Information security portrait construction method and device, computer equipment and storage medium

Abstract

The invention discloses an information security portrait construction method and device, computer equipment and a storage medium. The method comprises the steps of obtaining data feature information corresponding to each piece of original data in a financial system; determining risk data and hotspot data in the original data according to the multiple pieces of data feature information, and adding a risk tag to the risk data; obtaining strategy information corresponding to each piece of hotspot data, creating and operating a task corresponding to each piece of strategy information, and obtaining state information of the task in the operation process; if it is determined that malicious behaviors exist in the task operation process according to the state information, malicious labels are added to hotspot data corresponding to the malicious behaviors; the information security portrait corresponding to the financial system is constructed according to the label corresponding to each piece of original data, so that the original data with risk labels or malicious labels are prevented from being online in the financial system. The financial system can provide safe data query service by improving the coverage rate and the accuracy rate of multi-dimensional labels for risks, malicious behaviors and the like in the financial system.

Description

Technical Field

[0001] The present application relates to information security technology, which is applied in the financial field, and in particular to an information security portrait construction method, device, computer equipment and storage medium. Background Art

[0002] In the financial field, ensuring the information security within the financial system can reduce the possibility of violations or malicious behavior in the business system and provide security for the business. Information security portrait is a smart analytical security prevention and control management platform based on big data, which is used for unified information security risk control and management, helping to achieve accurate risk identification, disposal and smart operation, and prevent data leakage.

[0003] The construction of traditional information security risk portraits is a query tool composed of multiple service interfaces and a series of scripts. When extracting and analyzing feature data in massive logs, it is necessary to manually pull data, resulting in incomplete data coverage and low accuracy. In addition, the efficiency of analyzing effective strategies to combat illegal activities is low, and the operating costs are also high, resulting in great hidden dangers to the information security of the financial system. Summary of the invention

[0004] The present application provides a method, apparatus, computer equipment and storage medium for constructing an information security portrait, aiming to solve the problem that due to the high requirements on the voice conversion speed in the real-time question-and-answer scenario of financial customer service, the existing methods ignore the specific details of the speaker in the process of constructing real-time information security portraits, and the generated voice quality is relatively poor, resulting in a less than ideal user experience.

[0005] In a first aspect, the present application provides a method for constructing an information security portrait, including:

[0006] Obtain multiple raw data in the financial system and obtain data feature information corresponding to each raw data;

[0007] Determine risk data and hot spot data in multiple raw data based on multiple data feature information, and add risk labels to the risk data;

[0008] Obtain the policy information corresponding to each hotspot data, create and run the task corresponding to each policy information, and obtain the status information of the task during the running process;

[0009] If it is determined based on the status information that there is malicious behavior during the running of the task, a malicious label is added to the hotspot data corresponding to the malicious behavior;

[0010] Build an information security profile of the financial system based on the label corresponding to each piece of raw data to prevent raw data with risky or malicious labels from being put online in the financial system.

[0011] In some embodiments, the original data includes at least the flow log of the financial system and the newly added data source; obtaining the data feature information corresponding to each original data includes: converting each original data according to a preset standardized format to obtain the standardized log corresponding to the original data; performing feature extraction on each standardized log to obtain the feature vector corresponding to the standardized log, and constructing the data feature information according to the feature vector.

[0012] In some embodiments, multiple operating clusters are constructed within the financial system, each operating cluster includes multiple hot spot data; obtaining policy information corresponding to each hot spot data, including: calculating data feature information corresponding to the hot spot data and feature association information of each operating cluster; determining target association information based on multiple feature association information; adding the hot spot data to the target cluster corresponding to the target association information; using the policy information corresponding to the target cluster as the policy information corresponding to the hot spot data.

[0013] In some embodiments, determining the presence of malicious behavior during operation based on status information includes: parsing the status information, obtaining the malicious behavior type corresponding to the status information; the malicious behavior type includes at least black industry behavior, machine behavior, abnormal user behavior and business violation; obtaining a regular expression corresponding to the status information, scoring each malicious behavior type corresponding to the status information based on the regular expression, and obtaining a malicious behavior score corresponding to the status information; determining whether there is malicious behavior in the status information based on the malicious behavior score.

