Safety protection method and system for information collection of application system

Abstract

The invention discloses a security protection method and system for information collection of an application system, and the method comprises the steps: generating a security ID of the application system according to a unique identifier of the application system in an operating system when a basic package of a bottom platform is called, adding a probe to the application system according to the ID, and recording historical attack data; training positive and negative samples based on a classification clustering algorithm to obtain a distinguishing model of the dangerous attack behaviors, and defining a relevancy threshold value of the dangerous attack behaviors; the real-time data collected by the probe is combined with the distinguishing model to obtain the relevancy between the current state and the dangerous attack behavior, and early warning and alarming of the unsafe degree of the application system are carried out according to the threshold rule definition of single event alarm threshold and multi-event linkage alarm; and continuously combining the data acquired by the probe with the discrimination model to carry out iterative training, and carrying out safety analysis on the data acquired by the probe based on the new model.

Description

Technical Field

[0001] The present invention belongs to the technical field of data security management, and in particular, relates to a security protection method and system for application system information collection. Background Art

[0002] In traditional ways, network security systems are generally protected by traffic at the border, such as setting up firewalls, performing traffic control on routers, etc., but fail to fully identify and prevent important application system behaviors.

[0003] The lack of application system portraits and the insufficient use of application probes have led to serious deficiencies in the protection of important application systems. In today's era of rapid digital development, application systems are facing increasingly complex and diverse security threats. On the one hand, the lack of effective security monitoring means makes it impossible to detect potential security risks in a timely manner, making important application systems easy targets for hacker attacks. On the other hand, due to the lack of comprehensive recording and analysis of the behavior of application systems, it is difficult to trace the source and path of the attack after being attacked, and it is impossible to take targeted defense measures.

[0004] In addition, in the existing technical system, there is a lack of effective information sharing and collaborative protection mechanisms between various application systems. When an application system is attacked, other application systems cannot obtain relevant information in a timely manner and take corresponding preventive measures, thereby increasing the security risk of the entire system. Moreover, the security management of application systems is often passive, and only handles security incidents after they occur, lacking forward-looking security planning and preventive measures. In summary, traditional security management methods can no longer meet the security needs of today's application systems, and there is an urgent need for a more complete and efficient application security management system and method to protect the security of important application systems. Summary of the invention

[0005] In view of the problem that the existing application system information collection server lacks the ability to identify whether the collected data is offensive data and the source of the attack, the present invention provides a security protection method and system for application system information collection.

[0006] In order to achieve the above technical objectives, the technical solution adopted by the present invention is as follows:

[0007] A security protection method for application system information collection, comprising the steps of:

[0008] S1. Based on the unique identification of the application system in the operating system, generate the application system security ID (if such ID has not been generated before) when calling the underlying platform basic package (such as the Java system package), and then add a probe to the application system based on this ID to record the historical attack data;

[0009] S2. Based on the classification and clustering algorithm, positive and negative samples are trained to obtain a recognition model for dangerous attack behaviors and define a relevance threshold for dangerous attack behaviors. The real-time data collected by the probe is combined with the recognition model to obtain the relevance between the current state and dangerous attack behaviors. According to the definition of the threshold of a single event alarm and the threshold rule of multiple event linkage alarms, an early warning and alarm of the insecurity level of the application system is given.

[0010] S3, continuously combining the data collected by the probe with the discrimination model for iterative training, performing security analysis on the data collected by the probe based on the new model, storing the analysis results in the database, and pushing them to the vector feature library;

[0011] S4. Users can modify the data pushed to the vector feature library and optimize the results and direction of training and learning.

[0012] Furthermore, the detailed steps of step S1 include:

[0013] S101. Build the overall architecture of the application system, test the application system, and ensure that the server, application, and test ends can run stably;

[0014] S102. When the underlying platform basic package is called for the first time, a corresponding application system security ID is generated; the application system security ID is used as a key identifier for subsequent system identification and management of application system security information.

[0015] S103. Implant a probe in the application system. The probe is configured to collect data from the application system in full or by sampling. The collected data from the application system includes at least network traffic data, application operation logs, security device operation status, infrastructure-related information, and data on interaction with third-party systems.

[0016] Furthermore, the application system is probed, involving various servers, network devices, and multi-node and multi-service architecture of different applications and database services of the application system.

