Data security operation integration method

Abstract

The invention discloses a data security operation integration method, which comprises the following steps: classifying and collecting data information of a terminal, collecting and sorting threat samples, extracting features of the threat samples, calculating threat indexes based on data collection and feature extraction of the threat samples, and obtaining a threat result. Performing network partitioning on the terminal through the threat index calculated in the step S103, and classifying the information according to the threat index; and monitoring the operation condition of the terminal in real time, and adjusting the calculation formula of the threat index according to the operation condition. The unit threat index is calculated to realize quantitative evaluation of the safety condition of the partition, a scientific basis is provided for model adaptation, and the model calculation formula is redesigned to enhance the pertinence and accuracy of the model; based on the unit transition value, the sub-models are dynamically adjusted or recombined to form a transition group sub-model adaptive to the future state of the unit, so that the adaptability and prediction accuracy of the model to the dynamic change of the unit are improved, and the stability and optimization of the system performance are ensured.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a data security operation integrated method. Background Art

[0002] In the current digital age, data security has become a key factor that cannot be ignored by enterprises and organizations. With the rapid development of network technology and the sharp increase in data volume, data security operation integration has become an important means to ensure the security of information assets and enhance overall defense capabilities. Data security operation integration aims to build a comprehensive, efficient and coordinated data security protection system by integrating multiple links such as data classification, threat detection, risk assessment, and response strategy. The traditional data security management model is often scattered in various business departments and lacks a unified management and coordination mechanism, resulting in poor implementation of security strategies and low response efficiency. The data security operation integration method realizes the full life cycle management of data security through centralized management, unified strategy, and coordinated response. This method first requires comprehensive and detailed classification and collection of terminal data information, including hardware information, software information, network parameters, time information, and terminal user information, etc., to provide a detailed data basis for subsequent security analysis and risk assessment.

[0003] For example, Chinese patent publication number CN116723034 discloses an intelligent data monitoring system and method for Internet information security, the method comprising: dividing the network according to a first preset condition to obtain multiple first networks; deploying multiple data collection nodes on the first network and collecting first network data; sending the first network data to a data processing center via a first communication method; preprocessing the first network data to obtain second network data; performing intelligent analysis on the second network data to obtain first analysis data; evaluating and inferring the first analysis data to obtain first evaluation data; determining a first early warning strategy based on the first evaluation data; sending a first data security analysis report and suggestions obtained from the first evaluation data to a control center based on the first early warning strategy; formulating first disposal measures and processes based on the first data security analysis report and suggestions and executing the disposal measures.

[0004] In existing patent technologies, network partitions are rigid, the amount of data that can be processed by a single network partition is limited, and the accuracy, real-time performance, and stability of data processing by the system are insufficient. Summary of the invention

[0005] The present application provides an integrated data security operation method, which realizes a comprehensive evaluation of the dynamic changes of the unit by calculating the unit variable amplitude and unit variable form, dynamically adjusts the model parameters or structure based on the unit variable value, forms a sub-model that adapts to the unit changes, improves the model's pertinence and accuracy, and ensures the stability and optimization of system performance.

[0006] This application provides an integrated data security operation method, including:

[0007] S101, classifying and collecting data information of the terminal;

[0008] S102, collecting and organizing threat samples, and extracting features of the threat samples;

[0009] S103, calculating a threat index based on the data collection and feature extraction of threat samples in steps 101 to 102;

[0010] S104, performing network partitioning on the terminal according to the threat index calculated in step S103;

[0011] S105, classifying information according to threat index;

[0012] S106, monitoring the operation status of the terminal in real time, and adjusting the calculation formula of the threat index according to the operation status.

[0013] Preferably, static analysis is performed on threat samples, threat samples to be analyzed are selected from the threat sample library, decompilation tools are used to parse the code of threat samples, and URLs, IP addresses, domain names, and file paths in samples are extracted; dynamic analysis is performed on threat samples, samples are run in an isolated environment, and behavior monitoring tools are used to record file operations, process creation, and network communication operation behaviors, capture network traffic when threat samples are running, analyze communication patterns and data transmission content, and identify communication targets and communication methods of threat samples.

