Security baseline check data analysis method and device based on open architecture and server

Abstract

The embodiment of the invention provides a security baseline check data analysis method and device based on an open architecture and a server. The method comprises the following steps that: a server can obtain check data from each baseline check tool; the server can use a preset check data specification format to carry out structured processing on the check data to obtain final check data. And the server can analyze and match the structured check data according to the target check item and the target check result to obtain the coverage rate and the coincidence rate of the check data. If the coverage rate is smaller than a first threshold value, and / or the coincidence rate is smaller than a second threshold value, the server can use the checked item and the actual checking result to be matched with the target checking item and the target checking result. And the server can generate a disposal process corresponding to the coincidence rate and / or a disposal process corresponding to the coverage rate according to the matching result. The method is used for achieving the effect of improving the safety checking efficiency of the equipment.

Description

Technical Field

[0001] The present application relates to the field of computers, and in particular to a security baseline verification data analysis method, device and server based on an open architecture. Background Art

[0002] With the development of science and technology, the degree of equipment automation has gradually improved. As an important part of the equipment automation process, equipment automatic verification is widely used in equipment. However, different equipment usually has different safety baseline requirements and uses different safety verification tools. Therefore, technicians usually need to complete the safety verification of each device by calling the safety verification tools of different devices one by one. Obviously, this method has the problem of low efficiency of equipment safety verification. Summary of the invention

[0003] The embodiments of the present application provide a security baseline verification data analysis method, server, storage medium and program product based on an open architecture, so as to achieve the effect of improving the efficiency of security verification of equipment.

[0004] In a first aspect, an embodiment of the present application provides a security baseline verification data analysis method based on an open architecture, comprising:

[0005] Acquire the verification data uploaded by each baseline verification tool that has been connected to the open architecture, and perform structured processing on the verification data according to a preset verification data standard format;

[0006] Obtaining the target verification items and target verification results uploaded by each of the baseline verification tools from the configuration management database, and analyzing the structured verification data based on the target verification items and the target verification results to obtain the coverage and compliance rate of the verification data;

[0007] If the coverage rate is less than the first threshold and / or the compliance rate is less than the second threshold, the verification data that does not match the target verification item and the target verification result is obtained, and based on the mismatching verification data, the disposal process corresponding to the compliance rate and / or the coverage rate is generated and sent.

[0008] Optionally, analyzing the verification data after structured processing based on the target verification items and the target verification results to obtain coverage and compliance of the verification data includes:

[0009] Matching actual verification results of the verified items in the verification data with target verification results of the target verification items, and counting a first number of verified items whose actual verification results match the target verification results;

[0010] Determining the coverage rate according to the ratio of the total number of the verified items to the total number of the target verification items;

[0011] Matching the actual verification results of the verification sub-items of the verified items in the verification data with the target verification results of the verification sub-items of the target verification items, and counting a second number of the verification sub-items of the verified items whose actual verification results match the target verification results;

[0012] The compliance rate is determined according to a ratio of the second number to the total number of verification sub-items of the target verification item.

[0013] Optionally, if the coverage rate is less than a first threshold, obtaining the verification data that does not match the target verification item and the target verification result, and generating and sending a disposal process corresponding to the coverage rate according to the unmatched verification data, including:

[0014] If the coverage rate corresponding to the baseline verification tool is less than a first threshold, generating a list of uncovered assets according to the verified items and the target verification items;

[0015] According to the uncovered asset list, a new coverage improvement disposal sheet is created, and a coverage improvement disposal process is initiated; the coverage improvement disposal process includes at least one task to be verified;

[0016] The uncovered asset list and the tasks to be verified in the coverage improvement disposal process are sent to the baseline verification tool, so that the baseline verification tool regenerates and uploads verification data according to the tasks to be verified.

[0017] Optionally, if the compliance rate is less than a second threshold, obtaining the verification data that does not match the target verification item and the target verification result, and generating and sending a disposal process corresponding to the compliance rate according to the unmatched verification data, including:

[0018] If the compliance rate is less than a second threshold, determining the verified items that have failed the verification according to the actual project results of the verification sub-items of the verified items and the target verification results of the verification sub-items of the target verification items;

[0019] Generate an exception handling form according to the verification sub-item of the verified project that failed the verification, and initiate an exception handling process; the exception handling process at least includes the project name of the verification sub-item of the verified project;

[0020] The exception handling process is sent to the baseline verification tool, and a verification data exception reminder is generated according to the baseline verification tool and the project name; the verification data exception reminder indicates that there is an exception in the verification result of the project.