[0017] Furthermore, the data collected by the probe needs to be preprocessed before entering step S2. The detailed steps of preprocessing include:

[0018] First, desensitize the data and encrypt or replace the data containing sensitive information;

[0019] Then check the data integrity, and then convert the format, clean the data, remove noise data, duplicate data and other interference information;

[0020] Finally, the processed data is stored and cached in the storage space and used as the data collected by the probe to perform the dangerous attack behavior analysis in step S2.

[0021] Further, the detailed steps of step S2 are:

[0022] S201, combining the data collected by the probe with the historical attack data;

[0023] S202, dividing the data into positive and negative samples, where the positive samples are known dangerous attack behavior data and the negative samples are normal behavior data;

[0024] S203, using a convolutional neural network algorithm and a K nearest neighbor algorithm to calculate positive and negative samples;

[0025] S204, calculating the correlation between all positive and negative sample data and dangerous attack behaviors;

[0026] S205: Compare with a preset correlation threshold of dangerous attack behaviors, and when the preset correlation threshold is exceeded, issue a warning and alarm on the degree of danger.

[0027] Furthermore, the convolutional neural network algorithm application step in step S203 includes:

[0028] S20311. Normalize the collected sample data so that the data features have a uniform scale;

[0029] S20312. Convert the data into a format suitable for convolutional neural network input; S20313. Build a convolutional neural network model: define the structure of convolutional layer, pooling layer and fully connected layer. The convolutional layer is used to extract local features in the data. By setting different convolution kernel sizes and numbers, multi-scale feature extraction is performed on the data; the pooling layer is used to reduce the data dimension; the fully connected layer is used to map the extracted features to the final classification result;

[0030] S20314. Model training: Input positive and negative sample data into the convolutional neural network model, use the back-propagation algorithm to calculate the gradient of the loss function to the model parameters, and then update the model parameters according to the gradient. During the training process, set the appropriate learning rate and number of iterations.

[0031] Furthermore, the K nearest neighbor algorithm application step in step S203 includes:

[0032] S20321. Preprocess the data, including normalization and feature selection, and select features related to dangerous behavior judgment; for example, features such as access frequency, access time interval, and data transmission volume are used as input features of the K nearest neighbor algorithm.

[0033] S20322. Calculate distance: For a new data point (behavior data to be judged), calculate its distance from each sample point in the training set.

[0034] S20323. Select neighbors: Select the K neighbors with the closest distance according to the calculated distance. The selection of K value is the key, and the appropriate K value can be determined by methods such as cross-validation.

[0035] S20324. Classification decision: Determine the category of the new data point based on the category to which the majority of samples among the K neighbors belong.

[0036] Furthermore, the vector space model is used to represent the data in vector form and calculate the similarity between vectors;

[0037] Use the cosine similarity calculation formula To measure the similarity between two vectors;

[0038] When a new attack pattern or abnormal behavior is discovered, its corresponding vector feature will be updated to the feature library. By matching the similarity with the known dangerous feature vectors, unknown threats can be identified and prevented in a timely manner.

[0039] The continuous accumulation of data and continuous training of algorithms have established access security analysis models for various business systems, providing a solid model foundation for subsequent security risk identification and processing.

[0040] According to the results, if the model is found to have insufficient performance or misjudgment, the optimization process is started. For the CNN and KNN algorithms, parameter adjustments can be made in a targeted manner. For example, for the CNN algorithm, if the model is found to be overfitting, regularization terms (such as L1 or L2 regularization) can be added to penalize the model complexity and prevent overfitting; for the CNN algorithm, if the accuracy is found to be low, the K value can be adjusted, or more appropriate features can be reselected.

[0041] Add more training data, especially for those scenarios that are prone to misjudgment or omission in testing, to enhance the generalization ability of the model. For example, if it is found that the model performs poorly in identifying new weak password attacks, more similar weak password attack sample data can be collected and added to the training set.

[0042] Improve the structure and algorithm of the vector analysis model to improve the efficiency and accuracy of new feature matching. For example, optimize the dimension selection method of the vector space model, or adopt a more advanced vector similarity calculation algorithm to improve the recognition and matching capabilities of new features. Through continuous testing and optimization, gradually improve the performance of the system so that it can more accurately identify and prevent various security risks.

[0043] Furthermore, dangerous attack behaviors are identified from six dimensions, including behavioral characteristics, user fingerprints, geographic location, logical sequence, honeypot triggering, and data structure.

