Information security portrait construction method and device, computer device, and storage medium

Abstract

This application discloses an information security profile construction method, apparatus, computer equipment, and storage medium. The method involves: acquiring data feature information corresponding to each piece of raw data in a financial system; identifying risky and hotspot data in the raw data based on multiple data feature information, and adding risk tags to the risky data; acquiring strategy information corresponding to each hotspot data, creating and running tasks corresponding to each strategy information, and acquiring the status information of the tasks during execution; if malicious behavior is determined based on the status information, adding a malicious tag to the hotspot data corresponding to the malicious behavior; and constructing an information security profile for the financial system based on the tags corresponding to each piece of raw data, thereby preventing raw data with risk or malicious tags from being uploaded to the financial system. By improving the coverage and accuracy of multi-dimensional tags such as risk and malicious behavior in the financial system, the financial system can provide secure data query services.

Description

TECHNICAL FIELD

[0001] The present application relates to information security technology, applied to the financial field, and in particular to an information security portrait construction method and device, a computer device and a storage medium. BACKGROUND

[0002] In the financial field, ensuring information security in the financial system can reduce the possibility of irregularities or malicious behavior in the business system, providing security for the business. Information security portrait is a big data-based intelligent analysis security prevention and control management platform used for unified information security risk control and management, helping to achieve precise risk identification, disposal and intelligent operation, and prevent data leakage.

[0003] However, the construction of the traditional information security risk portrait is a query tool composed of multiple service interfaces and a series of scripts. When extracting and analyzing feature data in massive logs, manual data pulling is required, resulting in incomplete data coverage and low accuracy. Moreover, the efficiency of analyzing effective countermeasures against black production behavior is low, and the operating cost is high, which poses a great risk to the information security of the financial system. SUMMARY

[0004] The present application provides an information security portrait construction method, device, computer device and storage medium, aiming to solve the problem that the existing method ignores the specific details of the speaker in the real-time information security portrait construction process, resulting in relatively poor voice quality and unsatisfactory user experience due to the high requirement for the conversion speed of voice in the real-time question and answer scene of financial customer service.

[0005] In a first aspect, the present application provides an information security portrait construction method, comprising:

[0006] Obtaining a plurality of original data in a financial system, obtaining data feature information corresponding to each original data;

[0007] Determining risk data and hot data in the plurality of original data according to the plurality of data feature information, adding a risk label to the risk data;

[0008] Obtaining strategy information corresponding to each hot data, creating and running a task corresponding to each strategy information, and obtaining state information of the task in the running process;

[0009] If it is determined according to the state information that there is a malicious behavior in the running process of the task, adding a malicious label to the hot data corresponding to the malicious behavior;

[0010] Constructing an information security portrait corresponding to the financial system according to the label corresponding to each original data, to avoid the original data with a risk label or a malicious label from being online in the financial system.

[0011] In some embodiments, the original data at least includes traffic logs of the financial system and newly added data sources; obtaining data feature information corresponding to each original data includes: converting each original data according to a preset standardized format to obtain standardized logs corresponding to the original data; performing feature extraction on each standardized log to obtain a feature vector corresponding to the standardized log, and constructing the data feature information according to the feature vector.

[0012] In some embodiments, a plurality of running clusters are constructed in the financial system, and each running cluster includes a plurality of hot data; obtaining strategy information corresponding to each hot data includes: calculating data feature information corresponding to the hot data and feature association information of each running cluster; determining target association information according to a plurality of feature association information; adding the hot data to a target cluster corresponding to the target association information; and taking strategy information corresponding to the target cluster as the strategy information corresponding to the hot data.

[0013] In some embodiments, determining that there is malicious behavior in the running process according to the state information includes: analyzing the state information to obtain a malicious behavior type corresponding to the state information; the malicious behavior type at least includes black production behavior, machine behavior, user behavior anomaly and business violation; obtaining a rule expression corresponding to the state information, scoring each malicious behavior type corresponding to the state information according to the rule expression, and obtaining a malicious behavior score corresponding to the state information; and determining whether there is malicious behavior in the state information according to the malicious behavior score.