[0014] In some embodiments, a task corresponding to each policy information is created and run, and status information of the task during the running process is obtained, including: determining the running scenario corresponding to the hotspot data based on the policy information; creating a task and a state machine corresponding to the policy information based on the running scenario, the policy information, and data feature information corresponding to the hotspot data; running the task, and obtaining status information of the task during the running process through the state machine.

[0015] Exemplarily, the method also includes: determining a task execution status corresponding to the task based on status information; generating a control instruction corresponding to the task based on the task execution status, so as to control the task execution according to the control instruction; wherein the control instruction includes at least one of configuration issuance, task rerunning, timeout control and exception analysis.

[0016] In some embodiments, before constructing an information security portrait corresponding to the financial system based on the label corresponding to each original data, it also includes: obtaining data source information of risk data corresponding to the risk label and original data corresponding to the malicious label; in the original data without risk labels and malicious labels, filtering suspicious data information according to the data source information; adding suspicious labels to the suspicious data information to perform real-time monitoring of the original data with suspicious labels in the financial system.

[0017] In a second aspect, the present application provides an information security portrait construction device, comprising:

[0018] A data acquisition module is used to acquire multiple raw data in the financial system and obtain data feature information corresponding to each raw data;

[0019] A risk determination module is used to determine risk data and hot spot data in multiple original data according to multiple data feature information, and add risk labels to the risk data;

[0020] The strategy acquisition module is used to obtain the strategy information corresponding to each hotspot data, create and run the task corresponding to each strategy information, and obtain the status information of the task during the running process;

[0021] A malicious determination module is used to add a malicious tag to the hotspot data corresponding to the malicious behavior if it is determined according to the status information that there is malicious behavior during the operation of the task;

[0022] The portrait construction module is used to construct an information security portrait corresponding to the financial system based on the label corresponding to each raw data, so as to prevent raw data with risk labels or malicious labels from being put online in the financial system.

[0023] In a third aspect, the present application further provides a computer device, including:

[0024] Memory and processor;

[0025] The memory is used to store computer programs;

[0026] The processor is used to execute the computer program and implement the steps of the information security portrait construction method described in the first aspect above when executing the computer program.

[0027] In a fourth aspect, the present application also provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the processor implements the steps of the information security portrait construction method described in the first aspect above.

[0028] The present application discloses a method, device, computer equipment and storage medium for constructing an information security portrait. First, multiple raw data in a financial system are obtained, and data feature information corresponding to each raw data is obtained; then, risk data and hotspot data are determined in multiple raw data according to the multiple data feature information, and risk labels are added to the risk data; then, the policy information corresponding to each hotspot data is obtained, and tasks corresponding to each policy information are created and run, and the status information of the task during the running process is obtained; further, if malicious behavior is determined during the running process of the task according to the status information, malicious labels are added to the hotspot data corresponding to the malicious behavior; finally, the information security portrait corresponding to the financial system is constructed according to the labels corresponding to each raw data, so as to avoid raw data with risk labels or malicious labels from being put online in the financial system.

[0029] Furthermore, the provided method enables the financial system to provide secure and high-performance data query services by improving the coverage and accuracy of multi-dimensional labels such as risks and malicious behaviors in the financial system. The efficiency of analyzing and effectively combating black market behaviors in the financial system is greatly improved, and the operating costs of the financial system are reduced. At the same time, after integrating employee information into the information security portrait, the corresponding employee information security awareness and ability intelligent evaluation of the financial system can also be realized, which will effectively improve employee safety skills, guide employees to establish a good safety awareness, reduce various violations and malicious attacks, and protect the business.

[0030] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0032] Figure 1 This is a flowchart showing the steps of a method for constructing an information security portrait provided by an embodiment of the present application;

[0033] Figure 2 It is a flowchart of data analysis provided by an embodiment of the present application;

[0034] Figure 3 It is a schematic diagram of the architecture corresponding to the information security portrait construction method provided in one embodiment of the present application;

[0035] Figure 4 It is a structural diagram of an information security portrait construction device provided in an embodiment of the present application;

[0036] Figure 5 It is a schematic block diagram of the structure of a computer device provided in one embodiment of the present application.