[0044] Furthermore, for user behavior, the distance between its behavior feature vector and each cluster center is accurately calculated; based on a preset threshold, it is determined which cluster's behavior feature the new user behavior is similar to and classified.

[0045] Furthermore, for user fingerprints, every time the user operates, the system calculates their identity fingerprint in real time and quickly matches it with the stored identity fingerprint library. If the match is successful, the time series analysis method is used to carefully compare the consistency of the current behavior with the historical behavior in terms of time, operation type and frequency.

[0046] Furthermore, with regard to geographic location, the system obtains geographic location information of users’ visits through IP address positioning technology. If a user account has been used in a certain area for a long time, and suddenly logs in from an area with a very different geographic location and has nothing to do with the user’s historical activity range, and is accompanied by abnormal behavior, the system will increase the risk score of the user’s behavior.

[0047] Furthermore, for the logical sequence, we deeply analyze the contextual logical relationship of user behavior and build a behavior sequence model. If the user operation violates the normal operation logic and directly operates or browses without completing the previous steps, the system will regard these behaviors as high-risk behaviors.

[0048] Furthermore, for honeypot triggering, a honeypot is deployed on the application system to simulate real application services and resources to attract attackers; the honeypot system monitors access behavior in real time, and records the access source (IP address), access port, request content and other key information in detail. When the honeypot detects the access behavior, the system quickly performs an in-depth analysis of the access source identity fingerprint through the identity fingerprint analysis interface; if it matches an abnormal or suspected malicious identity fingerprint, the honeypot is determined to be triggered, and the network blocking function interface is immediately called.

[0049] Furthermore, for the data structure, the system sets structural specifications for the request data of each functional interface, and the request data structure of the data acquisition interface should contain specific fields; when receiving a request, the system first parses and verifies the request data structure, and analyzes the server's screening of the request body and the return body. When there are non-whitelist fields in the data structure, if the request data structure does not meet the preset specifications, the system will preliminarily determine that there may be abnormal situations. If non-whitelist fields and field data type errors occur, the system will determine that a serious system failure or unexpected data leakage has occurred.

[0050] A security protection system for application system information collection, comprising:

[0051] Probe module: deployed on the user side, used to collect data in full or in sampling mode, and transmit the collected data to the data collection module;

[0052] Data collection module: used to collect, compress and transmit the data uploaded by the front-end and back-end probes to the server module. At the same time, it can automatically send browsing js, collect and store js monitoring data, and receive and store mobile SDK monitoring data. This component supports cluster deployment.

[0053] Data reading and writing module: The backend big data warehouse supports cluster deployment, is used to store all monitoring and backend management data, and supports data calculation, retrieval and query;

[0054] API module: used for data sharing and data transmission of external data sources;

[0055] Data preprocessing module: used to desensitize, process, convert and aggregate the transmitted data;

[0056] Attack behavior warning module: Based on the classification and clustering algorithm, positive and negative samples are trained to obtain the identification model of dangerous attack behaviors and define the relevance threshold of dangerous attack behaviors; the real-time data collected by the probe is combined with the identification model to obtain the relevance between the current state and dangerous attack behaviors, and according to the threshold rules of single event alarm threshold and multiple event linkage alarm, the application system is warned and alarmed for the degree of insecurity;

[0057] Security analysis module: continuously combines the data collected by the probe with the discrimination model for iterative training, performs security analysis on the data collected by the probe based on the new model, stores the analysis results in the database, and pushes them to the vector feature library;

[0058] The continuous accumulation of data and continuous training of algorithms establish access security analysis models for various business systems;

[0059] Data storage module: used to cache frequently queried data and topological relationships, and improve the query efficiency of system pages.

[0060] Compared with the prior art, the present invention has the following beneficial effects:

[0061] By implanting probes, combining the data collected by the probes with historical attack data, and using classification and clustering algorithms to comprehensively train positive and negative samples, it is possible to accurately determine whether an attack has occurred and locate the source of the attack, thereby improving the security of the application system.

