Storage security management method and system

Abstract

The invention relates to a storage security management method and system. The method comprises the steps that a data acquisition module of a security management platform constructs a corresponding behavior topological graph for all users according to interactive behavior data of each user in a user client; the behavior recognition module analyzes according to all behavior edges corresponding to each user in the behavior topological graph to obtain interaction behavior characteristics of the corresponding user; the time sequence analysis module analyzes according to the interactive behavior characteristics of each user to obtain the time sequence abnormality of each user and the behavior similarity of each user in different monitoring periods, so that the sensitivity analysis module determines the behavior sensitivity corresponding to the current monitoring period; and the access control module judges whether the user is allowed to access the storage or not according to the behavior sensitivity.

Description

Technical Field

[0001] The present invention relates to the field of computer and data security, and in particular to a storage security management method and system. Background Art

[0002] Modern society is called the "information society". Information technology has penetrated into all sectors of politics, economy, industry and service fields, and the proportion of the information industry in the national economy is increasing. The level of development of the information industry and the level of information infrastructure construction are important indicators for measuring social modernization. With the development of the Internet, the Internet of Things, mobile Internet, big data and other fields, social informatization has reached an unprecedented level. The higher the degree of social informatization, the more information data is generated, and the more prominent the problem of information security is.

[0003] In recent years, the proportion of domestic hardware usage has gradually increased, such as domestic processors, storage devices and encryption chips. Therefore, it is necessary to study and adapt domestic operating systems to achieve secure data storage, aiming to ensure the security and reliability of system data storage. Research high-reliability storage fusion technology for dual-core operating systems, and break through real-time storage and macro-kernel compatibility technology. Support common industrial bus protocols, including EtherCAT (Ethernet control automation technology), PowerLink (industrial real-time Ethernet protocol), Modbus (Modicon bus), etc. Summary of the invention

[0004] In view of this, the present invention provides a storage security management method, which includes: a data acquisition module of a security management platform periodically acquires interactive behavior data generated by each user in a user client through a corresponding data interface, and constructs a corresponding behavior topology map for all users according to the interactive behavior data of each user, wherein the interactive behavior data includes user relationship data and storage access data of the user;

[0005] The behavior recognition module maps the storage access data of each user into a behavior topology graph to construct a corresponding behavior edge for each user in the behavior topology graph, and analyzes the interaction behavior of the corresponding user according to all the behavior edges of each user in the behavior topology graph to obtain the interaction behavior characteristics of the corresponding user, wherein the behavior edge is used to characterize the interaction behavior between the corresponding users;

[0006] The time series analysis module obtains the behavior similarity between each user based on the interaction behavior characteristics of each user in the behavior topology diagram, obtains the interaction behavior characteristics of each user in different monitoring periods, and arranges all the interaction behavior characteristics in order to obtain the behavior sequence of each user, and then obtains the time series anomaly of each user based on the behavior sequence of each user;

[0007] The sensitivity analysis module obtains the behavioral sensitivity of the behavior topology in the current monitoring period based on the time series anomaly of each user and the behavioral similarity between each user in different monitoring periods.

[0008] The access control module compares the behavior sensitivity with the sensitivity threshold. When the behavior sensitivity is not less than the sensitivity threshold, the access control module blocks the corresponding user from accessing the storage and records it in the security log of the security management platform.

[0009] According to a preferred embodiment, the behavior recognition module maps the storage access data of each user into the behavior topology graph to construct a corresponding behavior edge for each user in the behavior topology graph, including:

[0010] The behavior identification module obtains all associated users who have interaction records with the corresponding user based on the interaction behavior data of the corresponding user, and maps the interaction records between the corresponding user and each associated user to the corresponding two vertices in the behavior topology graph to construct a corresponding behavior edge for each user, wherein the interaction record includes interaction time, interaction type and interaction content.