[0037] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. DETAILED DESCRIPTION

[0038] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0039] The flowcharts shown in the accompanying drawings are only examples and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps may also be decomposed, combined or partially merged, so the actual execution order may change according to actual conditions.

[0040] It should be understood that the terms used in this application specification are only for the purpose of describing specific embodiments and are not intended to limit the application. As used in this application specification and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include plural forms.

[0041] It should also be understood that the term “and / or” used in the specification and appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0042] In conjunction with the accompanying drawings, some embodiments of the present application are described in detail below. In the absence of conflict, the following embodiments and features in the embodiments can be combined with each other.

[0043] In the financial field, ensuring the information security within the financial system can reduce the possibility of violations or malicious behavior in the business system and provide security for the business. Information security portrait is a smart analytical security prevention and control management platform based on big data, which is used for unified information security risk control and management, helping to achieve accurate risk identification, disposal and smart operation, and prevent data leakage.

[0044] The construction of traditional information security risk portraits is a query tool composed of multiple service interfaces and a series of scripts. When extracting and analyzing feature data in massive logs, it is necessary to manually pull data, resulting in incomplete data coverage and low accuracy. In addition, the efficiency of analyzing effective strategies to combat illegal activities is low, and the operating costs are also high, resulting in great hidden dangers to the information security of the financial system.

[0045] To solve the above problems, please refer to Figure 1 , Figure 1 This is a schematic flow chart of an information security portrait construction method provided by an embodiment of the present application. The information security portrait construction method can be implemented by a computer device, which can be deployed on a single server or a server cluster. It can also be deployed on a handheld terminal, a laptop computer, a wearable device or a robot, etc.

[0046] It should be noted that the method provided can be applied to the financial systems corresponding to various enterprises in the financial field, and can also be applied to the medical systems corresponding to various enterprises in the medical field. The method provided can be used in any system that needs to build an information security portrait. Therefore, the embodiment of this application does not limit the application scenario of the method provided.

[0047] like Figure 1 As shown, the information security portrait construction method provided in this embodiment includes steps S101 to S105. The details are as follows:

[0048] S101. Acquire multiple original data in the financial system, and acquire data feature information corresponding to each original data.

[0049] Specifically, by obtaining the original data to be run in the financial system for which the information security profile is to be constructed, or the traffic log to be analyzed as the original data, the data feature information corresponding to each different type of original data can be determined. In addition, the data feature information of different types can be monitored uniformly. It is ensured that the provided method can cover all types of data in the financial system, and avoid the existence of data on black industries (black industries are short for network black industries, which refer to industrial or economic benefits obtained through improper channels and improper means on the Internet) that are put online, resulting in hidden dangers in the information security of the system.

[0050] In some embodiments, the original data includes at least the flow log of the financial system and the newly added data source; obtaining the data feature information corresponding to each original data includes: converting each original data according to a preset standardized format to obtain the standardized log corresponding to the original data; performing feature extraction on each standardized log to obtain the feature vector corresponding to the standardized log, and constructing the data feature information according to the feature vector.

[0051] The newly added data source can be a newly purchased / newly added data source. The traffic log records the operation status of each data flow in the financial system, and then Figure 2 As shown in the flowchart, the computer device passes Figure 2 The control flow, state flow and data flow shown in the figure are combined to convert the original data into a standardized log, and then extract features from the standardized log to obtain the corresponding feature vector. The corresponding labels, such as risk labels, can be written into the standardized log to obtain the real-time label data corresponding to the standardized log.

[0052] For example, Figure 2 As shown, each raw data is converted according to a preset standardized format to obtain a standardized log corresponding to the raw data, including: performing a policy analysis on the raw data shown; converting the format of the raw data according to the analysis results and the standardized format corresponding to the policy analysis to obtain a standardized log corresponding to the raw data. Then, by parsing the policy content corresponding to each raw data and converting it according to the standardized format, multiple different categories of raw data can be standardized to ensure the accuracy of subsequent analysis.