[0062] Combine the data collected by the probe with the vector analysis model, perform iterative algorithm training, and obtain a new vector analysis model to perform security analysis on the data collected by the probe, thereby improving the update and iteration rate of the application system in identifying attacks and locating the source of attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] Figure 1 This is a flow chart of a security protection method for application system information collection in an embodiment of the present invention;

[0064] Figure 2 The present invention is a structural block diagram of a security protection system for application system information collection in an embodiment of the present invention. DETAILED DESCRIPTION

[0065] In order to facilitate the understanding of those skilled in the art, the present invention is further described below in conjunction with embodiments and drawings. The contents mentioned in the implementation modes are not intended to limit the present invention.

[0066] like Figure 1 As shown, this embodiment provides a security protection method for application system information collection, including the steps of:

[0067] S1. Based on the unique identification of the application system in the operating system, generate the application system security ID (if such ID has not been generated before) when calling the underlying platform basic package (such as the Java system package), and then add a probe to the application system based on this ID to record the historical attack data;

[0068] S2. Based on the classification and clustering algorithm, positive and negative samples are trained to obtain a recognition model for dangerous attack behaviors and define a relevance threshold for dangerous attack behaviors. The real-time data collected by the probe is combined with the recognition model to obtain the relevance between the current state and dangerous attack behaviors. According to the definition of the threshold of a single event alarm and the threshold rule of multiple event linkage alarms, an early warning and alarm of the insecurity level of the application system is given.

[0069] S3, continuously combining the data collected by the probe with the discrimination model for iterative training, performing security analysis on the data collected by the probe based on the new model, storing the analysis results in the database, and pushing them to the vector feature library;

[0070] S4. Users can modify the data pushed to the vector feature library and optimize the results and direction of training and learning.

[0071] The detailed steps of step S1 include:

[0072] S101. Build the overall architecture of the application system, test the application system, and ensure that the server, application, and test ends can run stably;

[0073] S102. When the underlying platform basic package is called for the first time, a corresponding application system security ID is generated; the application system security ID is used as a key identifier for subsequent system identification and management of application system security information.

[0074] S103. Probes are implanted in the application system. The probes are configured to collect data from the application system in full or by sampling. The collected data from the application system includes at least network traffic data, application operation logs, security device operation status, infrastructure-related information, and data interacting with third-party systems. The collected data will be transmitted to the collection module in real time, thereby completing the initialization preparation of the system and establishing a basic data source for the subsequent data processing process.

[0075] The application system adds probes, involving various servers, network devices, and multi-node and multi-service architectures of different applications and database services in the application system.

[0076] The data collected by the probe must be preprocessed before entering step S2. The detailed steps of preprocessing include:

[0077] First, desensitize the data and encrypt or replace the data containing sensitive information;

[0078] Then check the data integrity, and then convert the format, clean the data, remove noise data, duplicate data and other interference information;

[0079] Finally, the processed data is stored and cached in the storage space and used as the data collected by the probe to perform the dangerous attack behavior analysis in step S2.

[0080] Detailed steps of step S2:

[0081] S201, combining the data collected by the probe with the historical attack data;

[0082] S202, dividing the data into positive and negative samples, where the positive samples are known dangerous attack behavior data and the negative samples are normal behavior data;

[0083] S203, using a convolutional neural network algorithm and a K nearest neighbor algorithm to calculate positive and negative samples;

[0084] S204, calculating the correlation between all positive and negative sample data and dangerous attack behaviors;

[0085] S205: Compare with a preset correlation threshold of dangerous attack behaviors, and when the preset correlation threshold is exceeded, issue a warning and alarm on the degree of danger.

[0086] The convolutional neural network algorithm application step in step S203 includes:

[0087] S20311. Normalize the collected sample data so that the data features have a uniform scale to facilitate subsequent calculations.

[0088] S20312. Convert the data into a format suitable for convolutional neural network input; for example, convert two-dimensional data into a three-dimensional tensor.

[0089] S20313. Construct a convolutional neural network model: define the structure of the convolution layer, pooling layer and fully connected layer. The convolution layer is used to extract local features in the data. By setting different convolution kernel sizes and numbers, multi-scale feature extraction is performed on the data. The pooling layer is used to reduce the data dimension and the amount of calculation. Common pooling methods include maximum pooling and average pooling. The fully connected layer is used to map the extracted features to the final classification results.

[0090] S20314. Model training: Input positive and negative sample data into the convolutional neural network model, use the back-propagation algorithm to calculate the gradient of the loss function to the model parameters, and then update the model parameters according to the gradient. During the training process, set the appropriate learning rate and number of iterations.