[0021] Optionally, the method further includes:

[0022] Matching actual verification results of the verified items in the verification data with target verification results of the target verification items, and counting a third number of verified items whose actual verification results all meet the target verification results, and a fourth number of verified items whose actual verification results all do not meet the target verification results;

[0023] Determine the normal rate according to the ratio of the third number to the total number of the target verification items; determine the abnormal rate according to the ratio of the fourth number to the total number of the target verification items;

[0024] If the normal rate is less than the third threshold and the abnormal rate is greater than the fourth threshold, a logic abnormality reminder of the baseline verification tool is generated; the logic abnormality reminder indicates that there is an abnormality in the verification logic of the baseline verification tool.

[0025] Optionally, the method further includes:

[0026] Generate and initiate an exception registration process based on the exception registration information; the exception registration information at least includes a baseline verification tool and a verification project name;

[0027] In the configuration management database, the name of the verification item of the baseline verification tool is marked as an exception item; the verification data is not acquired or matched for the exception item.

[0028] In a second aspect, an embodiment of the present application provides a security baseline verification data analysis device based on an open architecture, comprising:

[0029] An acquisition module, used to acquire the verification data uploaded by each baseline verification tool that has been connected to the open architecture, and perform structured processing on the verification data according to a preset verification data specification format;

[0030] A processing module is used to obtain the target verification items and target verification results uploaded by each of the baseline verification tools from the configuration management database, and analyze the verification data after structured processing based on the target verification items and the target verification results to obtain the coverage and compliance rate of the verification data; if the coverage rate is less than a first threshold value, and / or the compliance rate is less than a second threshold value, then obtain the verification data that does not match the target verification items and the target verification results, and generate and send a disposal process corresponding to the compliance rate and / or the coverage rate based on the unmatched verification data.

[0031] Optionally, the processing module is used to:

[0032] Matching actual verification results of the verified items in the verification data with target verification results of the target verification items, and counting a first number of verified items whose actual verification results match the target verification results;

[0033] Determining the coverage rate according to the ratio of the total number of the verified items to the total number of the target verification items;

[0034] Matching the actual verification results of the verification sub-items of the verified items in the verification data with the target verification results of the verification sub-items of the target verification items, and counting a second number of the verification sub-items of the verified items whose actual verification results match the target verification results;

[0035] The compliance rate is determined according to a ratio of the second number to the total number of verification sub-items of the target verification item.

[0036] Optionally, the processing module is used to:

[0037] If the coverage rate corresponding to the baseline verification tool is less than a first threshold, generating a list of uncovered assets according to the verified items and the target verification items;

[0038] According to the uncovered asset list, a new coverage improvement disposal sheet is created, and a coverage improvement disposal process is initiated; the coverage improvement disposal process includes at least one task to be verified;

[0039] The uncovered asset list and the tasks to be verified in the coverage improvement disposal process are sent to the baseline verification tool, so that the baseline verification tool regenerates and uploads verification data according to the tasks to be verified.

[0040] Optionally, the processing module is used to:

[0041] If the compliance rate is less than a second threshold, determining the verified items that have failed the verification according to the actual project results of the verification sub-items of the verified items and the target verification results of the verification sub-items of the target verification items;

[0042] Generate an exception handling form according to the verification sub-item of the verified project that failed the verification, and initiate an exception handling process; the exception handling process at least includes the project name of the verification sub-item of the verified project;

[0043] The exception handling process is sent to the baseline verification tool, and a verification data exception reminder is generated according to the baseline verification tool and the project name; the verification data exception reminder indicates that there is an exception in the verification result of the project.

[0044] Optionally, the processing module is further configured to:

[0045] Matching actual verification results of the verified items in the verification data with target verification results of the target verification items, and counting a third number of verified items whose actual verification results all meet the target verification results, and a fourth number of verified items whose actual verification results all do not meet the target verification results;

[0046] Determine the normal rate according to the ratio of the third number to the total number of the target verification items; determine the abnormal rate according to the ratio of the fourth number to the total number of the target verification items;

[0047] If the normal rate is less than the third threshold and the abnormal rate is greater than the fourth threshold, a logic abnormality reminder of the baseline verification tool is generated; the logic abnormality reminder indicates that there is an abnormality in the verification logic of the baseline verification tool.

[0048] Optionally, the processing module is further configured to:

[0049] Generate and initiate an exception registration process based on the exception registration information; the exception registration information at least includes a baseline verification tool and a verification project name;

[0050] In the configuration management database, the name of the verification item of the baseline verification tool is marked as an exception item; the verification data is not acquired or matched for the exception item.