[0053] In some embodiments, a computer device is provided that has a Figure 3 The architecture shown in the figure constructs the capability domain, support domain, common domain and basic data domain for the information security portrait of the financial system.

[0054] The original data can be obtained from third-party data sources, platform logs or internal logs in the basic data domain. The general domain is used to determine the data flow platform corresponding to the data flow, the rule engine for generating various scoring rules, and the business indicator platform for evaluating employees in the financial system. At the same time, the support domain is equipped with a real-time strategy annotation engine for adding tags to strategies and an offline strategy scheduling engine for scheduling strategies.

[0055] The capability domain is equipped with a portal corresponding to the data in the financial system and various query / call libraries / functional modules used in the process of using the data (including but not limited to Figure 3 The modules in the module can be expanded according to actual usage requirements), and the financial system can provide secure data query services through the capability domain.

[0056] The operation domain monitors and manages the labels / strategies / indicators corresponding to the data during the operation of the financial system, so that the corresponding managers of the financial system can realize real-time monitoring of the operation of the financial system. Figure 3The architecture provided by the company can provide high-performance data query services by improving the coverage and accuracy of multi-dimensional label data sets, greatly improving the efficiency of analyzing and effectively combating illegal activities. This reduces the operating costs of the financial system. At the same time, the architecture can also integrate employee information security portraits and realize intelligent evaluation of employee information security awareness and capabilities, which will effectively improve employee security skills, guide employees to establish a good security awareness, reduce various violations and malicious attacks, and protect the business.

[0057] S102. Determine risk data and hot spot data in multiple original data according to multiple data feature information, and add risk tags to the risk data.

[0058] Specifically, by analyzing the data feature information, it is possible to determine whether each raw data has risks, divide the raw data into risk data and hot data, add risk tags to the risk data, and write the risk data into Figure 3 In the tag library corresponding to the architecture shown in the figure, the computer device can select a database that can support high concurrency and low latency as storage, cache hot data, meet high concurrency query requirements, and provide real-time query capabilities to the outside world through high-performance service interfaces.

[0059] S103. Obtain the policy information corresponding to each hotspot data, create and run the task corresponding to each policy information, and obtain the status information of the task during the running process.

[0060] Specifically, as the original data increases, the hotspot data also expands, and the policy information corresponding to the hotspot data operation also increases. In order to reduce the single-point hidden dangers of the system and enhance the monitoring capability, the provided method can monitor the status information of each task operation by creating a corresponding task for each policy information within a preset time and running it, so as to avoid malicious behavior in the hotspot information and cause the information security of the financial system to be leaked.

[0061] In some embodiments, multiple operating clusters are constructed within the financial system, each operating cluster includes multiple hot spot data; obtaining policy information corresponding to each hot spot data, including: calculating data feature information corresponding to the hot spot data and feature association information of each operating cluster; determining target association information based on multiple feature association information; adding the hot spot data to the target cluster corresponding to the target association information; using the policy information corresponding to the target cluster as the policy information corresponding to the hot spot data.

[0062] In order to improve the operating efficiency of the system, the provided method can store the same data by constructing multiple operating clusters in the financial system. This application adds hotspot information to the target cluster with the strongest associated information through a clustering method based on image-text association anomaly detection, and then can add hotspot data with consistent policy information to the corresponding target cluster in real time to simplify the complexity of the policy in the financial system.

[0063] In some embodiments, obtaining the policy information corresponding to each hotspot data includes: obtaining the operation scenario corresponding to the hotspot data; inputting the data feature information and the operation scenario corresponding to the hotspot data into a preset policy generation model, and the policy generation model generates the policy information corresponding to the hotspot data. Thus, the provided method can quickly determine the policy information of the newly generated hotspot data in the corresponding scenario in real time.

[0064] In some embodiments, a task corresponding to each policy information is created and run, and status information of the task during the running process is obtained, including: determining the running scenario corresponding to the hotspot data based on the policy information; creating a task and a state machine corresponding to the policy information based on the running scenario, the policy information, and data feature information corresponding to the hotspot data; running the task, and obtaining status information of the task during the running process through the state machine.