[0011] According to a preferred embodiment, the behavior recognition module analyzes the interaction behavior of the corresponding user according to all the behavior edges of each user in the behavior topology graph to obtain the interaction behavior characteristics of the corresponding user, including:

[0012] The behavior recognition module determines the periodic correlation between the corresponding user and each of its associated users according to the number of all behavior edges between the corresponding user and each of its associated users in the behavior topology graph, wherein the periodic correlation is used to characterize the closeness of the relationship between the corresponding user and its corresponding associated users within the corresponding monitoring period;

[0013] The behavior recognition module extracts the features of all interaction records between the corresponding user and each of its associated users to obtain the interaction features of each behavior edge, and performs weighted average of the periodic correlation between each user and each of its associated users in different monitoring periods according to the interaction features of each behavior edge to obtain the time domain correlation between the corresponding user and each of its associated users;

[0014] The behavior recognition module analyzes the interaction behavior of the corresponding user according to all behavior edges and time domain correlations between each user and each of its associated users to obtain the interaction behavior characteristics of the corresponding user, wherein the interaction behavior characteristics are used to characterize the communication frequency characteristics, communication topic characteristics and communication duration characteristics between the corresponding user and all of its associated users.

[0015] According to a preferred embodiment, the sensitivity analysis module obtains the behavioral sensitivity of the behavior topology graph in the current monitoring period according to the time series anomaly of each user and the behavioral similarity between each user in different monitoring periods, including:

[0016] The sensitivity analysis module obtains the behavioral similarity between each user in different monitoring periods, and converts the behavioral similarity between all users into a corresponding similarity matrix according to the time series of each different monitoring period, wherein the time series is used to characterize the time sequence of the corresponding monitoring period in the time domain;

[0017] The sensitivity analysis module maps each behavior similarity feature vector in the similarity matrix to the corresponding feature subspace to eliminate the normal fluctuation characteristics of each behavior similarity feature vector to obtain the main feature vector of each behavior similarity feature vector, and extracts variables from each main feature vector to obtain the similarity anomaly between each user in the time domain. The similarity anomaly is used to characterize the abnormal fluctuation of the behavior similarity between each user in the time domain;

[0018] The sensitivity analysis module determines the autocorrelation coefficient and the overall correlation coefficient of each user according to the network responsiveness of each user, and performs weighted fusion on the timing anomaly and similarity anomaly of each user according to the autocorrelation coefficient and the overall correlation coefficient to obtain the behavioral sensitivity of the behavior topology in the current monitoring period.

[0019] In addition, a storage security management system is provided, which executes the storage security management method as described above. The storage security management system includes a security management platform and a plurality of user clients having communication connections therewith; the security management platform includes a data acquisition module, a behavior recognition module, a timing analysis module, a sensitivity analysis module and an access control module.

[0020] The present invention has the following beneficial effects:

[0021] The data acquisition module of the security management platform constructs a corresponding behavior topology for all users based on the interactive behavior data generated by each user. The behavior recognition module obtains the interactive behavior characteristics of the corresponding user based on the behavior edge analysis. The timing analysis module obtains the behavioral similarity between each user based on the interactive behavior characteristics analysis. The sensitivity analysis module analyzes the behavioral sensitivity of the behavior topology in the current monitoring cycle. The access control module determines whether to allow the corresponding user to access the storage based on the behavioral sensitivity. Therefore, through the interactive behavior data generated by the associated user clients within the organization, the user's access rights to storage are periodically analyzed and determined, which can be applied to domestic chips and operating systems, ensuring the reliable storage of key data generated in the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 is a flowchart of a storage security management method in an embodiment of the present invention;

[0023] Figure 2 It is a structural block diagram of the storage security management system in an embodiment of the present invention. DETAILED DESCRIPTION

[0024] In order to make the purpose, technical scheme and advantages of the present invention clearer, the present invention is further described in detail below in conjunction with specific embodiments and with reference to the accompanying drawings. It should be understood that these descriptions are only exemplary and are not intended to limit the scope of the present invention. In addition, in the following description, the description of well-known structures and technologies is omitted to avoid unnecessary confusion of the concept of the present invention.

[0025] The terms used in the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. The singular forms "a", "the" and "the" used in the present invention and the appended claims are also intended to include plural forms unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0026] It should be understood that although the terms first, second, third, etc. may be used in the present invention to describe various information, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of the present invention, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0027] See also Figure 1 In one embodiment, the storage security management method of the present invention may include:

[0028] S1. The data acquisition module of the security management platform periodically acquires the interactive behavior data generated by each user in the user client through the corresponding data interface, and constructs a corresponding behavior topology map for all users based on the interactive behavior data of each user, wherein the interactive behavior data includes user relationship data and storage access data.