[0051] In a third aspect, an embodiment of the present application provides a server, including: a memory, a processor;

[0052] The memory stores computer-executable instructions;

[0053] The processor executes the computer-executable instructions stored in the memory, so that the processor executes the above first aspect and / or various possible implementations of the first aspect.

[0054] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the first aspect above and / or various possible implementations of the first aspect.

[0055] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the above first aspect and / or various possible implementation methods of the first aspect.

[0056] The open architecture-based security baseline verification data analysis method, device and server provided in the embodiments of the present application obtain verification data from each baseline verification tool; use a preset verification data specification format to structure the verification data to obtain final verification data; analyze and match the structured verification data according to the target verification items and target verification results to obtain the coverage and compliance rate of the verification data; if the coverage rate is less than a first threshold, and / or the compliance rate is less than a second threshold, use the verified items and actual verification results to match the target verification items and target verification results; based on the matching results, generate a disposal process corresponding to the compliance rate, and / or a disposal process corresponding to the coverage rate, so as to achieve the effect of improving the efficiency of the security verification of the equipment. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0058] Figure 1 A flowchart of the open architecture-based security baseline verification data analysis method provided for this application;

[0059] Figure 2 A schematic diagram of the structure of the security baseline verification data analysis system based on an open architecture provided for this application;

[0060] Figure 3 A schematic diagram of the structure of a security baseline verification data analysis device based on an open architecture provided in this application;

[0061] Figure 4 A schematic diagram of the structure of the server provided for this application.

[0062] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0063] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0064] First, the terms involved in this application are explained:

[0065] Security baseline: The minimum reference standard for security, that is, the minimum security standard that meets security needs.

[0066] Baseline verification: The full name is security baseline configuration verification, which generally refers to the verification of the security configuration of IT equipment according to the configuration baseline requirements to identify weak or non-compliant configurations.

[0067] Configuration Management Database: The full name is Configuration Management Database, or CMDB for short. It is a logical database that contains information about the entire life cycle of configuration items and the relationships between configuration items. The relationships can include physical relationships, real-time communication relationships, non-real-time communication relationships, and dependency relationships.

[0068] At present, most of the security baseline verification tools on the market are deployed and managed by various manufacturers. In addition, the security baseline requirements of security baseline verification tools are also different. In addition, the verification methods of security baseline verification tools are also quite different. In other words, the security baseline verification tools on the market lack a unified integrated management system and standardized verification data format standards, and cannot analyze the overall baseline compliance status of the target device or target system.

[0069] In response to the above problems, the main goal of the safety baseline management system currently in use is to schedule verification scripts, complete baseline verification, and collect verification information. This safety baseline management system mainly focuses on finding problems, and fails to provide a closed-loop management solution for the entire life cycle of baseline verification, such as verification data comparison, analysis and statistics, and problem rectification. It cannot fully utilize the effectiveness of baseline verification data, and there is a problem of low efficiency in equipment safety verification.

[0070] In response to the above problems, the open architecture-based security baseline verification data analysis method provided in the present application is used for an open architecture security baseline verification data analysis system. The security baseline verification data analysis system can modularly connect to baseline inspection tools of various professions. The baseline inspection tool can be applied to baseline inspections of systems, networks, security, terminals, etc. The security baseline verification data analysis system can run on a server. The security baseline verification data analysis system can process the verification result data received from different baseline inspection tools through data specification and standardization for unified management. At the same time, the security baseline verification data analysis system can connect to the configuration management database and provide data analysis functions such as baseline verification coverage calculation based on asset data. The security baseline verification data analysis system can also provide an abnormal rectification process to achieve closed-loop management.

[0071] In addition, the security baseline verification data analysis system of the present application adopts an open architecture and modular management to achieve the access of different baseline inspection tools, which can solve the problem of isolation of verification data of different professions and different resources, and can also form an analysis of the overall baseline compliance situation based on all connected baseline verification tools. The security baseline verification data analysis system can manage the security baseline inspection tools and inspection requirements of various professional equipment in one stop. Specifically, the security baseline verification data analysis system can include closed-loop management of the entire life cycle of baseline verification, such as verification data comparison, analysis and statistics, and problem rectification. The security baseline verification data analysis system can also detect anomalies in the equipment through automated verification.