[0014] Preferably, the operating system version, security software installation status and network connection status are used as influencing factors of the threat index, and the weights are assigned according to the degree of impact, frequency of occurrence and controllability. The calculation formula for constructing the threat index based on the influencing factors and weights is: Threat Index = ∑(weight_i×influence factor value_i), wherein Σ represents a summation operation, weight_i represents the weight of the i-th influencing factor, and influence factor value_i represents the quantized value of the i-th influencing factor.

[0015] Preferably, the threat index is divided into three levels: high, medium and low, the set partitioning standards are organized into documents, the threat index of each terminal is matched with the set network partitioning standards, and the network partition to which the terminal belongs is determined. According to the matching results, terminals with high threat indexes are divided into high-risk partitions, and terminals with low threat indexes are divided into low-risk partitions.

[0016] Preferably, the terminals are network partitioned by unit threat index:

[0017] S201, calculating a unit threat index based on the threat index within the network partition;

[0018] S202, adapting the model based on the calculated unit threat index;

[0019] S203: readjust the model calculation formula according to the model adaptation result.

[0020] Preferably, the unit threat index is the threat index of all terminals in the network partition, and the average value, standard deviation, maximum value and minimum value of the terminal threat index in the network partition are calculated. Based on the calculated average value, standard deviation, maximum value and minimum value of the terminal threat index, the formula is obtained: unit threat index = α×average value + β×maximum value + γ×standard deviation + δ×(1-minimum value), where α, β, γ and δ are weight coefficients.

[0021] Preferably, the formula of the learning rate in the model is adjusted, and the unit threat index is added to the formula of the learning rate to obtain the adjusted learning rate formula: Among them, lr is the current learning rate, lr_init is the initial learning rate, k is the current iteration round, max_k is the total number of iterations, α is the influence coefficient of the threat index, and threat_index is the current unit threat index. The formula for the search interval of the number of nodes is adjusted, and the unit threat index is used as a factor to adjust the number of nodes. The adjusted formula is: Among them, f is the number of features, c is the number of categories, m is the magnification factor, which is generally between 2 and 10, β is the influence coefficient of threat index on the number of nodes, and num_nodes is the search interval of the number of nodes.

[0022] Preferably, the units in the network partition will change, and the specific steps for calculating the unit variable amplitude and unit variable shape are:

[0023] S301, calculating the unit variable amplitude by collecting data within the time window;

[0024] S302, identifying unit variable forms, and classifying the identified unit variable forms;

[0025] S303, calculating the unit variable value according to the unit variable amplitude and the unit variable form;

[0026] S304, adjusting or combining the models according to the calculated unit variable values, and constructing a sub-model by adjusting or combining the models;

[0027] S305, dynamically adjust and optimize the parameters of the sub-model.

[0028] Preferably, the calculation formula for the unit variable value is: V=wA×A+wM×M, wherein V is the unit variable value, A is the unit variable amplitude, reflecting the strength or size of the variable, M is the unit variable morphological score, a score value given according to the classification and characteristics of the morphology, reflecting the morphological adaptability of the variable, and wA and wM are the weights of the amplitude and morphology, respectively.

[0029] Preferably, the step of adding the time dimension to the unit variable value is:

[0030] S401, collect the status data of the unit, sort the collected data in chronological order, and form time series data;

[0031] S402, calculating the unit transition value according to the time series data;

[0032] S403, dynamically adjusting the sub-model through the unit transition value to construct a transition group sub-model;

[0033] S404, real-time monitoring of the transition group sub-model.

[0034] One or more technical solutions provided in this application have at least the following technical effects or advantages: by calculating the unit threat index, a quantitative assessment of the partition security status is achieved, providing a scientific basis for model adaptation, and by redesigning the model calculation formula, the pertinence and accuracy of the model are enhanced, so that the system can handle various security threats more efficiently, shorten the threat response time, reduce security risks, enable the model to flexibly respond to the ever-changing threat environment, and improve the accuracy and stability of the model;

[0035] By calculating the unit variable amplitude and unit variable form, a comprehensive evaluation of the unit dynamic changes is achieved. Based on the unit variable value, the model parameters or structure are dynamically adjusted to form a sub-model that adapts to the unit changes, thereby improving the model's pertinence and accuracy and ensuring the stability and optimization of system performance.

