Security detection scheduling strategy and method based on multi-vector factor

Abstract

The invention relates to the technical field of network security, in particular to a security detection scheduling strategy and method based on a multi-vector factor. According to the method, by integrating multi-dimensional information such as system performance, security events, malicious software history detection, security policies and access records, a dynamically adjusted security detection scheduling policy is constructed. According to the technical scheme, the method comprises the steps of receiving a system detection point vector of multi-dimensional information, and performing data preprocessing; carrying out classification and weighted calculation on the preprocessed data, and combining historical vectors and dynamic monitoring point vectors which are smoothed by Kalman filtering to obtain a system security metric value through entropy calculation; calculating a regional environment safety influence factor by using a statistical method, and fusing the historical vector and the influence factor to obtain a dynamic safety threshold value; and establishing and executing a targeted security detection scheduling model according to a comparison result of the system security metric value and the dynamic security threshold value. The method has the beneficial effects that the detection strategy can be dynamically adjusted according to the overall security of the network environment and the historical data of the equipment, the accuracy and efficiency of security detection are improved, potential security threats are found and coped with in time, and the security of the whole network area is improved.

Description

Technical Field

[0001] The present invention belongs to the field of network security, and in particular relates to a security detection scheduling strategy and method based on multi-vector factors. Background Art

[0002] With the rapid development of information technology, network environments and information systems are becoming increasingly complex, and security threats are also increasing. Traditional security detection methods often rely on a single detection indicator or vector, such as system logs, network traffic, etc. This method is powerless when facing a variety of attack methods. Therefore, the field of information security urgently needs a technical solution that can comprehensively consider multi-dimensional information and improve the accuracy and efficiency of security detection.

[0003] At present, although some security detection strategies have tried to integrate multiple security factors, they still have many deficiencies in data processing, feature extraction, security assessment, etc. For example, some strategies are inefficient in processing large-scale data and have difficulty responding to security incidents in real time; other strategies may increase false positive or false negative rates due to improper feature selection or unreasonable weight allocation.

[0004] In addition, the prior art also lacks a method that can dynamically adjust the security detection strategy according to the network environment and security requirements of the system. In practical applications, the security requirements of the system often change with the changes in the network environment, and fixed security detection strategies are difficult to adapt to the dynamic changes. Therefore, the present invention proposes a security detection scheduling strategy and method based on multi-vector factors, which aims to solve the problems existing in the prior art, improve the accuracy and efficiency of security detection, and can be dynamically adjusted according to the network environment and security requirements of the system. Summary of the invention

[0005] The present invention aims to solve the problem that traditional security detection strategies rely on a single detection indicator or vector, the security detection scheduling strategy is fixed and lacks flexibility, and cannot effectively cope with complex and changeable network environments and security threats.

[0006] To this end, the present invention proposes a security detection scheduling strategy and method based on multi-vector factors, which can comprehensively consider multiple security factors and dynamically adjust the detection strategy to improve the accuracy and efficiency of security detection.

[0007] Specifically, the technical solution of the present invention includes the following key aspects:

[0008] S101: Input detection point vector: Receive system detection point vector containing multi-dimensional information such as system performance, security events, malware historical detection, security policies and access records;

[0009] S102: Data preprocessing: performing data cleaning and standardization on the currently acquired detection point vectors, removing invalid or redundant information, and ensuring the consistency and comparability of the data;

[0010] S103. Data classification and weighting: classify the preprocessed data and perform weighted calculation based on the importance and relevance of the data;

[0011] S104. Calculate the entropy value of the weighted data, and combine the historical vector and dynamic monitoring point vector smoothed by Kalman filter to obtain the system security metric M; Among them, the integration of historical vectors enhances the accuracy and comprehensiveness of safety assessment; The integration of dynamic monitoring point vectors reflects the real-time security status of the system;

[0012] S105. Calculation of regional environmental impact factor: derive the regional environmental safety impact factor q, which represents the degree of regional environmental safety, through statistical methods;

[0013] S106. Dynamic security threshold determination: integrating the historical vector and the regional environmental impact factor q, and obtaining a dynamic security threshold k that reflects the security requirements of the system in the current network environment;

[0014] S107: Establishment and execution of security detection scheduling model: A security detection scheduling model is established based on the above information to integrate and judge the input current system security metric value M and dynamic security threshold k; Based on the judgment results, perform corresponding special tests to ensure the safety of the system.

[0015] Compared with the prior art, the present invention has the following beneficial effects: The method dynamically adjusts the detection scheduling strategy based on the overall security of the network environment and the historical data of the equipment, and has better performance; The method effectively improves the security sensitivity of the system and timely detects and responds to potential security threats; The method can link the network area system to improve the security of the overall network area; The method performs special inspections through the generated dynamic scheduling engine, which is more targeted; The method combines historical safety vectors to participate in the construction of a scheduling engine model, thereby improving the accuracy of safety detection scheduling; The method introduces regional environmental impact factors obtained based on statistical methods to participate in the dynamic generation of security thresholds, so that security detection scheduling can dynamically optimize scanning strategies based on the overall security level of the network where the device is located; BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the implementation of the present invention or the existing technical solutions, the following briefly introduces the drawings required to be used in the embodiments or the description of the prior art.