[0072] In addition, the security baseline verification data analysis system can also combine asset information to analyze indicators such as the coverage rate and compliance rate of the verification data. In the case of coverage that does not meet the requirements, the security baseline verification data analysis system can provide feedback to each baseline verification tool and the person in charge of the verification work for additional verification until the coverage rate of the verification data meets the requirements. In the case of compliance that does not meet the requirements, the security baseline verification data analysis system can initiate an exception handling process and track the non-compliant exception until the problem is rectified. The security baseline verification data analysis system can also regularly perform security baseline verification indicator statistical analysis tasks to avoid situations where new equipment is put online and equipment configuration is modified, which does not meet the security baseline configuration requirements. At the same time, the security baseline verification data analysis system can also verify the verification logic to ensure the validity of the baseline verification data.

[0073] In summary, this application adopts an open architecture, and connects to external baseline verification tools through the data management module in the security baseline verification data analysis system, so as to achieve the normalization and standardization of baseline verification data of different professions and different equipment, so that the security baseline verification data analysis system of this application has strong scalability. This application also connects to the asset configuration database through the data analysis module in the security baseline verification data analysis system, synchronizes the status changes of assets online, put into production, offline, etc. in real time, and combines the maintenance and management of the exception list to ensure accurate and full coverage verification of various types of assets, thereby improving the precision and accuracy of verification.

[0074] In addition, the security baseline verification data analysis system of this application relies on the configuration data and verification result data of the CMDB to analyze indicators such as coverage and compliance, and updates them dynamically in real time, providing a global view of the overall security baseline compliance situation, which is convenient for security administrators to conduct statistical analysis and unified management of the compliance of various asset baselines. In addition, the security baseline verification data analysis system of this application can also integrate coverage improvement, exception handling, and verification logic verification functions through a one-stop security baseline management module, making baseline-related management work fully online and automated, and realizing one-stop closed-loop management of baseline verification to find problems, analyze problems, and rectify problems, reducing the manual workload of security baseline management and improving the efficiency of equipment verification based on security baselines.

[0075] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0076] Figure 1 The flowchart of the open architecture-based security baseline verification data analysis method provided in this application is applied to the security baseline verification data analysis system, with the server as the execution subject, and the security baseline verification data analysis system can be run in the server. Figure 1 As shown, the method includes:

[0077] S101. Acquire the verification data uploaded by each baseline verification tool that has been connected to the open architecture, and perform structured processing on the verification data according to a preset verification data standard format.

[0078] In this embodiment, the server can obtain the verification data obtained by verification from each baseline verification tool that has been connected to the open architecture. After obtaining the verification data, the server can use the preset verification data specification format to perform structured processing on the verification data to obtain the final verification data. The structured verification data can be stored in the database for calling in subsequent steps.

[0079] Optionally, the server may formulate different verification data standard formats for different baseline verification tools. Optionally, the standard format may also include a fixed file format. For example, the file format may be text-spaced format data such as csv. Optionally, the baseline verification tool may report the verification data to the server platform via a standardized file transfer interface such as FTP, HTTP, SAMBA, etc.

[0080] Optionally, after obtaining the verification data, the server can perform centralized structured storage of the verification data. The structured stored verification data can be queried and retrieved according to different screening conditions, and can support multiple conditional logical cascades (or, and, not). The server can also generate reports and data visualization views based on the search results.

[0081] Optionally, the server may read and store the verification logic scripts from each baseline inspection tool through an interface, and provide a centralized verification logic script review channel.

[0082] S102, obtaining the target verification items and target verification results uploaded by each baseline verification tool from the configuration management database, and analyzing the structured verification data based on the target verification items and target verification results to obtain the coverage and compliance rate of the verification data.

[0083] In this embodiment, the server can obtain the target verification items and target verification results from the configuration management database. The target verification items and target verification results can be based on the status changes of asset online, production, offline, etc. The server can analyze and match the structured verification data according to the target verification items and target verification results to obtain the coverage and compliance rate of the verification data. Optionally, the server can calculate the coverage and compliance rate of each baseline verification tool. And, the server can also calculate the coverage and compliance rate of all verification data.

[0084] In one example, the step of calculating the coverage rate and the compliance rate by the server may specifically include:

[0085] Step 1, match the actual verification results of the verification sub-items of the verified items in the verification data with the target verification results of the verification sub-items of the target verification items, and count the second number of verification sub-items of the verified items whose actual verification results match the target verification results; determine the compliance rate based on the ratio of the second number to the total number of verification sub-items of the target verification items.

[0086] In this step, the server may match the verification sub-items of the verified items in the verification data with the verification sub-items of the target verification items. When the verification sub-items of the verified items match the verification sub-items of the target verification items, the server may further match the actual verification results of the verification sub-items of the verified items with the target verification results of the verification sub-items of the target verification items. Optionally, the target verification results of the verification sub-items of the target verification items are the baseline requirements. The server may count the number of verification sub-items of the verified items in which the actual verification results match the target verification results, and record the number as the second number. The server may calculate the ratio of the second number to the total number of verification sub-items of the target verification items to obtain a final compliance rate. The compliance rate may be used to indicate the proportion of items whose actual verification results are consistent with the target verification results in all items.