[0014] In some embodiments, creating and running a task corresponding to each strategy information, and obtaining state information of the task in the running process includes: determining a running scenario corresponding to the hot data according to the strategy information; creating a task and a state machine corresponding to the strategy information according to the running scenario, the strategy information and the data feature information corresponding to the hot data; running the task to obtain the state information of the task in the running process through the state machine.

[0015] For example, the method further includes: determining a task execution state corresponding to the task according to the state information; generating a control instruction corresponding to the task according to the task execution state, so as to control the execution of the task according to the control instruction; wherein the control instruction at least includes any one of configuration delivery, task re-run, timeout control and exception analysis.

[0016] In some embodiments, before constructing the information security portrait corresponding to the financial system according to the label corresponding to each original data, it further includes: obtaining risk data corresponding to a risk label and data source information of original data corresponding to a malicious label; in the original data without the risk label and the malicious label, screening suspicious data information according to the data source information; adding a suspicious label to the suspicious data information, so as to monitor the original data with the suspicious label in the financial system in real time.

[0017] Secondly, this application provides an information security profile building device, comprising:

[0018] The data acquisition module is used to acquire multiple raw data from the financial system and obtain the data feature information corresponding to each raw data.

[0019] The risk identification module is used to identify risky and hotspot data from multiple raw data based on multiple data feature information, and to add risk labels to the risky data;

[0020] The strategy acquisition module is used to acquire strategy information corresponding to each hot data point, create and run tasks corresponding to each strategy information, and acquire the status information of the tasks during the running process.

[0021] The malice determination module is used to add malicious tags to the hot data corresponding to the malicious behavior if it is determined from the status information that the task has malicious behavior during the operation.

[0022] The profile building module is used to build an information security profile for the financial system based on the tags corresponding to each piece of raw data, so as to avoid raw data with risk tags or malicious tags from going online in the financial system.

[0023] Thirdly, this application also provides a computer device, comprising:

[0024] Memory and processor;

[0025] The memory is used to store computer programs;

[0026] The processor is configured to execute the computer program and, when executing the computer program, implement the steps of the information security profile construction method as described in the first aspect above.

[0027] Fourthly, this application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, causes the processor to implement the steps of the information security profile construction method described in the first aspect above.

[0028] This application discloses a method, apparatus, computer device, and storage medium for constructing an information security profile. First, multiple raw data sets from a financial system are acquired, and data feature information corresponding to each raw data set is obtained. Then, risky data and hotspot data are identified from the raw data sets based on the multiple data feature information, and risk tags are added to the risky data. Next, strategy information corresponding to each hotspot data set is acquired, and a task corresponding to each strategy information set is created and run, obtaining the status information of the task during its execution. Further, if malicious behavior is determined based on the status information during task execution, a malicious tag is added to the hotspot data corresponding to the malicious behavior. Finally, an information security profile corresponding to the financial system is constructed based on the tags corresponding to each raw data set to prevent raw data with risky or malicious tags from being uploaded to the financial system.

[0029] Furthermore, the provided method improves the coverage and accuracy of multi-dimensional tags such as risk and malicious behavior in the financial system, enabling the financial system to provide secure and high-performance data query services. This significantly increases the efficiency of analyzing and effectively combating malicious activities within the financial system, while reducing operating costs. Simultaneously, integrating employee information into the information security profile allows for intelligent evaluation of employees' information security awareness and capabilities within the financial system, effectively improving employee security skills, guiding them to cultivate strong security awareness, reducing various violations and malicious attacks, and safeguarding business operations.

[0030] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and do not limit this application. Attached Figure Description

[0031] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0032] Figure 1 This is a schematic flowchart illustrating the steps of an information security profile construction method provided in an embodiment of this application;

[0033] Figure 2 This is a schematic diagram of a data analysis process provided in an embodiment of this application;

[0034] Figure 3 This is a schematic diagram of the architecture corresponding to the information security profile construction method provided in one embodiment of this application;

[0035] Figure 4 This is a schematic diagram of the information security profile building device provided in one embodiment of this application;

[0036] Figure 5 This is a schematic block diagram of the structure of a computer device provided in an embodiment of this application.