[0017] Figure 1 The method of the present invention

[0018] Figure 2 Flow chart of an embodiment of the present invention Specific implementation methods

[0019] The following is a clear and complete description of the technical solutions in the embodiments of the invention in conjunction with the drawings in the embodiments of the invention. Obviously, the described embodiments are only part of the embodiments of the invention, not all of the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without creative work belong to the protection scope of the present invention. In the following description, many specific details are explained to facilitate a full understanding of the present invention, but the present invention can also be implemented in other ways different from those described herein. Those skilled in the art can make similar generalizations without violating the connotation of the present invention, so the present invention is not limited by the specific embodiments disclosed below.

[0020] like Figure 1 As shown, the present invention discloses a method for a security detection scheduling strategy and method based on multi-vector factors, including the following steps:

[0021] S101: Obtain dynamic monitoring point vectors and historical vectors;

[0022] S102: Perform Kalman filtering on the history vector;

[0023] S103: performing data cleaning and standardization processing on the above vectors;

[0024] S104: classify the data to establish a weighted model and calculate the entropy value to obtain the system security metric m;

[0025] S105: Obtaining a regional environmental impact factor q obtained based on a statistical method;

[0026] S106: dynamically derive a safety threshold k by integrating the historical vector and the regional environmental impact factor q;

[0027] S107: dynamically construct a scheduling engine model based on the above obtained content and perform targeted special detection;

[0028] As a preferred embodiment of the present invention, in step S101, the acquisition process of the historical vector is shown in S202, which can be obtained from the recorded historical data;

[0029] As a preferred embodiment of the present invention, in step S102, the Kalman filtering of the history vector is implemented by the following steps:

[0030] Assume that a historical vector data set of the past 7 days is selected for calculation

[0031] Setting the initial state estimate and the initial state covariance estimate . Determine the state transition matrix , measurement matrix , process noise covariance matrix and the measurement noise covariance matrix For each , use the state prediction equation and variance prediction equation to predict the state and variance. Use the Kalman gain equation to calculate the Kalman gain. Use the state update equation to update the state estimate. Use the variance update equation to update the state covariance estimate. After completing all 7 iterations, a set of filtered state estimates are obtained. , that is, the filtered historical vector dataset Q.

[0032] As a preferred embodiment of the present invention, in step S103, a historical impact factor p is obtained by performing a simple average on the filtered historical vector data set Q, which represents the overall safety metric value of the system in the historical process;

[0033] As a preferred embodiment of the present invention, in step S105, the regional environmental impact factor is determined by the security situation of the entire network, which is affected by environmental security, data security, attack frequency, number of vulnerabilities, vulnerability impact, etc., and is obtained according to a weighted model;

[0034] As a preferred implementation scheme of the present invention, in step S106, as shown in FIG. S209, it is necessary to fuse the historical vector and the regional environmental impact factor q. The fused historical vector and the regional environmental impact factor q are obtained by a simple weighted calculation formula, that is, the fused value , where the weights k1, k2 can be derived from statistical principles or defined according to the required system security sensitivity;

[0035] As a preferred embodiment of the present invention, in step S107, as shown in FIG. S211, a scheduling model is constructed by using the system security metric value m and the fusion value y. Here, a simple comparison is used to construct the scheduling model, that is, when The scanning detection tasks A1, A2, and An are dynamically allocated according to the vector scores of different monitoring points;

[0036] The above description is only a preferred specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can make equivalent replacements or changes according to the technical scheme and inventive concept of the present invention within the technical scope disclosed by the present invention, which should be within the protection scope of the present invention.

Claims

1. A safety detection scheduling strategy and method based on multi-vector factors, characterized in that: The following steps are involved: a. Input detection point vector: Receive system detection point vector containing multi-dimensional information such as system performance, security events, historical malware detection, security policies, and access records; b. Data preprocessing: clean and standardize the currently acquired detection point vectors, remove invalid or redundant information, and ensure data consistency and comparability; c. Data classification and weighting: classify the preprocessed data and perform weighted calculations based on the importance and relevance of the data; d. Calculate the entropy value of the weighted data, and combine the historical vector and dynamic monitoring point vector smoothed by Kalman filter to obtain the system safety metric M; Among them, the integration of historical vectors enhances the accuracy and comprehensiveness of safety assessment; The integration of dynamic monitoring point vectors reflects the real-time security status of the system; e. Calculation of regional environmental impact factor: Calculate the regional environmental safety impact factor q, which represents the degree of regional environmental safety, through statistical methods; f. Dynamic security threshold determination: By integrating the historical vector and the regional environmental impact factor q, a dynamic security threshold k that reflects the security requirements of the system in the current network environment is obtained; g. Establishment and execution of security detection scheduling model: A security detection scheduling model is established based on the above information to integrate and judge the input current system security metric value M and dynamic security threshold k; Based on the judgment results, perform corresponding special tests to ensure the safety of the system.

2. The multi-vector factor-based security detection scheduling strategy and method according to claim 1, characterized in that: It also includes the following technical features: In the security metric calculation step d, a regional environment security impact factor r is further introduced to refine or supplement the security level of the regional network environment. When comprehensively evaluating multiple security factors in the network environment, this factor r takes into account more or more specific network security factors than the regional environment impact factor q to improve the accuracy of the security assessment.

3. The multi-vector factor-based safety detection scheduling strategy and method according to claim 1 is characterized in that: It also includes the following technical features: when calculating the system safety metric M and the dynamic safety threshold k, in addition to considering the historical vectors and dynamic monitoring point vectors described in claim 1, historical related vectors related to safety are also introduced to enhance the comprehensiveness and depth of the safety assessment.

Images