[0087] Specifically, the calculation formula of the server's compliance can be:

[0088] Compliance = Second quantity / Total number of items

[0089] The second number is the number of verification sub-items whose actual verification results of the verification data meet the requirements of the target verification results. When the actual verification results meet the requirements of the target verification results, it means that the project is normal and the verification has passed. Optionally, when there are multiple verifications of the verification sub-items of the same verification project, the server can obtain the actual verification result of the latest verification and match the actual verification result with the target verification result. The total number of projects is the total number of verification sub-items of the target verification project.

[0090] Optionally, the server can create a list containing elements such as project code (IP), baseline item number, and situation description. The situation description can include values ​​such as applied exceptions and other special circumstances. Each project can correspond to a project code. When there is an exception to the project code, the project is not included in the calculation scope. Within the time range, if there is data for the same object, inspection object, and baseline project, only the latest data will be used for calculation.

[0091] Step 2: Match the actual verification results of the verified items in the verification data with the target verification results of the target verification items, and count the first number of verified items whose actual verification results match the target verification results; determine the coverage rate based on the ratio of the total number of the verified items to the total number of the target verification items.

[0092] In this step, the server can match the verified items and the target verification items in the verification data. When the verified items and the target verification items match, the server can further match the actual verification results of the verified items and the target verification results of the target verification items. Optionally, the target verification results of the target verification items are the baseline requirements. The server can count the number of verified items in which the actual verification results match the target verification results, and record the number as the first number. The server can count the total number of verified items, and the server can count the total number of target verification items. The server can determine the coverage rate based on the ratio of the two totals. The calculation formula for the coverage rate can be:

[0093] Coverage rate = total number of verified items / total number of target verification items

[0094] Optionally, the server may create a list including project codes (IP), baseline item numbers, and situation descriptions. The situation descriptions may include values ​​such as exceptions applied for and other special circumstances. Each project may correspond to a project code. When there is an exception to the project code, the project is not included in the calculation scope.

[0095] S103. If the coverage rate is less than the first threshold, and / or the compliance rate is less than the second threshold, then obtain verification data that does not match the target verification item and the target verification result, and generate and send a disposal process corresponding to the compliance rate and / or coverage rate based on the mismatching verification data.

[0096] In this embodiment, a first threshold and a second threshold may be set in the server. The first threshold is used for comparison with the coverage rate. The second threshold is used for comparison with the compliance rate. If the coverage rate is less than the first threshold, and / or the compliance rate is less than the second threshold, it means that the verification data needs to be disposed of. Specifically, the server can use the actual verification results of the verified items to match the target verification results of the target verification items. The server can generate a disposal process corresponding to the compliance rate based on the verified items whose actual verification results do not match the target verification results. And, the server can generate a disposal process corresponding to the coverage rate based on the verification items in the target verification items that are not matched to the verified items.

[0097] In one example, with respect to the coverage rate, when the coverage rate is less than a first threshold, the server may perform the following operations:

[0098] Step 1: If the coverage rate corresponding to the baseline verification tool is less than the first threshold, a list of uncovered assets is generated based on the verified items and the target verification items.

[0099] In this step, the server can judge the baseline verification tools one by one. If the coverage rate corresponding to a baseline verification tool is less than the first threshold, the server can compare the verified items of the baseline verification tool with the target verification items. Optionally, the first threshold is a preset standard. The server can determine that the items other than the verified items in the target verification items are unverified items. The server can generate a list of uncovered assets based on the unverified items. Optionally, the list of uncovered assets can be dynamically generated.

[0100] Step 2: Create a new coverage improvement disposal form based on the uncovered asset list and initiate a coverage improvement disposal process. The coverage improvement disposal process includes at least one task to be verified.

[0101] In this step, the server can automatically create a new coverage improvement disposal order based on the uncovered asset list and initiate a coverage improvement disposal process. Optionally, the coverage improvement disposal process can include at least one pending verification task corresponding to the baseline verification tool. The pending verification task is used to instruct the baseline verification tool to re-execute the verification operation according to the pending verification task.

[0102] Step 3: Send the uncovered asset list and the tasks to be verified in the coverage improvement disposal process to the baseline verification tool, so that the baseline verification tool can regenerate and upload the verification data based on the tasks to be verified.