[0065] The provided method determines the operating scenario corresponding to the hotspot data based on the policy information, and then can fuse the operating scenario, policy information and data feature information corresponding to the hotspot data to create tasks corresponding to the hotspot data. Then, it can obtain the tasks created based on the hotspot data operation and create a state machine for each task to control the state flow and obtain the status information of the task during the operation process.

[0066] At the same time, through the provided method, the computer device can establish a distributed offline task scheduling platform for timed execution of policy information, an analysis engine, an access engine, and a scheduling bus. The analysis engine is deployed in a container on servers in various environments and is responsible for the execution of policy information. The output of the policy footer corresponding to the policy information is an update log of hot data. At the same time, the task execution process and exception information are reported to the scheduling bus, which uniformly stores and manages the running status of task execution. The access engine parses the standardized log in a standardized format and writes it into the tag library in real time, and reports the execution status and execution exception information to the scheduling bus. The scheduling bus uniformly accepts the task status information reported by the analysis engine and the access engine.

[0067] Exemplarily, the method also includes: determining a task execution status corresponding to the task based on status information; generating a control instruction corresponding to the task based on the task execution status, so as to control the task execution according to the control instruction; wherein the control instruction includes at least one of configuration issuance, task rerunning, timeout control and exception analysis.

[0068] In the provided method, the computer device can determine the task execution status according to the task information, and can control the task execution by issuing control instructions such as configuration issuance, task re-running, timeout control and exception analysis, or the computer device builds a visual page so that the user can monitor and issue control instructions for each task to perform operations such as configuration issuance, task re-running, timeout control, exception analysis, etc., thereby reducing the workload of data maintenance and deployment, and improving the accuracy of task execution and the efficiency of strategy analysis.

[0069] S104. If it is determined based on the status information that there is malicious behavior during the running of the task, a malicious tag is added to the hotspot data corresponding to the malicious behavior.

[0070] Specifically, to prevent the existence of black industry in hot data and bypass the label-based online strategy, when it is determined that any task has malicious behavior during operation based on the status information, the computer device can promptly add malicious tags to the hot data corresponding to the malicious behavior, thereby preventing the existence of black industry behavior in hot data from threatening the information security of the financial system. The multi-dimensional label detection of data in the financial system is realized, which improves the security of the financial system.

[0071] In some embodiments, determining the presence of malicious behavior during operation based on status information includes: parsing the status information, obtaining the malicious behavior type corresponding to the status information; the malicious behavior type includes at least black industry behavior, machine behavior, abnormal user behavior and business violation; obtaining a regular expression corresponding to the status information, scoring each malicious behavior type corresponding to the status information based on the regular expression, and obtaining a malicious behavior score corresponding to the status information; determining whether there is malicious behavior in the status information based on the malicious behavior score.

[0072] According to the characteristics of the financial system, pre-defined malicious behavior types such as black market behavior, machine behavior, abnormal user behavior, business violations, etc. (malicious behavior can be adjusted for different scenarios / systems), determine whether any of the above malicious behaviors exists in the status information, and specify corresponding rule expressions for each status information (such as the scores of different malicious types in different scenarios / strategies are different). Then, the malicious behavior score can be used to determine that the status information with a total score above the threshold is defined as the presence of malicious behavior (because when the malicious behavior is of low severity in the scenario / the malicious behavior occurs only once, etc., the malicious behavior can be monitored without adding a label). The provided method can accurately monitor malicious behavior by flexibly formulating rule expressions.

[0073] Exemplarily, obtaining a rule expression corresponding to the state information includes: obtaining the policy information corresponding to the state information, the running scenario of the task corresponding to the state information, and generating a rule expression corresponding to the state information according to the policy information and the running scenario. The provided method can determine different rule expressions according to the policy and scenario corresponding to the state information, that is, the same behavior may have different corresponding scores under different state information, thereby realizing flexible monitoring of various hot data.

[0074] S105. Build an information security profile corresponding to the financial system based on the label corresponding to each raw data to prevent raw data with risky or malicious labels from being put online in the financial system.