[0037] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and do not limit this application. Detailed Implementation

[0038] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0039] The flowchart shown in the attached diagram is for illustrative purposes only and does not necessarily include all content and operations / steps, nor does it necessarily have to be performed in the order described. For example, some operations / steps can be broken down, combined, or partially merged, so the actual execution order may change depending on the actual situation.

[0040] It should be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the scope of the application. As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.

[0041] It should also be understood that the term “and / or” as used in this application specification and the appended claims means any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0042] The following detailed description of some embodiments of this application is provided in conjunction with the accompanying drawings. Unless otherwise specified, the following embodiments and features can be combined with each other.

[0043] In the financial sector, ensuring information security within the financial system reduces the likelihood of irregularities or malicious behavior in business systems, providing security for operations. Information security profiling is a big data-based intelligent analytical security control and management platform used for unified information security risk control and management. It helps achieve accurate risk identification, handling, and intelligent operation, preventing data breaches.

[0044] Traditional information security risk profiling relies on query tools with multiple service interfaces and a series of scripts. When extracting and analyzing feature data from massive logs, manual data retrieval is required, resulting in incomplete data coverage and low accuracy. Furthermore, it is inefficient in identifying effective strategies to combat cybercrime, and its operating costs remain high, posing significant risks to the information security of financial systems.

[0045] To resolve the above issues, please refer to [link / reference]. Figure 1 , Figure 1 This is a schematic flowchart illustrating an embodiment of an information security profile construction method provided in this application. This information security profile construction method can be implemented using computer equipment, which can be deployed on a single server or a server cluster. It can also be deployed on handheld terminals, laptops, wearable devices, or robots, etc.

[0046] It should be noted that the provided method can be applied to the financial systems of various enterprises in the financial field, as well as the medical systems of various enterprises in the medical field. The provided method can be used in any system that needs to build information security profiles. Therefore, the application scenarios of the provided method are not limited in the embodiments of this application.

[0047] like Figure 1 As shown, the information security profile construction method provided in this embodiment includes steps S101 to S105. Details are as follows:

[0048] S101. Obtain multiple raw data from the financial system and obtain the data feature information corresponding to each raw data.

[0049] Specifically, by acquiring raw data from the financial system to be analyzed, or traffic logs to be processed, as raw data for constructing an information security profile, the data characteristic information corresponding to different types of raw data can be determined. This allows for unified monitoring of the characteristic information of different data types. It has been ensured that the provided method can cover all types of data within the financial system, preventing data from being uploaded due to illicit activities (illegal activities refer to industrial or economic gains obtained through illegitimate means on the internet), thus avoiding potential information security risks to the system.

[0050] In some embodiments, the raw data includes at least the flow logs of the financial system and newly added data sources; obtaining data feature information corresponding to each raw data includes: converting each raw data according to a preset standardized format to obtain standardized logs corresponding to the raw data; extracting features from each standardized log to obtain feature vectors corresponding to the standardized logs, and constructing data feature information based on the feature vectors.

[0051] The newly added data source can be a newly purchased / added data source. The traffic log records the operating status of each data flow in the financial system, and then... Figure 2 The flowchart shown illustrates how computer devices communicate via... Figure 2 The control flow, state flow, and data flow shown combine to transform raw data into standardized logs, and then feature vectors are extracted from these standardized logs. It can also write corresponding tags, such as risk tags, into the standardized logs and obtain real-time tag data corresponding to the standardized logs.

[0052] For example, such as Figure 2 As shown, each piece of raw data is transformed according to a preset standardized format to obtain the corresponding standardized logs. This includes: performing strategy analysis on the raw data; and converting the raw data according to the analysis results and standardized format to obtain the corresponding standardized logs. Furthermore, by parsing the strategy content corresponding to each piece of raw data and converting it according to a standardized format, various types of raw data can be standardized, ensuring the accuracy of subsequent analysis.

[0053] In some embodiments, the provided computer device is equipped with, for example Figure 3 The architecture shown comprises a capability domain, a support domain, a general domain, and a basic data domain for constructing an information security profile of the financial system.