[0103] In this step, the server may send the uncovered asset list and the tasks to be verified to the baseline verification tool. Optionally, the baseline verification tool may automatically perform a supplementary verification based on the tasks to be verified.

[0104] In another example, with respect to the compliance rate, when the compliance rate is less than the second threshold, the server may perform the following operations:

[0105] Step 1: If the compliance rate is less than the second threshold, the verification sub-items of the verified project that failed the verification are determined according to the actual project results of the verification sub-items of the verified project and the target verification results of the verification sub-items of the target verification project.

[0106] In this step, the server may judge the baseline verification tools one by one. If the compliance rate corresponding to a baseline verification tool is less than the second threshold, the server may compare the actual project results of the verification sub-items of the verified items of the baseline verification tool with the target verification results of the verification sub-items of the target verification items. The server may determine that the verification sub-items in which the actual verification results do not match the target verification results are the verification sub-items of the verified items that have failed the verification.

[0107] Step 2: Generate an exception handling form based on the verification sub-items of the verified project that failed the verification, and initiate the exception handling process. The exception handling process at least includes the project name of the verification sub-item of the verified project.

[0108] In this step, the server can select a verification sub-item of a verified item that has not passed the verification, generate an exception handling form based on the verification sub-item of the verification item, and initiate an exception handling process. Optionally, since the exception handling form usually corresponds to a verification sub-item of a verification item selected by the user, the name of the verification sub-item of the verified item can be included in the exception handling process.

[0109] Step 3: Send the exception handling process to the baseline verification tool, and generate a verification data exception reminder based on the baseline verification tool and project name. The verification data exception reminder indicates that the verification result of the verification sub-item is abnormal.

[0110] In this step, the server may send the abnormal handling process to the baseline verification tool. The baseline tool may generate a verification data abnormality reminder based on the project name. Optionally, the baseline verification tool may also re-verify the verification sub-item based on the project name. Optionally, the verification data abnormality reminder is used to remind the user that the verification sub-item has an abnormality.

[0111] The security baseline verification data analysis method based on the open architecture provided in the embodiment of the present application can obtain the verification data obtained by the verification from each baseline verification tool that has been docked to the open architecture. After obtaining the verification data, the server can use the preset verification data specification format to perform structured processing on the verification data to obtain the final verification data. The server can obtain the target verification item and the target verification result from the configuration management database. The server can analyze and match the verification data after structured processing according to the target verification item and the target verification result to obtain the coverage and compliance rate of the verification data. If the coverage rate is less than the first threshold value, and / or the compliance rate is less than the second threshold value, the server can use the actual verification results of the verified items and their verification sub-items to match the target verification results of the target verification items and their verification sub-items. The server can generate a disposal process corresponding to the compliance rate according to the verification sub-items of the verified items that do not match the actual verification results and the target verification results. And, the server can generate a disposal process corresponding to the coverage rate according to the verification items that are not matched to the verified items in the target verification items. This application achieves management of verification data of baseline verification tools by calculating coverage and compliance, thereby improving the efficiency of safety verification of safety baseline equipment and reducing the manual workload of safety baseline management.

[0112] Based on the above embodiment, the server can also verify the verification logic in the baseline verification tool. The steps include:

[0113] S201. Match the actual verification results of the verified items in the verification data with the target verification results of the target verification items, and count the third number of verified items whose actual verification results all meet the target verification results, and the fourth number of verified items whose actual verification results all do not meet the target verification results.

[0114] In this embodiment, the server can perform the verification process of the verification logic on a specific server. The server can match the actual verification results of the verified items in the verification data with the target verification results of the target verification items. Among them, the target verification results of the target verification items are the baseline requirements. The server can calculate the forward parameters and reverse parameters respectively. Among them, the forward parameters are all the baseline verification items implemented that meet the baseline requirements. Among them, the reverse parameters are all the baseline verification items implemented that do not meet the baseline requirements.

[0115] Specifically, the server can obtain a third number by counting all the verified items whose actual verification results meet the target verification results. The third number is the positive parameter. The server can obtain a fourth number by counting all the verified items whose actual verification results do not meet the target verification results. The fourth number is the reverse parameter.

[0116] S202: Determine a normal rate according to a ratio of the third number to the total number of target inspection items. Determine an abnormal rate according to a ratio of the fourth number to the total number of target inspection items.

[0117] In this embodiment, the server may calculate the ratio of the third number to the total number of target verification items to obtain a normal rate. The normal rate is used to indicate the proportion of items that fully meet the baseline requirements. The server may calculate the ratio of the fourth number to the total number of target verification items to obtain an abnormal rate. The abnormal rate is used to indicate the proportion of items that do not fully meet the baseline requirements.