[0075] Specifically, after adding corresponding labels to each piece of raw data (corresponding labels can also be added to raw data with no risks / no malicious behaviors), a corresponding information security portrait can be constructed based on all labels in the financial system, thereby being able to block raw data with risks and malicious behaviors at the same time. At the same time, corresponding employee security portraits can also be generated for employees who provide such data, so as to realize intelligent evaluation of employees' information security awareness and capabilities, effectively improve employees' safety skills, guide employees to establish a good safety awareness, reduce the occurrence of various violations and malicious attacks, and protect the business.

[0076] In some embodiments, before constructing an information security portrait corresponding to the financial system based on the label corresponding to each original data, it also includes: obtaining data source information of risk data corresponding to the risk label and original data corresponding to the malicious label; in the original data without risk labels and malicious labels, filtering suspicious data information according to the data source information; adding suspicious labels to the suspicious data information to perform real-time monitoring of the original data with suspicious labels in the financial system.

[0077] For data with risks and illegal activities, the source may be an employee and / or any supplier. It is necessary to add suspicious labels to other original data corresponding to the data source information, and then monitor the data with suspicious labels to ensure the safe operation of the financial system. At the same time, the provided method can also be flexibly set, such as blacklisting data source information with suspicious / risky / malicious labels exceeding the total amount of the threshold, and subsequently blocking any data from the source.

[0078] The provided method enables the financial system to provide secure and high-performance data query services by improving the coverage and accuracy of multi-dimensional labels such as risks and malicious behaviors in the financial system. The efficiency of analyzing and effectively combating black market behaviors in the financial system is greatly improved, and the operating costs of the financial system are reduced. At the same time, after integrating employee information into the information security portrait, the corresponding employee information security awareness and ability intelligent evaluation of the financial system can also be realized, which will effectively improve employee security skills, guide employees to establish a good security awareness, reduce various violations and malicious attacks, and escort the business.

[0079] See also Figure 4 As shown, Figure 4 : is a schematic diagram of the structure of the information security portrait construction device 200 provided in an embodiment of the present application. The information security portrait construction device 200 is used to execute the steps of the information security portrait construction method shown in the above embodiments. The information security portrait construction device 200 can be a single server or a server cluster, or the information security portrait construction device 200 can be a terminal, which can be a handheld terminal, a laptop computer, a wearable device or a robot, etc.

[0080] like Figure 4 As shown, the information security portrait construction device 200 includes:

[0081] The data acquisition module 201 is used to acquire multiple original data in the financial system and acquire data feature information corresponding to each original data;

[0082] A risk determination module 202, configured to determine risk data and hotspot data from a plurality of original data according to a plurality of data feature information, and to add risk tags to the risk data;

[0083] The strategy acquisition module 203 is used to acquire the strategy information corresponding to each hotspot data, create and run the task corresponding to each strategy information, and acquire the status information of the task during the running process;

[0084] Malicious determination module 204, used to add malicious tags to hotspot data corresponding to malicious behaviors if it is determined according to the status information that there are malicious behaviors in the running process of the task;

[0085] The portrait construction module 205 is used to construct an information security portrait corresponding to the financial system according to the label corresponding to each original data, so as to prevent the original data with risk labels or malicious labels from being put online in the financial system.

[0086] The above-mentioned information security portrait construction method can be implemented in the form of a computer program. The computer program can be used in Figure 4 Run on the device shown.

[0087] See also Figure 5 , Figure 5 1 is a schematic block diagram of the structure of a computer device provided in an embodiment of the present application. The computer device includes a processor, a memory and a network interface connected via a device bus, wherein the memory may include a storage medium and an internal memory.

[0088] The storage medium can store an operating device and a computer program. The computer program includes program instructions, and when the program instructions are executed, the processor can execute any information security portrait construction method.

[0089] The processor is used to provide computing and control capabilities and support the operation of the entire computer equipment.

[0090] The internal memory provides an environment for the operation of computer programs in non-volatile storage media. When the computer program is executed by the processor, the processor can execute any information security portrait construction method.