[0036] By calculating the unit transition value, the future changes of the unit state can be predicted and evaluated. Based on the unit transition value, the sub-models are dynamically adjusted or recombined to form a transition group sub-model that adapts to the future state of the unit, thereby improving the model's adaptability to the dynamic changes of the unit and the prediction accuracy, and ensuring the stability and optimization of the system performance. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 A schematic diagram of a process of a data security operation integration method of the present invention;

[0038] Figure 2 A schematic diagram of a process of performing network partitioning on a terminal by using a unit threat index and a threat type according to an embodiment of the present invention;

[0039] Figure 3 A schematic diagram of a flow chart of calculating unit variable amplitude and unit variable form according to an embodiment of the present invention;

[0040] Figure 4 The figure is a flowchart of specific steps for calculating unit variable amplitude and unit variable form according to an embodiment of the present invention. DETAILED DESCRIPTION

[0041] To facilitate the understanding of the present invention, the present application will be described more comprehensively below with reference to the relevant drawings; the drawings show preferred embodiments of the present invention, but the present invention can be implemented in many different forms and is not limited to the embodiments described herein; on the contrary, the purpose of providing these embodiments is to enable a more thorough and comprehensive understanding of the disclosed content of the present invention.

[0042] It should be noted that the terms “vertical”, “horizontal”, “up”, “down”, “left”, “right” and similar expressions used in this document are only for illustrative purposes and do not represent the only implementation method.

[0043] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by technicians in the technical field to which the present invention belongs; the terms used in the specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention; the term "and / or" used herein includes any and all combinations of one or more related listed items.

[0044] Embodiment 1: Figure 1 The following is a flow chart of a data security operation integration method according to an embodiment of the present invention, comprising the following steps:

[0045] S101, classifying and collecting data information of the terminal;

[0046] Specifically, the terminals are classified into hardware information (such as CPU model, memory capacity), software information (such as operating system version, application software list), network parameters (such as IP address, network bandwidth usage), time information (such as login time, usage time) and terminal user information (such as identity information, authority level), etc., and the hardware information, software information, network parameters, time information and terminal user information are collected.

[0047] S102, collecting and organizing threat samples, and extracting features of the threat samples;

[0048] Furthermore, the system collects a large number of threat samples from multiple sources (such as security vendors, public security databases, honeypot systems, etc.). The threat samples include malware (such as viruses, Trojans, ransomware), network attack traces (such as DDoS attacks, SQL injection attacks), phishing website links, etc., and stores the collected threat samples in a threat sample library.

[0049] Perform static analysis on samples, select samples to be analyzed from the threat sample library, use decompilation tools or reverse engineering tools to parse the sample code to see if the sample contains specific malicious code fragments, encryption algorithms or obfuscation techniques, extract URLs, IP addresses, domain names, file paths and other strings in the sample, and check the resource files such as pictures, audio, and video embedded in the sample; perform dynamic analysis on samples, run samples in an isolated environment, and use behavior monitoring tools to record their file operations, process creation, network communication and other operating behaviors, analyze whether these behaviors are abnormal, capture network traffic when the sample is running, analyze its communication mode, data transmission content, etc., to identify the communication target and communication method of the sample, use system call monitoring tools to record the system call sequence when the sample is running, and analyze its access to and operation of system resources. Based on static analysis and dynamic analysis, identify key features such as sample code structure, behavior pattern, and communication method, encode the identified key features, and store the encoded key features in the feature library.

[0050] S103, calculating a threat index based on the data collection and feature extraction of threat samples in steps 101 to 102;

[0051] Specifically, the operating system version, security software installation status and network connection status are used as influencing factors of the threat index. The influencing factors are related to the security risks of the terminal. The operating system version reflects whether the terminal has installed the latest security patches and updates in a timely manner to reduce the risks of known vulnerabilities. The security software installation status evaluates whether the terminal has installed effective security software (such as antivirus software, firewall, etc.) and whether these software have been correctly configured and updated. The network connection status is analyzed, including whether it is connected to a secure network and whether there is abnormal network traffic. Based on the above selected influencing factors, weights are allocated according to the degree of impact, frequency of occurrence and controllability. The calculation formula for constructing the threat index based on the influencing factors and weights is: Threat Index T = ∑(weight_i×influence factor value_i), where Σ represents a summation operation, weight_i represents the weight of the i-th influencing factor, and influence factor value_i represents the quantized value of the i-th influencing factor (usually a value between 0 and 1, or other numerical ranges set according to specific circumstances).