[0054] Raw data can be obtained from third-party data sources, platform logs, or internal logs in the basic data domain. The general domain is used to determine the data flow platform corresponding to the data flow, the rule engine for generating various scoring rules, and the business indicator platform for evaluating employees within the financial system. At the same time, the support domain has a real-time strategy labeling engine for adding tags to strategies and an offline strategy scheduling engine for scheduling strategies.

[0055] The capability domain includes portals corresponding to data in the financial system and various query / call libraries / functional modules used during the process of using the data (including but not limited to...). Figure 3 Each module in the system can be expanded according to actual usage needs, and the financial system can then provide secure data query services through capability domains.

[0056] The operations domain, on the other hand, monitors and manages the tags, strategies, and indicators corresponding to the data during the operation of the financial system, enabling managers to achieve real-time monitoring of the system's operation. Furthermore, through... Figure 3The provided architecture significantly improves the efficiency of analyzing and effectively combating cybercrime by enhancing the coverage and accuracy of multi-dimensional labeled datasets and offering high-performance data query services. This reduces the operating costs of financial systems. Furthermore, the architecture integrates employee information security profiles and enables intelligent evaluation of employee information security awareness and capabilities, effectively improving employee security skills, guiding them to develop strong security awareness, reducing various violations and malicious attacks, and safeguarding business operations.

[0057] S102. Based on multiple data feature information, identify risk data and hotspot data in multiple raw data, and add risk labels to the risk data.

[0058] Specifically, by analyzing data characteristic information, it is possible to determine whether each piece of raw data poses a risk, classifying the raw data into risky data and hotspot data, adding risk labels to the risky data, and writing the risky data into a file such as... Figure 3 The architecture shown corresponds to the tag library. Simultaneously, the computer device can select a database that supports high concurrency and low latency for storage, cache frequently accessed data, meet high-concurrency query requirements, and provide real-time query capabilities externally through a high-performance service interface.

[0059] S103. Obtain the strategy information corresponding to each hot data point, create and run the task corresponding to each strategy information, and obtain the status information of the task during the running process.

[0060] Specifically, as the amount of raw data increases, the amount of hot data also expands, and the corresponding strategy information for running hot data also increases. In order to reduce the risk of single points of failure in the system and enhance monitoring capabilities, the provided method creates and runs corresponding tasks for each piece of strategy information within a preset time period. This allows for monitoring of the status information of each task's operation, thereby preventing malicious behavior in hot data from causing information security breaches in the financial system.

[0061] In some embodiments, the financial system has multiple operating clusters, each of which includes multiple hot data points; obtaining the strategy information corresponding to each hot data point includes: calculating the data feature information corresponding to the hot data point and the feature association information of each operating cluster; determining the target association information based on the multiple feature association information; adding the hot data point to the target cluster corresponding to the target association information; and using the strategy information corresponding to the target cluster as the strategy information corresponding to the hot data point.

[0062] To improve system efficiency, the proposed method constructs multiple operating clusters within the financial system, enabling the storage of identical data. This application employs a clustering method based on anomaly detection of text-image associations to add hotspot information to the target cluster with the strongest correlation. This allows for the real-time addition of hotspot data with consistent strategy information to the corresponding target clusters, thereby simplifying the complexity of strategies within the financial system.

[0063] In some embodiments, obtaining policy information corresponding to each hot data point includes: obtaining the operating scenario corresponding to the hot data point; inputting the data feature information and operating scenario corresponding to the hot data point into a preset policy generation model, and the policy generation model generating policy information corresponding to the hot data point. Therefore, the provided method can quickly determine the policy information of newly generated hot data in the corresponding scenario in real time.

[0064] In some embodiments, a task corresponding to each policy information is created and run, and the state information of the task during the running process is obtained, including: determining the running scenario corresponding to the hot data based on the policy information; creating the task and state machine corresponding to the policy information based on the running scenario, policy information and data feature information corresponding to the hot data; running the task and obtaining the state information of the task during the running process through the state machine.