[0029] S2. The behavior recognition module maps the storage access data of each user to a behavior topology graph to construct a corresponding behavior edge for each user in the behavior topology graph, and analyzes the interaction behavior of the corresponding user based on all the behavior edges of each user in the behavior topology graph to obtain the interaction behavior characteristics of the corresponding user, wherein the behavior edge is used to characterize the interaction behavior between the corresponding users.

[0030] Optionally, the behavior recognition module maps the storage access data of each user into the behavior topology graph to construct a corresponding behavior edge for each user in the behavior topology graph, including:

[0031] The behavior recognition module obtains all associated users with whom the user has interaction records based on the interaction behavior data of the corresponding user, and maps the interaction records between the corresponding user and each associated user to the corresponding two vertices in the behavior topology graph to construct a corresponding behavior edge for each user, wherein the interaction record includes interaction time, interaction type and interaction content. The associated user is the user with whom the target user has interaction records.

[0032] Optionally, the behavior recognition module maps the interaction records between the corresponding user and each associated user to between two corresponding vertices in the behavior topology graph to construct a corresponding behavior edge for each user, wherein each vertex in the behavior topology graph corresponds to a user.

[0033] Specifically, the behavior recognition module analyzes the interaction behavior of the corresponding user according to all the behavior edges of each user in the behavior topology graph to obtain the interaction behavior features of the corresponding user including:

[0034] The behavior recognition module determines the periodic correlation between the corresponding user and each of its associated users according to the number of all behavior edges between the corresponding user and each of its associated users in the behavior topology graph, wherein the periodic correlation is used to characterize the closeness of the relationship between the corresponding user and its corresponding associated users within the corresponding monitoring period;

[0035] The behavior recognition module extracts the features of all interaction records between the corresponding user and each of its associated users to obtain the interaction features of each behavior edge, and performs weighted average of the periodic correlation between each user and each of its associated users in different monitoring periods according to the interaction features of each behavior edge to obtain the time domain correlation between the corresponding user and each of its associated users;

[0036] The behavior recognition module analyzes the interaction behavior of the corresponding user according to all behavior edges and time domain correlations between each user and each of its associated users to obtain the interaction behavior characteristics of the corresponding user, wherein the interaction behavior characteristics are used to characterize the communication frequency characteristics, communication topic characteristics and communication duration characteristics between the corresponding user and all of its associated users.

[0037] S3. The timing analysis module obtains the behavior similarity between each user based on the interaction behavior characteristics of each user in the behavior topology diagram, obtains the interaction behavior characteristics of each user in different monitoring periods, and arranges all the interaction behavior characteristics in order to obtain the behavior sequence of each user, and then obtains the timing anomaly of each user based on the behavior sequence analysis of each user.

[0038] Optionally, the temporal anomaly degree is used to characterize the characteristic fluctuation amount of each user's interactive behavior characteristics in the time domain.

[0039] S4. The sensitivity analysis module obtains the behavioral sensitivity of the behavior topology in the current monitoring period according to the time series anomaly of each user and the behavioral similarity between each user in different monitoring periods.

[0040] Specifically, the sensitivity analysis module analyzes the behavior sensitivity of the behavior topology graph in the current monitoring period according to the time series anomaly of each user and the behavior similarity between each user in different monitoring periods, including:

[0041] The sensitivity analysis module obtains the behavioral similarity between each user in different monitoring periods, and converts the behavioral similarity between all users into a corresponding similarity matrix according to the time series of each different monitoring period, where the time series is used to represent the time sequence of the corresponding monitoring period in the time domain;

[0042] The sensitivity analysis module maps each behavior similarity feature vector in the similarity matrix to the corresponding feature subspace to eliminate the normal fluctuation characteristics of each behavior similarity feature vector to obtain the main feature vector of each behavior similarity feature vector, and performs variable extraction on each main feature vector to obtain the similarity abnormality between each user in the time domain. The similarity abnormality is used to characterize the abnormal fluctuation amount of the behavior similarity between each user in the time domain;

[0043] The sensitivity analysis module determines the autocorrelation coefficient and overall correlation coefficient of each user according to the network responsiveness of each user, and performs weighted fusion on the temporal anomaly and similar anomaly of each user according to the autocorrelation coefficient and the overall correlation coefficient to obtain the behavioral sensitivity of the behavior topology graph in the current monitoring period, where the autocorrelation coefficient is used to characterize the impact of the change of the user's own state on the behavioral sensitivity. The overall correlation coefficient is used to characterize the impact of the state change between the user and its associated users on the behavioral sensitivity.