[0052] In some embodiments, the operating system version (y1), security software installation status (y2) and network connection status (y3), each factor is assigned a weight: the operating system version weight is 0.5, the security software installation status weight is 0.3, the network connection status weight is 0.2, and the threat index T is calculated as follows: T = 0.5×y1+0.3×y2+0.2×y3. In the above formula, the values ​​of y1, y2 and y3 are quantified according to actual conditions. The operating system version can be scored based on factors such as whether it is outdated and whether there are known vulnerabilities; the security software installation status can be scored based on factors such as whether the security software is installed and whether the security software is updated to the latest version; the network connection status can be scored based on factors such as whether the network connection is stable and whether there is abnormal traffic.

[0053] S104, performing network partitioning on the terminal according to the threat index calculated in step S103;

[0054] Furthermore, according to the level of threat index, the calculated threat index value is statistically analyzed, the data is cleaned, the mean and standard deviation of the threat index are calculated, and the threat index is statistically analyzed using a histogram. According to the distribution of the threat index and the security requirements of the network, different partition thresholds are set, and the threat index is divided into three levels: high, medium, and low. The set partition standards are organized into documents, and the threat index of each terminal is matched with the set network partition standards to determine the network partition to which it belongs. According to the matching results, terminals with high threat indexes are divided into high-risk partitions, and terminals with low threat indexes are divided into low-risk partitions. According to the security risk level of each partition and the actual situation of the terminal, targeted security management strategies are formulated, and for terminals in high-risk partitions, more frequent security scanning, monitoring, and auditing measures are implemented.

[0055] In some embodiments, a large network including 1,000 terminals performs statistical analysis on the collected data and finds that the threat index is mainly concentrated between 0 and 100, where 0-30 is a low threat, 31-70 is a medium threat, and 71-100 is a high threat. According to the distribution of the threat index, three partitions are set: low-risk area (0-30), medium-risk area (31-70), and high-risk area (71-100). The threat index of terminal A is 45, which belongs to the medium-risk area. Different management strategies are formulated according to different risk areas. For terminals in low-risk areas, basic security monitoring and regular security scans are implemented; for terminals in medium-risk areas, the frequency of security audits is increased, and some targeted security tools are deployed; for terminals in high-risk areas, strict security monitoring, real-time threat detection and response, and regular security training and drills are implemented.

[0056] S105, classifying information according to threat index;

[0057] Specifically, identify all information assets in the network, analyze each information asset to determine its attributes such as confidentiality, integrity and availability (whether the information is accessible and usable), determine the importance and sensitivity level of the information based on the confidentiality, integrity and availability of the information, as well as the organization's dependence on the information, divide the information into four levels: highly sensitive, sensitive, general and non-sensitive, associate the information with the terminals that store it, and assess the information risk based on the importance of the information and the threat level of the terminals. For highly sensitive information, implement stricter access control (such as multi-factor authentication), encryption measures (such as end-to-end encryption) and audit mechanisms (such as logging and analysis), organize the formulated security policies into documents, and clearly define the objectives, scope of application, implementation steps and responsible persons of each policy.

[0058] S106, monitoring the operation status of the terminal in real time, and adjusting the calculation formula of the threat index according to the operation status;

[0059] Furthermore, the operation of the terminal is monitored in real time, and reasonable thresholds are set for each monitoring indicator based on historical data and security baselines. Once the actual value exceeds the threshold range, an early warning is triggered. According to the early warning situation and actual threat changes, the calculation formula of the threat index is dynamically adjusted to increase or decrease the weight of specific threat types.

[0060] The technical solutions in the above-mentioned embodiments of the present application have at least the following technical effects or advantages: by calculating the threat index, reasonable partitioning of terminals and effective classification of information are achieved, the accuracy and real-time performance of the system in processing information are improved, and the system performance is continuously optimized by optimizing and adjusting the threat index to ensure the stability and security of the system in different scenarios. The calculation formula and threshold setting of the threat index enable the system to more accurately assess the degree of threat and respond accordingly.

