to help the system quickly identify and solve problems. Through the hierarchical warning system, the network security status is continuously monitored, and the security strategy is dynamically adjusted to adapt to the ever-changing network threats.

[0154] It should be noted that the attack tracing layer can issue early warnings through the layered protection model, take protective measures in advance, and be able to launch effective counterattacks after being attacked.

[0155] In the embodiment of the present application, the security protection and counterattack based on the attack source information of the attack tracing layer in the above step S8 includes:

[0156] Receive all marked device IP addresses, establish an access blacklist, and include all marked device IP addresses in the access blacklist.

[0157] It should be noted that the establishment of a blacklist can achieve defense against attacking devices. This ensures that the model can flexibly respond to various situations, from simple threats to complex and persistent attacks. This also improves the accuracy of security threat warnings and reduces the rate of false warnings.

[0158] The above is a schematic scheme of the security information classification warning method of this embodiment. It should be noted that the technical scheme of the security information classification warning system and the technical scheme of the above security information classification warning method belong to the same concept, and the details of the technical scheme of the security information classification warning system in this embodiment that are not described in detail can all be referred to the description of the technical scheme of the above security information classification warning method.

[0159] The safety information classification warning system in this embodiment includes:

[0160] A layered protection model building module is used to build a layered protection model and incorporate security devices;

[0161] Dynamic security patrol layer construction module, used to build a dynamic security patrol layer through the dynamic security module of the layered protection model, receive the IP address of each security device, and ensure the security protection of the physical layer through access authorization code and detection probe;

[0162] An early warning protection layer construction module is used to construct an early warning protection layer based on the early warning module of the layered protection model, receive access request information and perform intrusion detection;

[0163] The first response connection establishment module is used to establish a response connection between the dynamic security patrol layer and the early warning protection layer;

[0164] The security assessment layer building module is used to establish a security assessment layer based on the security rating module of the layered protection model; through the vulnerability scanning results, the security device and its firewall level that are connected to the IP address are determined, thereby determining the attack level of the IP address;

[0165] A second response connection establishment module is used to establish a response connection between the early warning protection layer and the security assessment layer;

[0166] The attack source information acquisition module is used to build an overall situation awareness layer and an attack tracing layer through the security assessment layer to obtain attack source information;

[0167] The security protection and counterattack module is used to perform security protection and counterattack based on the attack source information of the attack tracing layer.

[0168] This embodiment further provides a computing device, which is applicable to the case of the security information classification warning method, including:

[0169] Memory and processor; the memory is used to store computer executable instructions, and the processor is used to execute computer executable instructions to implement the security information classification warning method proposed in the above embodiment.

[0170] This embodiment also provides a storage medium on which a computer program is stored. When the program is executed by a processor, the security information classification warning method proposed in the above embodiment is implemented.

[0171] The storage medium proposed in this embodiment and the security information classification warning method proposed in the above embodiment belong to the same inventive concept. The technical details not fully described in this embodiment can be referred to the above embodiment, and this embodiment has the same beneficial effects as the above embodiment.

[0172] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A safety information classification warning method, characterized in that: include: Establish a layered protection model and incorporate security devices; The dynamic security patrol layer is built through the dynamic security module of the layered protection model, receiving the IP address of each security device and ensuring the security protection of the physical layer through access authorization codes and detection probes; The early warning module based on the layered protection model builds an early warning protection layer, receives access request information and performs intrusion detection; Establish a response connection between the dynamic security patrol layer and the early warning protection layer; The security rating module based on the layered protection model establishes a security assessment layer; through the vulnerability scanning results, the security device and its firewall level that are connected to the IP address are determined, thereby determining the attack level of the IP address; Establish a response connection between the early warning protection layer and the security assessment layer; Build an overall situation awareness layer and attack source tracing layer through the security assessment layer to obtain attack source information; Perform security protection and counterattack based on the attack source information of the attack tracing layer.

2. The security information classification warning method according to claim 1, characterized in that: The dynamic security inspection layer constructed by the dynamic security module of the layered protection model includes: Receive the IP address of each security device through the dynamic security patrol layer: Through the IP address call of each security device, physical layer security protection is implemented to prevent unauthorized malicious devices from accessing or modifying data; Send access authorization codes and probes to each IP address: Establish an encrypted communication link through the data link, and deploy probes on the communication link to detect and respond to network attacks; Utilizes probing probes to detect data flow from security devices; Screen data flow based on access authorization codes.