[0091] Model evaluation and optimization: During the training process, the validation set is used to evaluate the model regularly to calculate indicators such as accuracy, precision, and recall. If the model performance is poor, it can be optimized by adjusting the model structure (such as increasing or decreasing the number of convolutional layers and fully connected layers), adjusting hyperparameters (such as learning rate and regularization parameters), or using data enhancement techniques (such as random transformation of sample data).

[0092] The K nearest neighbor algorithm application step in step S203 includes:

[0093] S20321. Preprocess the data, including normalization and feature selection, and select features related to dangerous behavior judgment; for example, features such as access frequency, access time interval, and data transmission volume are used as input features of the K nearest neighbor algorithm.

[0094] S20322. Calculate distance: For a new data point (behavior data to be judged), calculate its distance to each sample point in the training set. Common distance measurement methods include Euclidean distance and Manhattan distance. For example, the calculation formula for Euclidean distance is Where x and y are two data points and n is the number of features.

[0095] S20323. Select neighbors: Select the K neighbors with the closest distance according to the calculated distance. The selection of K value is the key, and the appropriate K value can be determined by cross-validation and other methods. Generally speaking, K value can be selected between 3 and 10.

[0096] S20324, classification decision: Determine the category of the new data point according to the category to which the majority of samples in the K neighbors belong. If the number of dangerous behavior samples in the K neighbors exceeds half, the new data point is determined as dangerous behavior; otherwise, it is determined as normal behavior.

[0097] Using the vector space model, the data is represented as vectors and the similarity between vectors is calculated;

[0098] Use the cosine similarity calculation formula To measure the similarity between two vectors;

[0099] When a new attack pattern or abnormal behavior is discovered, its corresponding vector feature will be updated to the feature library. By matching the similarity with the known dangerous feature vectors, unknown threats can be identified and prevented in a timely manner.

[0100] The continuous accumulation of data and continuous training of algorithms have established access security analysis models for various business systems, providing a solid model foundation for subsequent security risk identification and processing.

[0101] According to the results, if the model is found to have insufficient performance or misjudgment, the optimization process is started. For the CNN and KNN algorithms, parameter adjustments can be made in a targeted manner. For example, for the CNN algorithm, if the model is found to be overfitting, regularization terms (such as L1 or L2 regularization) can be added to penalize the model complexity and prevent overfitting; for the CNN algorithm, if the accuracy is found to be low, the K value can be adjusted, or more appropriate features can be reselected.

[0102] Add more training data, especially for those scenarios that are prone to misjudgment or omission in testing, to enhance the generalization ability of the model. For example, if it is found that the model performs poorly in identifying new weak password attacks, more similar weak password attack sample data can be collected and added to the training set.

[0103] Improve the structure and algorithm of the vector analysis model to improve the efficiency and accuracy of new feature matching. For example, optimize the dimension selection method of the vector space model, or adopt a more advanced vector similarity calculation algorithm to improve the recognition and matching capabilities of new features. Through continuous testing and optimization, gradually improve the performance of the system so that it can more accurately identify and prevent various security risks.

[0104] Dangerous attack behaviors are identified from six dimensions, including behavioral characteristics, user fingerprints, geographic location, logical sequence, honeypot triggers and data structure.

[0105] For user behavior, accurately calculate the distance between its behavior feature vector and each cluster center (such as Euclidean distance, cosine similarity, etc.); determine which cluster's behavior characteristics the new user behavior is similar to based on the preset threshold and classify it.

[0106] For user fingerprints, every time the user performs an operation, the system calculates their identity fingerprint in real time and quickly matches it with the stored identity fingerprint library. If the match is successful, the time series analysis method is used to carefully compare the consistency of the current behavior with the historical behavior in terms of time, operation type and frequency.

[0107] Regarding geographic location, the system obtains the geographic location information of users through IP address positioning technology. If a user account has been used in a certain area for a long time, and suddenly logs in from an area with a very different geographic location and has nothing to do with the user's historical activity range, and is accompanied by abnormal behavior, the system will increase the risk score of the user's behavior.

[0108] For the logical sequence, we deeply analyze the contextual logical relationship of user behavior and build a behavior sequence model. If the user operation violates the normal operation logic and directly operates or browses without completing the previous steps, the system will regard these behaviors as high-risk behaviors.