[0061] Embodiment 2: Based on Embodiment 1, the embodiment divides the terminal into fine divisions, forms partitions guided by threat index and threat type, calculates the partitions, forms unit threat indexes, and corresponds the unit threat indexes to the adaptation of the model, making the model more targeted.

[0062] like Figure 2 As shown in the figure, the terminals are partitioned into network segments by unit threat index and threat type:

[0063] S201, calculating a unit threat index based on the threat index within the network partition;

[0064] Specifically, the unit threat index is the threat index of all terminals within a specific network partition (formed by the threat index), and the average value, standard deviation, maximum value and minimum value of the network partition terminal threat index are calculated. The formula is obtained based on the calculated average value, standard deviation, maximum value and minimum value of the terminal threat index: Unit threat index = α×average value + β×maximum value + γ×standard deviation + δ×(1-minimum value), where α, β, γ, and δ are weight coefficients used to adjust the influence of each statistical indicator in calculating the unit threat index. The weight coefficient can be adjusted according to actual conditions and expert experience.

[0065] In some embodiments, a network partition includes threat indexes of the following four terminals: the threat index of the first terminal is 0.6, the threat index of the second terminal is 0.8, the threat index of the third terminal is 0.5, and the threat index of the fourth terminal is 0.9. The average value, standard deviation, maximum value, and minimum value of the threat indexes of these terminals are calculated. Assuming that the weight coefficients are α=0.5, β=0.3, γ=0.1, and δ=0.1, we substitute them into the unit threat index formula and obtain: Unit threat index=0.5×0.7+0.3×0.9+0.1×0.16+0.1×(1-0.5)≈0.65. Therefore, the unit threat index of the network partition is approximately 0.65, which reflects the overall level and discrete degree of the terminal threat index in the network partition.

[0066] S202, adapting the model based on the calculated unit threat index;

[0067] Furthermore, the unit threat index reflects the risk of the unit being attacked or failing. A threshold range is preset, which includes a maximum threshold and a minimum threshold. When the unit threat index exceeds the maximum threshold, it indicates that the unit faces a serious threat. The model should increase the detection sensitivity for specific threat types, and enhance the defense capability of the model by increasing the detection frequency, increasing the complexity of the detection rules, or introducing more advanced detection algorithms. When the unit threat index is at a medium level, the model should maintain the current detection frequency and sensitivity, and pay attention to the trend of the threat index change so as to make timely adjustments. When the unit threat index is lower than the minimum threshold, it indicates that the unit is currently facing a small threat. In order to avoid resource waste, the model reduces the detection frequency accordingly, while maintaining the basic monitoring capability of potential threats. According to the changes in the unit threat index, the detection rules are updated according to the latest threat intelligence and attack patterns. By adjusting the detection threshold, algorithm parameters, etc. of the model, the sensitivity of the model to threats is changed. At the same time, according to the changes in the threat index, the computing resources and storage resources required for the model operation are dynamically adjusted to ensure that resource consumption is minimized while maintaining efficient detection.

[0068] S203, readjusting the model calculation formula according to the model adaptation result;

[0069] Furthermore, the learning rate formula in the model is adjusted by adding the unit threat index to the learning rate formula to obtain the adjusted learning rate formula: Among them, lr is the current learning rate, lr_init is the initial learning rate, k is the current iteration round, max_k is the total number of iterations, α is the influence coefficient of the threat index, and threat_index is the current unit threat index. The formula for the search interval of the number of nodes is adjusted, and the unit threat index is used as a factor to adjust the number of nodes. The adjusted formula is: Among them, f is the number of features, c is the number of categories, m is the magnification factor, which is generally between 2 and 10, and β is the influence coefficient of the threat index on the number of nodes, which is determined based on historical data analysis.

[0070] The technical solutions in the above-mentioned embodiments of the present application have at least the following technical effects or advantages: by calculating the unit threat index, a quantitative assessment of the partition security status is achieved, providing a scientific basis for model adaptation; by redesigning the model calculation formula, the pertinence and accuracy of the model are enhanced, so that the system can handle various security threats more efficiently, shorten the threat response time, reduce security risks, enable the model to flexibly respond to the ever-changing threat environment, and improve the accuracy and stability of the model.

[0071] Embodiment 3: Based on the fact that the unit in Embodiment 2 will change, this embodiment calculates the unit variable amplitude and unit variable form to achieve a comprehensive evaluation of the dynamic changes of the unit.