[0044] S5. The access control module compares the behavior sensitivity with the sensitivity threshold. When the behavior sensitivity is not less than the sensitivity threshold, the access control module blocks the corresponding user from accessing the storage and records it in the security log of the security management platform.

[0045] In this way, the interactive behavior data generated by each user in the data acquisition module of the security management platform of the present invention constructs a corresponding behavior topology for all users, the behavior recognition module obtains the interactive behavior characteristics of the corresponding user based on the behavior edge analysis, the timing analysis module obtains the behavioral similarity between each user based on the interactive behavior characteristics analysis, the sensitivity analysis module analyzes the behavioral sensitivity of the behavior topology in the current monitoring cycle, and the access control module determines whether to allow the corresponding user to access the storage based on the behavioral sensitivity. Therefore, through the interactive behavior data generated by the associated user clients within the organization, the user's access rights to storage are periodically analyzed and determined, which can be applied to domestic chips and adapted to domestic operating systems, ensuring the reliable storage of key data generated in the system.

[0046] like Figure 2 As shown, the present invention also provides a storage security management system, which includes a security management platform and multiple user clients that are in communication connection with the security management platform. The security management platform includes a data acquisition module, a behavior recognition module, a timing analysis module, a sensitivity analysis module and an access control module.

[0047] The data acquisition module is used to periodically acquire the interactive behavior data generated by each user in the user client through the corresponding data interface, and construct a corresponding behavior topology map for all users based on the interactive behavior data of each user, wherein the interactive behavior data includes user relationship data and storage access data.

[0048] The behavior identification module is used to map the storage access data of each user into a behavior topology graph to construct a corresponding behavior edge for each user in the behavior topology graph, and analyze the interaction behavior of the corresponding user based on all the behavior edges of each user in the behavior topology graph to obtain the interaction behavior characteristics of the corresponding user, wherein the behavior edge is used to characterize the interaction behavior between the corresponding users.

[0049] The timing analysis module is used to obtain the behavior similarity between each user based on the interaction behavior characteristics of each user in the behavior topology diagram, obtain the interaction behavior characteristics of each user in different monitoring periods and arrange all the interaction behavior characteristics in order to obtain the behavior sequence of each user, and obtain the timing anomaly of each user based on the behavior sequence analysis of each user.

[0050] The sensitivity analysis module is used to obtain the behavioral sensitivity of the behavior topology in the current monitoring period based on the time series anomaly of each user and the behavioral similarity between each user in different monitoring periods.

[0051] The access control module compares the behavior sensitivity with the sensitivity threshold. When the behavior sensitivity is not less than the sensitivity threshold, the access control module blocks the corresponding user from accessing the storage and records it in the security log of the security management platform.

[0052] In addition, although specific functions are discussed above with reference to specific modules, it should be noted that the functions of the various modules discussed herein may be divided into multiple modules, and / or at least some functions of multiple modules may be combined into a single module. In addition, the specific module discussed herein performing an action includes the specific module itself performing the action, or alternatively the specific module calling or otherwise accessing another component or module that performs the action (or performing the action in conjunction with the specific module). Therefore, the specific module that performs an action may include the specific module itself that performs the action and / or another module that the specific module that performs the action calls or otherwise accesses.

[0053] It should be understood that, although the terms first, second, third, etc. may be used to describe various devices, components, parts or elements in this article, these devices, components, parts or elements should not be limited by these terms. These terms are only used to distinguish one device, component, part or element from another device, component, part or element.