[0109] For honeypot triggering, honeypots are reasonably deployed at key locations of the system to simulate real application services and resources to attract attackers; the honeypot system monitors access behavior in real time, and records the access source (IP address), access port, request content and other key information in detail. When the honeypot detects the access behavior, the system quickly performs an in-depth analysis of the access source identity fingerprint through the identity fingerprint analysis interface; if it matches an abnormal or suspected malicious identity fingerprint, the honeypot is determined to be triggered, and the network blocking function interface is immediately called.

[0110] For the data structure, the system sets structural specifications for the request data of each functional interface, and the request data structure of the data collection interface should contain specific fields. When receiving a request, the system first parses and verifies the request data structure, and analyzes the server's screening of the request body and the return body. When there are non-whitelist fields in the data structure, if the request data structure does not meet the preset specifications, the system will preliminarily determine that there may be abnormal situations. If there are non-whitelist fields and field data type errors, the system will determine that a serious system failure or unexpected data leakage has occurred.

[0111] like Figure 2 As shown, a security protection system for application system information collection includes a probe module, a data collection module, a data reading and writing module, an API module, a data preprocessing module, an attack behavior warning module, a security analysis module and a data storage module:

[0112] The probe module is connected to the data collection module: it is deployed on the user side and is used to collect all or sample data and transmit the collected data to the data collection module;

[0113] The data collection module communicates with the data reading and writing module: it is used to collect, compress and transmit the data uploaded by the front-end and back-end probes to the server module. At the same time, it can automatically send browsing js, collect and store js monitoring data, and receive and store sdk monitoring data on the mobile terminal. This component supports cluster deployment;

[0114] The data reading and writing module is connected to the data storage module and the data preprocessing module: the backend big data warehouse supports cluster deployment, is used to store all monitoring and backend management data, and supports data calculation, retrieval and query;

[0115] The API module is connected to the data preprocessing module for data sharing and data transmission with external data sources;

[0116] The data preprocessing module is provided with communication connection with the attack behavior warning module and the security analysis module: it is used to desensitize, process, convert and aggregate the transmitted data;

[0117] Attack behavior warning module: Based on the classification and clustering algorithm, positive and negative samples are trained to obtain the identification model of dangerous attack behaviors and define the relevance threshold of dangerous attack behaviors; the real-time data collected by the probe is combined with the identification model to obtain the relevance between the current state and dangerous attack behaviors, and according to the threshold rules of single event alarm threshold and multiple event linkage alarm, the application system is warned and alarmed for the degree of insecurity;

[0118] Security analysis module: continuously combines the data collected by the probe with the discrimination model for iterative training, performs security analysis on the data collected by the probe based on the new model, stores the analysis results in the database, and pushes them to the vector feature library;

[0119] The continuous accumulation of data and continuous training of algorithms establish access security analysis models for various business systems;

[0120] Data storage module: used to cache frequently queried data and topological relationships, and improve the query efficiency of system pages.

[0121] Compared with the prior art, the present invention has the following beneficial effects:

[0122] By implanting probes, combining the data collected by the probes with historical attack data, and using classification and clustering algorithms to comprehensively train positive and negative samples, it is possible to accurately determine whether an attack has occurred and locate the source of the attack, thereby improving the security of the application system.

[0123] Combine the data collected by the probe with the vector analysis model, perform iterative algorithm training, and obtain a new vector analysis model to perform security analysis on the data collected by the probe, thereby improving the update and iteration rate of the application system in identifying attacks and locating the source of attacks.

[0124] Probe data is combined with other related data, and multiple probe data from the same service and network segment are combined to make model recognition more efficient and practical.

[0125] Security data is obtained based on the application call behavior of the underlying library. These security data are combined with other data (such as the server is in the external network and security incidents have occurred frequently in history) to form a security assessment model. In addition to defining thresholds through the security data of an application to determine the security status, the security data of all applications of an IP address / a network segment / a server can also be summarized (the honeypot security status can also be factored in here) to perceive the security situation. For example, if multiple servers on a server are subjected to a supply of low intensity, but the overall supply method is similar and the number is large, the security warning level can be improved, thereby triggering attack behaviors more scientifically.

[0126] The above is a detailed introduction to a security protection method and system for application system information collection provided by the present application. The description of the specific embodiment is only used to help understand the method and its core idea of ​​the present application. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of the present application, several improvements and modifications can be made to the present application, and these improvements and modifications also fall within the scope of protection of the claims of the present application.