[0118] S203: If the normal rate is less than the third threshold and the abnormal rate is greater than the fourth threshold, a logic abnormality reminder of the baseline verification tool is generated. The logic abnormality reminder indicates that the verification logic of the baseline verification tool is abnormal.

[0119] In this embodiment, a verification threshold may be set in the server. The verification threshold may include a third threshold and a fourth threshold. If the normal rate is greater than or equal to the third threshold, and the abnormal rate is less than or equal to the fourth threshold, the server may determine that the verification logic is valid. Conversely, if the normal rate is less than the third threshold, and the abnormal rate is greater than the fourth threshold, the server may determine that there is an abnormality in the verification logic. If there is an abnormality in the verification logic, the server may treat the verified items whose actual verification results do not all meet the target verification results as misjudged items. The server performs subsequent tracking on the abnormal items.

[0120] The open architecture-based security baseline verification data analysis method provided in the embodiment of the present application determines whether the verification logic is valid by counting the third number of verified items whose actual verification results all meet the target verification results, and the fourth number of verified items whose actual verification results all do not meet the target verification results, thereby further improving the validity of the verification data.

[0121] Based on the above embodiment, the server can also implement exception registration through the security baseline verification data analysis system. The specific steps may include:

[0122] S301: Generate and initiate an exception registration process based on exception registration information. The exception registration information at least includes a baseline verification tool and a verification project name.

[0123] In this embodiment, the server can obtain the exception registration information filled in and uploaded by the user. Optionally, the exception registration information can include a baseline verification tool and a verification item name. The server can generate and initiate an exception registration process based on the exception registration information.

[0124] S302: In the configuration management database, the verification item name of the baseline verification tool is marked as an exception item. The exception item does not obtain or match verification data.

[0125] In this embodiment, the server may mark the verification item name of the baseline verification tool in the configuration management database according to the exception registration process. Alternatively, the server may mark the verification requirement corresponding to the verification item name of the baseline verification tool in the configuration management database. When the item is marked as an exception, the item will not be verified.

[0126] The open architecture-based security baseline verification data analysis method provided in the embodiment of the present application implements exception management by marking exceptions, thereby avoiding exceptional items from being verified and improving the accuracy of verification.

[0127] Figure 2 The schematic diagram of the security baseline verification data analysis system structure based on the open architecture provided for this application is Figure 1 Based on the embodiment shown, Figure 2 As shown, the safety baseline verification data analysis system can include three modules: verification data management module, verification data analysis module and process control module. The verification data management module can provide a standardized data reporting interface and a database for storing verification data. The standardized data reporting interface can obtain verification data and perform structured processing on the verification data during the docking process with the baseline verification tool. The verification data analysis module can provide functions such as verification coverage analysis, baseline compliance analysis and verification indicator display functions. The process control module can provide abnormal handling process control and exception registration process control functions.

[0128] Among them, the data reporting standardization interface in the verification data management module can formulate the standard format of the output data of different baseline verification tools. Each baseline verification tool can output its verification data as text-interval format data such as csv according to the standard format. Thereafter, each baseline verification tool can report the verification data to the platform through standardized file transfer interfaces such as FTP, HTTP, SAMBA, etc. The verification data management module can realize the centralized storage of verification data. After the verification data is centrally and structuredly stored, the verification data management module can also perform conditional query and retrieval on the stored verification data, and can support multiple conditional logic cascades (or, and, not). The verification data management module can also generate reports and data visualization views based on the retrieval results. And, the verification data management module can also collect and manage verification scripts. The verification data management module can read the verification logic script from each baseline inspection tool through the interface, and store the verification logic script in the database for centralized review.

[0129] Among them, the verification data analysis module can analyze the coverage of the verification data. The verification data analysis module can be connected to the configuration management database. The verification data analysis module can compare the verification data with the verification requirements stored in the configuration management database. The verification data analysis module can calculate the coverage of the verification data based on the comparison result. For the verification items that have applied for exceptions, the verification data analysis module will not be included in the calculation scope. The verification data analysis module can also realize baseline compliance analysis. The verification data analysis module can match the actual verification results of each verified item with the target verification results, and calculate the compliance rate based on the matching results. For the verification items that have applied for exceptions, the verification data analysis module will not be included in the calculation scope. Within the time range, if there is data for the same object, the same inspection object and the baseline project, only the latest data will be used for calculation.