[0072] like Figure 3 As shown in the figure, the specific steps for calculating the unit variable amplitude and unit variable shape are:

[0073] S301, calculating the unit variable amplitude by collecting data within the time window;

[0074] Specifically, according to the characteristics of the system, the time window is set to 10 minutes, and according to the characteristics and change speed of the parameters, the data sampling frequency is set to once per second. The data values ​​of the parameters are collected in real time and stored in a database. For the collected data, the maximum and minimum values ​​of each parameter in the time window are calculated, and the unit variable amplitude is determined according to the calculated maximum and minimum values. The unit variable amplitude is the difference between the maximum and minimum values ​​of the parameter in the time window. The calculated unit variable amplitude is stored in a specified data structure, such as a dictionary, a database table, etc. An independent storage area is set for each parameter, and information such as the calculation time window and the calculation method is marked. As new data is added, the unit variable amplitude is recalculated regularly (such as every hour, every day, etc.), and the stored value is updated to ensure the timeliness and accuracy of the update, so as to avoid using outdated data for analysis and decision-making.

[0075] S302, identifying unit variable forms, and classifying the identified unit variable forms;

[0076] Furthermore, the parameters are analyzed in combination, and the correlation coefficient between each pair of parameters is calculated to measure the degree of linear correlation between them. According to the value of the correlation coefficient (usually between -1 and 1), it is judged whether the parameters are positively correlated, negatively correlated or uncorrelated; a covariance matrix between parameters is constructed to reflect the common change trend between multiple parameters, and the overall correlation structure and main change direction between parameters are understood by analyzing the eigenvalues ​​and eigenvectors of the covariance matrix; the parameters are clustered to classify parameters with similar behaviors or characteristics, and the clustering results are used to identify parameter groups, and the interactions and differences within and between groups are analyzed. Based on the correlation coefficient, covariance matrix and cluster analysis of the parameters, a scatter plot or line graph is used to display the relationship and change trend between the parameters, and the change pattern of the parameter combination, that is, the unit variable form, is identified by observing the shape, trend and outliers of the graph.

[0077] According to the characteristics and properties of the morphology, classification principles are formulated, and classification is carried out according to the shape, trend, amplitude or phase of the morphology. Based on the classified unit variable morphology, a morphological classification system is established.

[0078] S303, calculating the unit variable value according to the unit variable amplitude and the unit variable form;

[0079] Furthermore, through the following formula: V = wA × A + wM × M, where V is the unit variable value, A is the unit variable amplitude, reflecting the strength or size of the variable, M is the unit variable morphological score, a score value given according to the classification and characteristics of the morphology, reflecting the morphological adaptability of the variable, wA and wM are the weights of amplitude and morphology, indicating their importance in the comprehensive calculation, and the size of the weight should be determined according to the actual situation and needs. Compare the calculated unit variable value with the preset threshold. If the unit variable value exceeds the preset threshold, it means that the state of the unit needs to be adjusted, triggering the model deployment or combination mechanism.

[0080] S304, adjusting or combining the models according to the calculated unit variable values, and constructing a sub-model by adjusting or combining the models;

[0081] Specifically, according to the changes in the unit variable values, the thresholds, weights and coefficients in the model are adjusted, and the outputs of multiple models are combined through weighted average, voting mechanism, series or parallel connection to make the results more accurate and comprehensive. The models are deployed or combined to form a new sub-model. The sub-model is verified by using a known data set, and the difference between the model's predicted results and the actual results is compared. The performance of the model is evaluated by calculating indicators such as error rate, accuracy rate, recall rate, etc. If the sub-model does not meet the requirements during the verification and testing process, the model needs to be deployed or combined again.

[0082] S305, dynamically adjusting and optimizing the parameters of the sub-model;

[0083] Furthermore, the changes in the amplitude, shape and value of unit variables are monitored in real time. When these indicators are found to have changed significantly, the model adjustment mechanism is triggered in time. According to the real-time monitoring results and unit change requirements, the parameters or structure of the sub-model are dynamically adjusted to ensure that the sub-model is always highly consistent and adapted to the current unit status.