Claims

1. A security protection method for application system information collection, characterized in that: Includes steps: S1. Based on the unique identification of the application system in the operating system, the application system security ID is generated when the underlying platform basic package is called. Then, the application system is probed based on the application system security ID to record historical attack data. S2. Training positive and negative samples based on the classification and clustering algorithm to obtain a recognition model for dangerous attack behaviors and define a relevance threshold for dangerous attack behaviors; The real-time data collected by the probe is combined with the identification model to obtain the correlation between the current state and the dangerous attack behavior. According to the threshold rules for single event alarm and multiple event linkage alarm, early warning and alarm of the insecurity level of the application system are given; S3, continuously combining the data collected by the probe with the discrimination model for iterative training, performing security analysis on the data collected by the probe based on the new model, storing the analysis results in the database, and pushing them to the vector feature library; S4. Users can modify the data pushed to the vector feature library and optimize the results and direction of training and learning.

2. A security protection method for application system information collection according to claim 1, characterized in that: The detailed steps of step S1 include: S101. Build the overall architecture of the application system, test the application system, and ensure that the server, application, and test ends can run stably; S102. When the underlying platform basic package is called for the first time, a corresponding application system security ID is generated; the application system security ID is used as a key identifier for subsequent system identification and management of application system security information. S103. Implant a probe in the application system. The probe is configured to collect data of the application system in full or by sampling. The collected data of the application system includes at least network traffic data, application operation logs, security device operation status, infrastructure-related information, and data on interaction with third-party systems.

3. A security protection method for application system information collection according to claim 2, characterized in that: The application system adds probes, involving various servers, network devices, and multi-node and multi-service architectures of different applications and database services in the application system.

4. A security protection method for application system information collection according to claim 3, characterized in that: The data collected by the probe must be preprocessed before entering step S2. The detailed steps of preprocessing include: First, desensitize the data and encrypt or replace the data containing sensitive information; Then check the data integrity, and then convert the format, clean the data, remove noise data, duplicate data and other interference information; Finally, the processed data is stored and cached in the storage space and used as the data collected by the probe to perform the dangerous attack behavior analysis in step S2.

5. A security protection method for application system information collection according to claim 4, characterized in that: Detailed steps of step S2: S201, combining the data collected by the probe with the historical attack data; S202, dividing the data into positive and negative samples, where the positive samples are known dangerous attack behavior data and the negative samples are normal behavior data; S203, using a convolutional neural network algorithm and a K nearest neighbor algorithm to calculate positive and negative samples; S204, calculating the correlation between all positive and negative sample data and dangerous attack behaviors; S205: Compare with a preset correlation threshold of dangerous attack behaviors, and when the preset correlation threshold is exceeded, issue a warning and alarm on the degree of danger.

6. A security protection method for application system information collection according to claim 5, characterized in that: The convolutional neural network algorithm application step in step S203 includes: S20311. Normalize the collected sample data so that the data features have a uniform scale to facilitate subsequent calculations. S20312. Convert the data into a format suitable for convolutional neural network input; for example, convert two-dimensional data into a three-dimensional tensor. S20313. Construct a convolutional neural network model: define the structure of convolutional layer, pooling layer and fully connected layer. The convolutional layer is used to extract local features in the data. By setting different convolution kernel sizes and numbers, multi-scale feature extraction is performed on the data. The pooling layer is used to reduce the data dimension. The fully connected layer is used to map the extracted features to the final classification result. S20314. Model training: Input positive and negative sample data into the convolutional neural network model, use the back-propagation algorithm to calculate the gradient of the loss function to the model parameters, and then update the model parameters according to the gradient. During the training process, set the appropriate learning rate and number of iterations.

7. A security protection method for application system information collection according to claim 6, characterized in that: The K nearest neighbor algorithm application step in step S203 includes: S20321. Preprocess the data, including normalization and feature selection, and select features related to the judgment of dangerous behavior; S20322. Calculate distance: for a new data point, calculate its distance to each sample point in the training set; S20323, selecting neighbors: selecting the nearest K neighbors according to the calculated distances; S20324. Classification decision: Determine the category of the new data point based on the category to which the majority of samples among the K neighbors belong.