3. The security information classification warning method according to claim 2, characterized in that: The dynamic security inspection layer constructed by the dynamic security module of the layered protection model also includes: Receive access requests through the dynamic security patrol layer and parse the access authorization code in the access request; Determine whether the access authorization code in the access request matches the access authorization code of the corresponding IP address; If the access authorization code in the access request does not match the access authorization code of the corresponding IP address, the access request information is passed to the early warning protection layer; If the access authorization code in the access request matches the access authorization code of the corresponding IP address, a data flow utilizing the probing probe security device is returned.

4. The security information classification warning method according to claim 3, characterized in that: The early warning module based on the layered protection model constructs an early warning protection layer, including: Receive access request information through the early warning protection layer and perform intrusion detection on the access request information; Based on intrusion detection, determine whether the device corresponding to the access request poses a security threat; If the device corresponding to the access request does not pose a security threat, the IP address of the device corresponding to the access request is fed back to the security log; If the device corresponding to the access request has a security threat, the local data flow of the IP address is further scanned for vulnerabilities; Send the results of the vulnerability scan to the security assessment layer.

5. The security information classification warning method according to claim 4, characterized in that: The security rating module based on the layered protection model establishes a security assessment layer including: Determine the security device that the IP address has established contact with based on the vulnerability scan results through the security assessment layer; Select a security device that has established a connection and determine the firewall level of the security device; Return to select a connected safety device until all safety devices are selected; Select the firewall level with the highest firewall level as the attack level for the IP address.

6. The security information classification warning method according to claim 5, characterized in that: The obtaining of attack source information includes: Retrieve all data streams of the firewall level corresponding to the attack level, select a data stream, parse the data stream based on the covert channel screening algorithm, and mark the device IP address without access authorization code; return to select a data stream until all data streams are selected; The method of parsing the data stream based on the covert channel screening algorithm includes: Determine whether the data stream is static information; If the data stream is static information, source code analysis and taint analysis are performed on the data stream; If the data stream is not static information, determining that the data stream is a real-time interactive data stream; performing trace analysis and fuzzy analysis on the data stream; Based on the analysis result, determining the data transmission characteristics of the data flow; The device IP addresses marked with no access authorization code include: Invoke data transfer rules; Based on the data transmission characteristics of the data stream and the data classification of the data transmission rules, it is determined whether the data stream has interactive information of abnormal data type transmission; If the data flow contains interactive information transmitted with abnormal data types, the IP address of the device outside the layered protection model is marked; If the data stream does not contain interactive information transmitted with abnormal data types, determining whether the data stream contains unmarked interactive information; If the data flow contains unmarked interactive information, the IP address of the device outside the layered protection model is marked; If the data stream does not contain unmarked interactive information, the process of marking the device IP address without the access authorization code is terminated.

7. The security information classification warning method according to claim 6, characterized in that: The security protection and counterattack based on the attack source information of the attack tracing layer includes: Receive all marked device IP addresses, establish an access blacklist, and include all marked device IP addresses in the access blacklist.

8. A system using the security information classification warning method according to any one of claims 1 to 7, characterized in that: include: A layered protection model building module is used to build a layered protection model and incorporate security devices; Dynamic security patrol layer construction module, used to build a dynamic security patrol layer through the dynamic security module of the layered protection model, receive the IP address of each security device, and ensure the security protection of the physical layer through access authorization code and detection probe; An early warning protection layer construction module is used to construct an early warning protection layer based on the early warning module of the layered protection model, receive access request information and perform intrusion detection; The first response connection establishment module is used to establish a response connection between the dynamic security patrol layer and the early warning protection layer; The security assessment layer building module is used to establish a security assessment layer based on the security rating module of the layered protection model; through the vulnerability scanning results, the security device and its firewall level that are connected to the IP address are determined, thereby determining the attack level of the IP address; A second response connection establishment module is used to establish a response connection between the early warning protection layer and the security assessment layer; The attack source information acquisition module is used to build an overall situation awareness layer and an attack tracing layer through the security assessment layer to obtain attack source information; The security protection and counterattack module is used to perform security protection and counterattack based on the attack source information of the attack tracing layer.

9. A computing device comprising: Memory and processor; The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the computer-executable instructions are executed by the processor, the steps of the security information classification warning method described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the steps of the security information classification warning method according to any one of claims 1 to 7.

Images