[0065] The provided method determines the running scenario corresponding to hot data based on strategy information, and then integrates the running scenario, strategy information and data feature information corresponding to hot data to create a task corresponding to the hot data. It can then run the created task based on the hot data to obtain and create a state machine for each task to control the state transition and obtain the state information of the task during the running process.

[0066] Simultaneously, the provided method enables computer equipment to establish a distributed offline task scheduling platform for periodically executing policy information, comprising an analysis engine, an access engine, and a scheduling bus. The analysis engine, deployed as a container on servers in various environments, is responsible for executing the policy information. The output of the policy footer corresponding to the policy information is an update log of hot data, and it also reports the task execution process and exception information to the scheduling bus, which uniformly stores and manages the task execution status. The access engine parses standardized logs in a standardized format, writes them to a tag library in real time, and reports the execution status and execution exception information to the scheduling bus. The scheduling bus uniformly receives task status information reported by both the analysis engine and the access engine.

[0067] For example, the method further includes: determining the task execution status corresponding to the task based on the status information; generating control instructions corresponding to the task based on the task execution status, so as to control the task execution according to the control instructions; wherein, the control instructions include at least one of configuration issuance, task rerun, timeout control, and exception analysis.

[0068] In the provided method, the computer device can determine the task execution status based on task information and control task execution by issuing control commands such as configuration distribution, task rerun, timeout control, and anomaly analysis. Alternatively, the computer device can build a visual interface allowing users to monitor and issue control commands for each task, performing operations such as configuration distribution, task rerun, timeout control, and anomaly analysis. This reduces the workload of data maintenance and deployment, and improves the accuracy of task execution and the efficiency of strategy analysis.

[0069] S104. If it is determined from the status information that the task has malicious behavior during operation, add a malicious label to the hot data corresponding to the malicious behavior.

[0070] Specifically, to prevent malicious actors from bypassing tag-based deployment strategies within hot data, when malicious behavior is identified during the execution of any task based on status information, computer devices can promptly add malicious tags to the hot data corresponding to the malicious behavior. This prevents malicious activities within hot data from threatening the information security of the financial system. This multi-dimensional tag detection of data within the financial system improves its security.

[0071] In some embodiments, determining the presence of malicious behavior during operation based on status information includes: parsing the status information to obtain the type of malicious behavior corresponding to the status information; the type of malicious behavior includes at least black market behavior, machine behavior, abnormal user behavior, and business violations; obtaining the rule expression corresponding to the status information, scoring each type of malicious behavior corresponding to the status information according to the rule expression, and obtaining the malicious behavior score corresponding to the status information; and determining whether there is malicious behavior in the status information based on the malicious behavior score.

[0072] Based on the characteristics of the financial system, predefined malicious behavior types such as black market behavior, machine behavior, abnormal user behavior, and business violations are used (the types of malicious behavior can be adjusted for different scenarios / systems). The system determines whether any of the above malicious behaviors exist in the status information and assigns corresponding rule expressions to each status information (e.g., the scoring of different malicious types varies under different scenarios / strategies). Thus, the system can determine the status information with a total score higher than a threshold as having malicious behavior (because when the severity of the malicious behavior is low in the scenario or the malicious behavior only occurs once, the malicious behavior can be left unlabeled for continued monitoring). Therefore, the provided method can accurately monitor malicious behavior by flexibly formulating rule expressions.

[0073] For example, obtaining the rule expression corresponding to the state information includes: obtaining the policy information corresponding to the state information and the running scenario of the task corresponding to the state information, and generating the rule expression corresponding to the state information based on the policy information and the running scenario. Therefore, the provided method can determine different rule expressions based on the policy and scenario corresponding to the state information; that is, the same behavior may have different scores under different state information, thus achieving flexible monitoring of various hot data.

[0074] S105. Construct an information security profile for the financial system based on the labels corresponding to each piece of raw data, so as to avoid raw data with risk labels or malicious labels from being uploaded to the financial system.