[0091] The network interface is used for network communication, such as sending assigned tasks, etc. Those skilled in the art will understand that Figure 5 The structure shown in the figure is only a block diagram of a part of the structure related to the scheme of the present application, and does not constitute a limitation on the terminal to which the scheme of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0092] It should be understood that the processor may be a central processing unit (CPU), and the processor may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Among them, the general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0093] In one embodiment, the processor is used to run a computer program stored in the memory to implement the following steps:

[0094] Obtain multiple raw data in the financial system and obtain data feature information corresponding to each raw data;

[0095] Determine risk data and hot spot data in multiple raw data based on multiple data feature information, and add risk labels to the risk data;

[0096] Obtain the policy information corresponding to each hotspot data, create and run the task corresponding to each policy information, and obtain the status information of the task during the running process;

[0097] If it is determined based on the status information that there is malicious behavior during the running of the task, a malicious label is added to the hotspot data corresponding to the malicious behavior;

[0098] Build an information security profile of the financial system based on the label corresponding to each piece of raw data to prevent raw data with risky or malicious labels from being put online in the financial system.

[0099] In some embodiments, the original data includes at least the flow log of the financial system and the newly added data source; obtaining the data feature information corresponding to each original data includes: converting each original data according to a preset standardized format to obtain the standardized log corresponding to the original data; performing feature extraction on each standardized log to obtain the feature vector corresponding to the standardized log, and constructing the data feature information according to the feature vector.

[0100] In some embodiments, multiple operating clusters are constructed within the financial system, each operating cluster includes multiple hot spot data; obtaining policy information corresponding to each hot spot data, including: calculating data feature information corresponding to the hot spot data and feature association information of each operating cluster; determining target association information based on multiple feature association information; adding the hot spot data to the target cluster corresponding to the target association information; using the policy information corresponding to the target cluster as the policy information corresponding to the hot spot data.

[0101] In some embodiments, determining the presence of malicious behavior during operation based on status information includes: parsing the status information, obtaining the malicious behavior type corresponding to the status information; the malicious behavior type includes at least black industry behavior, machine behavior, abnormal user behavior and business violation; obtaining a regular expression corresponding to the status information, scoring each malicious behavior type corresponding to the status information based on the regular expression, and obtaining a malicious behavior score corresponding to the status information; determining whether there is malicious behavior in the status information based on the malicious behavior score.

[0102] In some embodiments, a task corresponding to each policy information is created and run, and status information of the task during the running process is obtained, including: determining the running scenario corresponding to the hotspot data based on the policy information; creating a task and a state machine corresponding to the policy information based on the running scenario, the policy information, and data feature information corresponding to the hotspot data; running the task, and obtaining status information of the task during the running process through the state machine.

[0103] Exemplarily, the method also includes: determining a task execution status corresponding to the task based on status information; generating a control instruction corresponding to the task based on the task execution status, so as to control the task execution according to the control instruction; wherein the control instruction includes at least one of configuration issuance, task rerunning, timeout control and exception analysis.

[0104] In some embodiments, before constructing an information security portrait corresponding to the financial system based on the label corresponding to each original data, it also includes: obtaining data source information of risk data corresponding to the risk label and original data corresponding to the malicious label; in the original data without risk labels and malicious labels, filtering suspicious data information according to the data source information; adding suspicious labels to the suspicious data information to perform real-time monitoring of the original data with suspicious labels in the financial system.

[0105] A computer-readable storage medium is also provided in an embodiment of the present application, wherein the computer-readable storage medium stores a computer program, wherein the computer program includes program instructions, and the processor executes the program instructions to implement the steps of the information security portrait construction method provided in the above embodiments of the present application.

[0106] The computer-readable storage medium may be an internal storage unit of the computer device described in the foregoing embodiment, such as a hard disk or memory of the computer device. The computer-readable storage medium may also be an external storage device of the computer device, such as a plug-in hard disk, a smart memory card (SmartMedia Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc., equipped on the computer device.