[0084] The technical solutions in the above-mentioned embodiments of the present application have at least the following technical effects or advantages: by calculating the unit variable amplitude and the unit variable form, a comprehensive evaluation of the dynamic changes of the unit is achieved; based on the unit variable value, the model parameters or structure are dynamically adjusted to form a sub-model that adapts to the unit changes, thereby improving the model's pertinence and accuracy, and ensuring the stability and optimization of the system performance.

[0085] Embodiment 4: Based on the unit variable values ​​of embodiment 3, for units whose unit variable values ​​change in a multi-form regular manner, this embodiment adds a time dimension, calculates the unit transition value, and the unit transition value is used to measure the current state of the unit and the expected state in the next stage. The sub-models are synchronously adjusted for adaptation and calculation to form a transition group sub-model.

[0086] like Figure 4 As shown, the steps to add the time dimension to the unit variable value are:

[0087] S401, collect the status data of the unit, sort the collected data in chronological order, and form time series data;

[0088] Furthermore, historical data of the unit status is collected, including timestamps and status values, and the collected data is sorted in the order of timestamps to form time series data.

[0089] S402, calculating the unit transition value according to the time series data;

[0090] Specifically, the time series data is segmented according to the time window and each day, and the ARIMA model is used for trend fitting, that is, a straight line or curve is used to approximate the trend in the data, and the trend line is fitted by the least square method, linear regression and other methods, and the slope and intercept of the trend are analyzed; the characteristics of the unit are discretized or classified, and the continuous values ​​are divided into a limited interval or category, and a unique identifier is assigned to each state. The state change of the unit over a period of time is observed, and the number of times each state is transferred to other states is recorded. A state transition matrix is ​​constructed according to the number of transfers. Each element in the matrix represents the probability of transferring from one state to another. The row of the matrix represents the current state, and the column represents the next state. The value in the matrix represents the transfer probability. The state is used as the state space of the Markov chain. Each element in the state transfer matrix itself is the transfer probability, which represents the possibility of transferring from one state to another. The state transfer matrix is ​​normalized to obtain the transfer probability, determine the position of the current state in the state space, find the transfer probability of the corresponding row in the state transfer matrix, and calculate the sum of the probabilities of transferring from the current state to all other states.

[0091] S403, dynamically adjusting the sub-model through the unit transition value to construct a transition group sub-model;

[0092] The calculated transition value is compared with the preset threshold. If the transition value exceeds the preset threshold, it is considered that the state change of the unit is active enough and the adjustment or combination mechanism of the sub-model needs to be triggered. If the transition value does not exceed the threshold, it is considered that the state change of the unit is not active enough and the adjustment or combination mechanism of the sub-model does not need to be triggered. The key parameters that affect the prediction performance of the sub-model are identified, and then these parameters are optimized and adjusted based on historical data or real-time data to improve the prediction accuracy of the model. The sub-models that can improve the prediction performance are selected for combination, and the sub-models are weighted combined to form a transition group sub-model.

[0093] S404, real-time monitoring of the transition group sub-model.

[0094] Furthermore, the transition group sub-model is monitored in real time, the prediction effect of the model is analyzed, and the transition group sub-model is optimized and adjusted according to the prediction effect.

[0095] The technical solution in the above-mentioned embodiment of the present application has at least the following technical effects or advantages: by calculating the unit transition value, the prediction and evaluation of the future change of the unit state are realized, and based on the unit transition value, the sub-model is dynamically adjusted or recombined to form a transition group sub-model that adapts to the future state of the unit, thereby improving the adaptability and prediction accuracy of the model to the dynamic change of the unit, and ensuring the stability and optimization of the system performance;

[0096] The above-mentioned embodiments 1 to 4 generally reflect the advantages of integrated data security operations through comprehensive and integrated management, accurate risk assessment and zoning management, detailed information classification and protection, dynamic monitoring and flexible adjustment, etc.

[0097] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A data security operation integrated method, characterized in that: include: S101, classifying and collecting data information of the terminal; S102, collecting and organizing threat samples, and extracting features of the threat samples; S103, calculating a threat index based on the data collection and feature extraction of threat samples in steps 101 to 102; S104, performing network partitioning on the terminal according to the threat index calculated in step S103; S105, classifying information according to threat index; S106, monitoring the operation status of the terminal in real time, and adjusting the calculation formula of the threat index according to the operation status.