8. A security protection method for application system information collection according to claim 7, characterized in that: Using the vector space model, the data is represented as vectors and the similarity between vectors is calculated; When a new attack pattern or abnormal behavior is discovered, its corresponding vector feature will be updated to the feature library. By matching the similarity with the known dangerous feature vectors, unknown threats can be identified and prevented in a timely manner. The continuous accumulation of data and continuous training of algorithms establish access security analysis models for various business systems; According to the results, if the model is found to have insufficient performance or misjudgment, the optimization process is started to adjust the parameters of the CNN and KNN algorithms; Supplement training data for scenarios that are prone to misjudgment or omission during testing.

9. A security protection method for application system information collection according to claim 8, characterized in that: The identification of dangerous attack behaviors is carried out from six dimensions, including behavioral characteristics, user fingerprints, geographic location, logical sequence, honeypot triggering and data structure. For user behavior, accurately calculate the distance between its behavior feature vector and each cluster center, determine whether the user behavior is similar to a certain behavior feature of the cluster based on the preset threshold, and classify it; For user fingerprints, the system calculates the user's identity fingerprint in real time every time the user operates, and quickly matches it with the stored identity fingerprint library. If the match is successful, the system uses time series analysis methods to carefully compare the current behavior with the historical behavior in terms of time, operation type and frequency consistency; For geographic location, the system obtains the geographic location information of users through IP address positioning technology. If a user account has been used in a certain area for a long time, and suddenly logs in from a region with a very different geographic location and no connection with the user's historical activity range, and is accompanied by abnormal behavior, the system will increase the risk score of the user's behavior; For logical sequence, we deeply analyze the contextual logic relationship of user behaviors and build a behavior sequence model. If the user operation violates the normal operation logic and directly operates or browses without completing the previous steps, the system will regard these behaviors as high-risk behaviors. For honeypot triggering, deploy honeypots on the application system to simulate real application services and resources to attract attackers; The honeypot system monitors access behaviors in real time, and records the access source, access port, request content and other key information in detail. Once the honeypot detects the access behavior, the system quickly conducts an in-depth analysis of the access source identity fingerprint through the identity fingerprint analysis interface. If it matches an abnormal or suspected malicious identity fingerprint, the honeypot is determined to be triggered; For the data structure, the system sets structural specifications for the request data of each functional interface, and the request data structure of the data collection interface should contain specific fields. When receiving a request, the system first parses and verifies the request data structure, and analyzes the server's screening of the request body and the return body. When there are non-whitelist fields in the data structure, if the request data structure does not meet the preset specifications, the system will preliminarily determine that there may be abnormal situations. If there are non-whitelist fields and field data type errors, the system will determine that a serious system failure or unexpected data leakage has occurred.

10. A security protection system for application system information collection, characterized in that: It includes probe module, data collection module, data reading and writing module, API module, data preprocessing module, attack behavior warning module, security analysis module and data storage module: The probe module is connected to the data collection module: it is deployed on the user side and is used to collect all or sample data and transmit the collected data to the data collection module; The data collection module communicates with the data reading and writing module: it is used to collect, compress and transmit the data uploaded by the front-end and back-end probes to the server module. At the same time, it can automatically send browsing js, collect and store js monitoring data, and receive and store sdk monitoring data on the mobile terminal. This component supports cluster deployment; The data reading and writing module is connected to the data storage module and the API module: the backend big data warehouse supports cluster deployment, is used to store all monitoring and backend management data, and supports data calculation, retrieval and query; The API module is provided with communication connections with the data preprocessing module and the data storage module: used for data sharing and data transmission with external data sources; The data preprocessing module is provided with communication connection with the attack behavior warning module and the security analysis module: it is used to desensitize, process, convert and aggregate the transmitted data; Aggression behavior warning module: Based on the classification and clustering algorithm, positive and negative samples are trained to obtain the identification model of dangerous attack behaviors and define the relevance threshold of dangerous attack behaviors; The real-time data collected by the probe is combined with the identification model to obtain the correlation between the current state and the dangerous attack behavior. According to the threshold rules for single event alarm and multiple event linkage alarm, early warning and alarm of the insecurity level of the application system are given; Security analysis module: continuously combines the data collected by the probe with the discrimination model for iterative training, performs security analysis on the data collected by the probe based on the new model, stores the analysis results in the database, and pushes them to the vector feature library; The continuous accumulation of data and continuous training of algorithms establish access security analysis models for various business systems; Data storage module: used to cache frequently queried data and topological relationships.

Images