[0075] Specifically, after adding corresponding tags to each piece of raw data (and also adding corresponding tags to raw data that is risk-free / without malicious behavior), a corresponding information security profile can be constructed based on all the tags in the financial system. This allows for the simultaneous blocking of raw data that presents risks and malicious behavior, as well as the generation of corresponding employee security profiles for employees who provide such data. This enables intelligent evaluation of employees' information security awareness and capabilities, effectively improving their security skills, guiding them to establish a strong security awareness, reducing various violations and malicious attacks, and safeguarding business operations.

[0076] In some embodiments, before constructing an information security profile of the financial system based on the labels corresponding to each piece of raw data, the method further includes: obtaining data source information of risk data corresponding to risk labels and raw data corresponding to malicious labels; filtering suspicious data information based on data source information in raw data without risk labels and malicious labels; adding suspicious labels to suspicious data information to enable real-time monitoring of raw data with suspicious labels in the financial system.

[0077] For data that poses risks or involves illicit activities, its source may be a single employee and / or any supplier. It is necessary to simultaneously add suspicious tags to other original data corresponding to this data source information, thereby monitoring the data with suspicious tags to ensure the secure operation of the financial system. The provided method can also be flexibly configured to blacklist data sources with a total number of suspicious / risky / malicious tags exceeding a threshold, subsequently blocking any data from that source.

[0078] The provided method improves the coverage and accuracy of multi-dimensional tags, such as those for risk and malicious behavior, within financial systems, enabling them to provide secure and high-performance data query services. This significantly increases the efficiency of analyzing and effectively combating malicious activities within financial systems, while reducing operational costs. Furthermore, integrating employee information into information security profiles allows for intelligent evaluation of employees' information security awareness and capabilities, effectively improving employee security skills, guiding them to cultivate strong security awareness, and reducing various violations and malicious attacks, thus safeguarding business operations.

[0079] Please see Figure 4 As shown, Figure 4 This is a schematic diagram of the information security profile building device 200 provided in this application embodiment. The information security profile building device 200 is used to execute the steps of the information security profile building method shown in the above embodiments. The information security profile building device 200 can be a single server or a server cluster, or it can be a terminal, such as a handheld terminal, laptop computer, wearable device, or robot.

[0080] like Figure 4 As shown, the information security profile building device 200 includes:

[0081] The data acquisition module 201 is used to acquire multiple raw data from the financial system and obtain the data feature information corresponding to each raw data.

[0082] The risk determination module 202 is used to identify risky data and hotspot data from multiple raw data based on multiple data feature information, and to add risk labels to the risky data;

[0083] The strategy acquisition module 203 is used to acquire strategy information corresponding to each hot data, create and run tasks corresponding to each strategy information, and acquire the status information of the tasks during the running process.

[0084] The malice determination module 204 is used to add malicious tags to the hot data corresponding to the malicious behavior if it is determined from the status information that the task has malicious behavior during the operation.

[0085] The profile building module 205 is used to build an information security profile for the financial system based on the tags corresponding to each piece of raw data, so as to avoid raw data with risk tags or malicious tags from going online in the financial system.

[0086] The aforementioned method for constructing information security profiles can be implemented as a computer program, which can be used in, for example... Figure 4 It runs on the device shown.

[0087] Please seeFigure 5 , Figure 5 This is a schematic block diagram of the structure of a computer device provided in an embodiment of this application. The computer device includes a processor, a memory, and a network interface connected via a device bus, wherein the memory may include a storage medium and internal memory.

[0088] The storage medium can store operating devices and computer programs. The computer program includes program instructions that, when executed, cause the processor to perform any information security profiling method.

[0089] The processor provides computing and control capabilities, supporting the operation of the entire computer device.

[0090] Internal memory provides an environment for the execution of computer programs stored in non-volatile storage media. When these computer programs are executed by the processor, the processor can execute any information security profile construction method.

[0091] This network interface is used for network communication, such as sending assigned tasks. Those skilled in the art will understand that... Figure 5 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the terminal to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0092] It should be understood that the processor can be a Central Processing Unit (CPU), but it can also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Among these, a general-purpose processor can be a microprocessor or any conventional processor.