[0054] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A storage security management method, characterized in that: The method comprises: The data acquisition module of the security management platform periodically acquires the interactive behavior data generated by each user in the user client through the corresponding data interface, and constructs a corresponding behavior topology map for all users according to the interactive behavior data of each user, wherein the interactive behavior data includes user relationship data and storage access data; The behavior recognition module maps the storage access data of each user into a behavior topology graph to construct a corresponding behavior edge for each user in the behavior topology graph, and analyzes the interaction behavior of the corresponding user according to all the behavior edges of each user in the behavior topology graph to obtain the interaction behavior characteristics of the corresponding user, wherein the behavior edge is used to characterize the interaction behavior between the corresponding users; The time series analysis module obtains the behavior similarity between each user based on the interaction behavior characteristics of each user in the behavior topology diagram, obtains the interaction behavior characteristics of each user in different monitoring periods, and arranges all the interaction behavior characteristics in order to obtain the behavior sequence of each user, and then obtains the time series anomaly of each user based on the behavior sequence of each user; The sensitivity analysis module obtains the behavioral sensitivity of the behavior topology graph in the current monitoring cycle based on the time series anomaly of each user and the behavioral similarity between each user in different monitoring cycles; The access control module compares the behavior sensitivity with the sensitivity threshold. When the behavior sensitivity is not less than the sensitivity threshold, the access control module blocks the corresponding user from accessing the storage and records it in the security log of the security management platform.

2. The method according to claim 1, characterized in that The behavior recognition module maps the storage access data of each user into the behavior topology graph to construct corresponding behavior edges for each user in the behavior topology graph, including: The behavior identification module obtains all associated users with whom there are interaction records based on the interaction behavior data of the corresponding user, and maps the interaction records between the corresponding user and each associated user to the corresponding two vertices in the behavior topology graph to construct a corresponding behavior edge for each user, wherein the interaction record includes interaction time, interaction type and interaction content.

3. The method according to claim 2, characterized in that The behavior recognition module analyzes the interaction behavior of the corresponding user according to all the behavior edges of each user in the behavior topology graph to obtain the interaction behavior characteristics of the corresponding user, including: The behavior recognition module determines the periodic correlation between the corresponding user and each of its associated users according to the number of all behavior edges between the corresponding user and each of its associated users in the behavior topology graph, wherein the periodic correlation is used to characterize the closeness of the relationship between the corresponding user and its corresponding associated users within the corresponding monitoring period; The behavior recognition module extracts the features of all interaction records between the corresponding user and each of its associated users to obtain the interaction features of each behavior edge, and performs weighted average of the periodic correlation between each user and each of its associated users in different monitoring periods according to the interaction features of each behavior edge to obtain the time domain correlation between the corresponding user and each of its associated users; The behavior recognition module analyzes the interaction behavior of the corresponding user according to all behavior edges and time domain correlations between each user and each of its associated users to obtain the interaction behavior characteristics of the corresponding user, wherein the interaction behavior characteristics are used to characterize the communication frequency characteristics, communication topic characteristics and communication duration characteristics between the corresponding user and all of its associated users.

4. The method according to claim 3, characterized in that The sensitivity analysis module analyzes the behavior topology graph in the current monitoring cycle based on the time series anomaly of each user and the behavior similarity between each user in different monitoring cycles. The behavior sensitivity includes: The sensitivity analysis module obtains the behavioral similarity between each user in different monitoring periods, and converts the behavioral similarity between all users into a corresponding similarity matrix according to the time series of each different monitoring period, wherein the time series is used to characterize the time sequence of the corresponding monitoring period in the time domain; The sensitivity analysis module maps each behavior similarity feature vector in the similarity matrix to the corresponding feature subspace to eliminate the normal fluctuation characteristics of each behavior similarity feature vector to obtain the main feature vector of each behavior similarity feature vector, and performs variable extraction on each main feature vector to obtain the similarity abnormality between each user in the time domain, wherein the similarity abnormality is used to characterize the abnormal fluctuation amount of the behavior similarity between each user in the time domain; The sensitivity analysis module determines the autocorrelation coefficient and overall correlation coefficient of each user according to the network responsiveness of each user, and performs weighted fusion on the timing anomaly and similarity anomaly of each user according to the autocorrelation coefficient and the overall correlation coefficient to obtain the behavioral sensitivity of the behavior topology graph in the current monitoring period, where the autocorrelation coefficient is used to characterize the impact of changes in the user's own state on the behavioral sensitivity.

5. A storage security management system, characterized in that: The storage security management system executes the storage security management method as described in claim 1, and the storage security management system includes a security management platform and multiple user clients that are communicatively connected to it; the security management platform includes a data acquisition module, a behavior recognition module, a timing analysis module, a sensitivity analysis module and an access control module.

Images