[0107] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in the present application, and these modifications or replacements should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A method for constructing an information security portrait, characterized in that: The method comprises: Acquire multiple original data in the financial system, and acquire data feature information corresponding to each of the original data; Determine risk data and hotspot data in the plurality of original data according to the plurality of data feature information, and add risk tags to the risk data; Obtaining the policy information corresponding to each of the hotspot data, creating and running the task corresponding to each of the policy information, and obtaining the status information of the task during the running process; If it is determined according to the state information that there is malicious behavior during the operation, adding a malicious tag to the hotspot data corresponding to the malicious behavior; An information security profile corresponding to the financial system is constructed according to the label corresponding to each of the original data to prevent the original data with the risk label or the malicious label from being put online in the financial system.

2. The method according to claim 1, characterized in that The original data at least includes the flow log of the financial system and the newly added data source; the obtaining of data feature information corresponding to each of the original data includes: Convert each of the original data according to a preset standardized format to obtain a standardized log corresponding to the original data; Feature extraction is performed on each of the standardized logs to obtain a feature vector corresponding to the standardized log, and the data feature information is constructed according to the feature vector.

3. The method according to claim 1, characterized in that A plurality of operation clusters are constructed in the financial system, and each of the operation clusters includes a plurality of the hotspot data; and obtaining the policy information corresponding to each of the hotspot data includes: Calculating data feature information corresponding to the hotspot data and feature association information of each of the running clusters; Determine target association information according to the plurality of feature association information; Adding the hotspot data to the target cluster corresponding to the target association information; The policy information corresponding to the target cluster is used as the policy information corresponding to the hotspot data.

4. The method according to claim 1, characterized in that: The determining, according to the state information, that there is malicious behavior during the operation process includes: Parse the status information to obtain the malicious behavior type corresponding to the status information; the malicious behavior type at least includes black industry behavior, machine behavior, abnormal user behavior and business violation; Obtaining a regular expression corresponding to the state information, scoring each malicious behavior type corresponding to the state information according to the regular expression, and obtaining a malicious behavior score corresponding to the state information; It is determined whether the malicious behavior exists in the status information according to the malicious behavior score.

5. The method according to claim 1, characterized in that The step of creating and running a task corresponding to each of the policy information, and obtaining status information of the task during the running process, includes: Determine the operation scenario corresponding to the hotspot data according to the policy information; Creating a task and a state machine corresponding to the strategy information according to the operation scenario, the strategy information, and data feature information corresponding to the hotspot data; The task is run, and state information of the task during the running process is obtained through the state machine.

6. The method according to claim 5, characterized in that The method further comprises: Determine a task execution status corresponding to the task according to the status information; generating a control instruction corresponding to the task according to the task execution status, so as to control the execution of the task according to the control instruction; The control instructions include at least one of configuration delivery, task re-running, timeout control and exception analysis.

7. The method according to claim 1, characterized in that Before constructing the information security portrait corresponding to the financial system according to the label corresponding to each of the original data, the method further includes: Obtaining data source information of the risk data corresponding to the risk label and the original data corresponding to the malicious label; In the original data without the risk label and the malicious label, screening suspicious data information according to the data source information; A suspicious label is added to the suspicious data information so as to monitor the original data with the suspicious label in real time in the financial system.

8. An information security portrait construction device, characterized in that: include: A data acquisition module, used to acquire multiple original data in the financial system and acquire data feature information corresponding to each of the original data; A risk determination module, used to determine risk data and hotspot data in the plurality of original data according to the plurality of data feature information, and add risk tags to the risk data; A strategy acquisition module, used to acquire the strategy information corresponding to each of the hotspot data, create and run the task corresponding to each of the strategy information, and acquire the status information of the task during the running process; A malicious determination module, configured to add a malicious tag to hotspot data corresponding to the malicious behavior if it is determined according to the status information that the task has malicious behavior during operation; The portrait construction module is used to construct an information security portrait corresponding to the financial system according to the label corresponding to each of the original data, so as to prevent the original data with the risk label or the malicious label from being put online in the financial system.

9. A computer device, characterized in that: The computer device includes a memory and a processor; The memory is used to store computer programs; The processor is used to execute the computer program and implement the information security portrait construction method as described in any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the processor implements the method for constructing an information security portrait based on an aphasia patient as described in any one of claims 1 to 7.

Images