[0093] In one embodiment, the processor is configured to run a computer program stored in memory to perform the following steps:

[0094] Obtain multiple raw data sets from the financial system and extract the data feature information corresponding to each raw data set;

[0095] Based on multiple data feature information, risk data and hotspot data are identified from multiple raw data, and risk labels are added to the risk data.

[0096] Obtain the strategy information corresponding to each hot data point, create and run the task corresponding to each strategy information, and obtain the status information of the task during the running process;

[0097] If it is determined from the status information that there is malicious behavior in the task during its operation, add a malicious label to the hot data corresponding to the malicious behavior;

[0098] An information security profile for the financial system is constructed based on the labels corresponding to each piece of raw data, in order to prevent raw data with risky or malicious labels from being uploaded to the financial system.

[0099] In some embodiments, the raw data includes at least the flow logs of the financial system and newly added data sources; obtaining data feature information corresponding to each raw data includes: converting each raw data according to a preset standardized format to obtain standardized logs corresponding to the raw data; extracting features from each standardized log to obtain feature vectors corresponding to the standardized logs, and constructing data feature information based on the feature vectors.

[0100] In some embodiments, the financial system has multiple operating clusters, each of which includes multiple hot data points; obtaining the strategy information corresponding to each hot data point includes: calculating the data feature information corresponding to the hot data point and the feature association information of each operating cluster; determining the target association information based on the multiple feature association information; adding the hot data point to the target cluster corresponding to the target association information; and using the strategy information corresponding to the target cluster as the strategy information corresponding to the hot data point.

[0101] In some embodiments, determining the presence of malicious behavior during operation based on status information includes: parsing the status information to obtain the type of malicious behavior corresponding to the status information; the type of malicious behavior includes at least black market behavior, machine behavior, abnormal user behavior, and business violations; obtaining the rule expression corresponding to the status information, scoring each type of malicious behavior corresponding to the status information according to the rule expression, and obtaining the malicious behavior score corresponding to the status information; and determining whether there is malicious behavior in the status information based on the malicious behavior score.

[0102] In some embodiments, a task corresponding to each policy information is created and run, and the state information of the task during the running process is obtained, including: determining the running scenario corresponding to the hot data based on the policy information; creating the task and state machine corresponding to the policy information based on the running scenario, policy information and data feature information corresponding to the hot data; running the task and obtaining the state information of the task during the running process through the state machine.

[0103] For example, the method further includes: determining the task execution status corresponding to the task based on the status information; generating control instructions corresponding to the task based on the task execution status, so as to control the task execution according to the control instructions; wherein, the control instructions include at least one of configuration issuance, task rerun, timeout control, and exception analysis.

[0104] In some embodiments, before constructing an information security profile of the financial system based on the labels corresponding to each piece of raw data, the method further includes: obtaining data source information of risk data corresponding to risk labels and raw data corresponding to malicious labels; filtering suspicious data information based on data source information in raw data without risk labels and malicious labels; adding suspicious labels to suspicious data information to enable real-time monitoring of raw data with suspicious labels in the financial system.

[0105] The embodiments of this application also provide a computer-readable storage medium storing a computer program, the computer program including program instructions, and the processor executing the program instructions to implement the steps of the information security profile construction method provided in the above embodiments of this application.

[0106] The computer-readable storage medium may be an internal storage unit of the computer device described in the foregoing embodiments, such as the hard disk or memory of the computer device. The computer-readable storage medium may also be an external storage device of the computer device, such as a plug-in hard disk, SmartMedia Card (SMC), Secure Digital (SD) card, or Flash Card equipped on the computer device.