2. A data security operation integrated method as claimed in claim 1, characterized in that: Perform static analysis on threat samples, select threat samples to be analyzed from the threat sample library, use decompilation tools to parse the code of threat samples, and extract URLs, IP addresses, domain names, and file paths from samples; perform dynamic analysis on threat samples, run samples in an isolated environment, and use behavior monitoring tools to record file operations, process creation, and network communication operation behaviors, capture network traffic when threat samples are running, analyze communication patterns and data transmission content, and identify the communication targets and methods of threat samples.

3. A data security operation integrated method as claimed in claim 1, characterized in that: The operating system version, security software installation status and network connection status are used as influencing factors of the threat index. The weights are assigned according to the degree of impact, frequency of occurrence and controllability. The calculation formula for constructing the threat index based on the influencing factors and weights is: Threat Index = ∑(weight_i×influence factor value_i), where Σ represents the summation operation, weight_i represents the weight of the i-th influencing factor, and influence factor value_i represents the quantitative value of the i-th influencing factor.

4. A data security operation integrated method as claimed in claim 1, characterized in that: The threat index is divided into three levels: high, medium, and low. The set partitioning standards are organized into documents. The threat index of each terminal is matched with the set network partitioning standards to determine the network partition to which the terminal belongs. Based on the matching results, terminals with high threat indexes are divided into high-risk partitions, and terminals with low threat indexes are divided into low-risk partitions.

5. A data security operation integrated method as claimed in claim 1, characterized in that: Network partitioning of terminals by unit threat index: S201, calculating a unit threat index based on the threat index within the network partition; S202, adapting the model based on the calculated unit threat index; S203: readjust the model calculation formula according to the model adaptation result.

6. A data security operation integrated method as claimed in claim 5, characterized in that: The unit threat index is the threat index of all terminals in the network partition. The average value, standard deviation, maximum value and minimum value of the terminal threat index in the network partition are calculated. Based on the calculated average value, standard deviation, maximum value and minimum value of the terminal threat index, the formula is obtained: unit threat index = α×average value + β×maximum value + γ×standard deviation + δ×(1-minimum value), where α, β, γ and δ are weight coefficients.

7. A data security operation integrated method as claimed in claim 5, characterized in that: Adjust the learning rate formula in the model, add the unit threat index to the learning rate formula, and get the adjusted learning rate formula: Among them, lr is the current learning rate, lr_init is the initial learning rate, k is the current iteration round, max_k is the total number of iterations, α is the influence coefficient of the threat index, and threat_index is the current unit threat index. The formula for the search interval of the number of nodes is adjusted, and the unit threat index is used as a factor to adjust the number of nodes. The adjusted formula is: Among them, f is the number of features, c is the number of categories, m is the magnification factor, which is generally between 2 and 10, β is the influence coefficient of threat index on the number of nodes, and num_nodes is the search interval of the number of nodes.

8. A data security operation integrated method as claimed in claim 6, characterized in that: The cells in the network partition will change. The specific steps for calculating the cell variable amplitude and cell variable shape are: S301, calculating the unit variable amplitude by collecting data within the time window; S302, identifying unit variable forms, and classifying the identified unit variable forms; S303, calculating the unit variable value according to the unit variable amplitude and the unit variable form; S304, adjusting or combining the models according to the calculated unit variable values, and constructing a sub-model by adjusting or combining the models; S305, dynamically adjust and optimize the parameters of the sub-model.

9. A data security operation integrated method as claimed in claim 8, characterized in that: The calculation formula for the unit variable value is: V = wA×A+wM×M, where V is the unit variable value, A is the unit variable amplitude, reflecting the strength or size of the variable, M is the unit variable morphological score, a score value given according to the classification and characteristics of the morphology, reflecting the morphological adaptability of the variable, and wA and wM are the weights of the amplitude and morphology, respectively.

10. A data security operation integrated method as claimed in claim 9, characterized in that: Steps to add the time dimension to the cell variable value: S401, collect the status data of the unit, sort the collected data in chronological order, and form time series data; S402, calculating the unit transition value according to the time series data; S403, dynamically adjusting the sub-model through the unit transition value to construct a transition group sub-model; S404, real-time monitoring of the transition group sub-model.

Images