[0107] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in this application, and these modifications or substitutions should all be covered within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for constructing an information security profile, characterized in that, The method includes: Obtain multiple raw data from the financial system, and obtain data feature information corresponding to each raw data; Based on multiple data feature information, risk data and hotspot data are identified from multiple original data, and risk tags are added to the risk data; The process includes: obtaining policy information corresponding to each hot data point; creating and running a task corresponding to each policy information point; and obtaining the status information of the task during its execution. This process includes: determining the execution scenario corresponding to the hot data point based on the policy information; creating a task and a state machine corresponding to the policy information point based on the execution scenario, the policy information, and the data feature information corresponding to the hot data point; running the task; and obtaining the status information of the task during its execution through the state machine. If it is determined that malicious behavior exists during operation based on the status information, the process includes: parsing the status information to obtain the malicious behavior type corresponding to the status information; the malicious behavior type includes at least black market behavior, machine behavior, abnormal user behavior, and business violations; obtaining the rule expression corresponding to the status information, scoring each malicious behavior type corresponding to the status based on the rule expression, and obtaining the malicious behavior score corresponding to the status information; determining whether the malicious behavior exists in the status information based on the malicious behavior score; and adding malicious tags to the hot data corresponding to the malicious behavior. An information security profile for the financial system is constructed based on the tags corresponding to each piece of raw data, so as to prevent the raw data with the risk tags or the malicious tags from being uploaded to the financial system.

2. The method according to claim 1, characterized in that, The raw data includes at least the traffic logs of the financial system and newly added data sources; obtaining the data feature information corresponding to each piece of raw data includes: Each piece of raw data is converted according to a preset standardized format to obtain the standardized log corresponding to the raw data; For each of the standardized logs, feature extraction is performed to obtain the feature vector corresponding to the standardized log, and the data feature information is constructed based on the feature vector.

3. The method according to claim 1, characterized in that, The financial system comprises multiple operational clusters, each containing multiple hotspot data points; obtaining the strategy information corresponding to each hotspot data point includes: Calculate the data feature information corresponding to the hot data and the feature association information of each running cluster; Target association information is determined based on multiple feature association information; Add the hotspot data to the target cluster corresponding to the target association information; The strategy information corresponding to the target cluster is used as the strategy information corresponding to the hot data.

4. The method according to claim 1, characterized in that, The method further includes: The task execution status corresponding to the task is determined based on the status information; Based on the task execution status, control instructions corresponding to the task are generated, so as to control the execution of the task according to the control instructions; The control commands include at least one of the following: configuration issuance, task rerun, timeout control, and anomaly analysis.

5. The method according to claim 1, characterized in that, Before constructing the information security profile of the financial system based on the tags corresponding to each of the original data, the method further includes: Obtain the data source information of the risk data corresponding to the risk label and the original data corresponding to the malicious label; From the raw data that does not carry the aforementioned risk label and malicious label, suspicious data information is filtered based on the data source information; Suspicious tags are added to the suspicious data information so that the original data with the suspicious tags can be monitored in real time in the financial system.

6. An information security profile building device, characterized in that, include: The data acquisition module is used to acquire multiple raw data from the financial system and acquire data feature information corresponding to each raw data. The risk determination module is used to determine risk data and hotspot data from multiple sets of raw data based on multiple data feature information, and to add risk tags to the risk data; The strategy acquisition module is used to acquire strategy information corresponding to each hot data point, create and run a task corresponding to each strategy information point, and acquire the status information of the task during the running process, including: determining the running scenario corresponding to the hot data point based on the strategy information; creating a task and a state machine corresponding to the strategy information point based on the running scenario, the strategy information, and the data feature information corresponding to the hot data point; running the task and acquiring the status information of the task during the running process through the state machine; A malice determination module is used to determine, based on the status information, that malicious behavior exists during operation, including: parsing the status information to obtain the malicious behavior type corresponding to the status information; the malicious behavior type includes at least black market behavior, machine behavior, abnormal user behavior, and business violations; obtaining a rule expression corresponding to the status information; scoring each malicious behavior type corresponding to the status based on the rule expression to obtain a malicious behavior score corresponding to the status information; determining whether the malicious behavior exists in the status information based on the malicious behavior score; and adding a malicious tag to the hot data corresponding to the malicious behavior. The profile building module is used to build an information security profile of the financial system based on the tags corresponding to each piece of raw data, so as to prevent the raw data with the risk tag or the malicious tag from going online in the financial system.

7. A computer device, characterized in that, The computer device includes a memory and a processor; The memory is used to store computer programs; The processor is configured to execute the computer program and, when executing the computer program, implement the information security profile construction method as described in any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, causes the processor to implement the information security profile construction method as described in any one of claims 1 to 5.

Images