[0130] The verification data analysis module can also display the verification indicators. The verification data analysis module can regularly generate a statistical summary table of the coverage and compliance indicators of each baseline verification tool. The verification data analysis module can automatically send an email to the corresponding user's mailbox. Optionally, the user can be the person in charge of each baseline verification tool. This setting allows the user to urge the baseline verification tool to complete processes such as coverage improvement and exception handling. At the same time, the verification data analysis module can also customize the coverage and compliance indicators for real-time queries, and display the results of coverage and compliance in response to the user's click on the calculation instruction. The verification data analysis module can also save the page displaying the verification indicators as the homepage and customize the displayed indicators. The verification indicators can also be displayed regularly in the background, and the current value can be displayed according to the calculation results, and the historical trend chart can be displayed according to the historical calculation results. The verification indicators are displayed.

[0131] The verification data analysis module can also verify the logic verification. The verification data analysis module can calculate the forward parameters (all meet the baseline requirements) and the reverse parameters (all do not meet the baseline requirements) according to the baseline requirements on a specific server. The verification data analysis module can output and report the result data after checking the forward parameters and reverse parameters through the baseline verification tool. For data from these specific sources, the verification data analysis module can use the forward parameters to calculate the normal rate. For the reverse parameters, the verification data analysis module can calculate the abnormal rate. The verification data analysis module can set the verification threshold in advance. If the correct rate is greater than the third threshold in the verification threshold and the abnormal rate is less than the fourth threshold in the verification threshold, the verification data analysis module can judge that the verification logic is valid, otherwise it is judged that the verification logic is invalid. At the same time, for items misjudged by the verification tool, the verification data analysis module can output the abnormal data to the process control module for subsequent rectification tracking.

[0132] Among them, the security baseline control module can be used for coverage improvement process control. For existing assets in production, if the coverage rate is lower than the preset standard, the security baseline control module can dynamically generate a list of uncovered assets, automatically create a new coverage improvement disposal order, and initiate the coverage improvement process. The security baseline control module can also automatically send the list of uncovered assets and verification tasks to the corresponding baseline verification tool, and the relevant asset operation and maintenance personnel will complete the supplementary verification and data reporting work in the verification tool until the coverage rate reaches the preset standard. The security baseline control module can transfer the disposal order to the operation and maintenance person in charge after the relevant asset operation and maintenance personnel click on the upgrade. After the operation and maintenance person in charge reviews it, he can click on the approval. The security baseline control module responds to the instruction of the approval and controls the closure of the coverage improvement disposal order. If the review fails, the operation and maintenance person in charge can click on the rollback to allow the relevant asset operation and maintenance personnel to correct the asset configuration information until the review passes. This setting can ensure that all asset information is accurate and the coverage rate meets the standard. For newly commissioned or offline systems, the server can update the asset configuration database when the commissioning or offline is completed. The security baseline management and control module can receive asset configuration library update messages, automatically initiate coverage improvement disposal orders based on asset types, complete the issuance of new system security configuration baselines, and retrieve offline system baseline verification tasks.

[0133] The security baseline control module can also control the abnormal handling process. For situations that are found to be inconsistent with the baseline requirements during the verification, the verification data analysis module can determine that it is an abnormality. The verification data analysis module can respond to the user's selection of abnormal data to be handled, and then fill in relevant information to create a new abnormal handling form. Among them, the handling process name field is a required item. The verification data analysis module can respond to the user's operation and initiate the abnormal handling process, so that the abnormal handling form will be transferred to the abnormal handling personnel specified by the user. When the relevant personnel complete the abnormal handling, the verification data analysis module can respond to the relevant personnel clicking the operation of handling completed, and transfer the abnormal handling form to the operation and maintenance person in charge related to the verification data. After the operation and maintenance person in charge reviews it, clicks on the review and passes, and the abnormal handling form is closed. The user can view the abnormal handling form in the historical abnormal handling form of the relevant personnel. If the review fails, the operation and maintenance person in charge can click back to allow the relevant personnel to handle it again until the review passes and the handling form is closed. After the relevant abnormal handling form is completed, the corresponding verification data will be marked as "normal".

[0134] The security baseline control module can also perform exception registration process control. For assets that cannot be automatically verified in the short term or whose configuration does not meet the baseline requirements but cannot be changed due to special needs, exception registration can be performed. When the verification project is registered as an exception, the verification project will not be included in the calculation scope when the baseline coverage and compliance rate are calculated later. The security baseline control module can respond to the user's selection, determine the assets to be registered for exceptions, obtain relevant information filled in by the user, and create a new exception registration form. Among them, the exception registration process name field is a required item. The security baseline control module can respond to the user's operation and initiate the exception approval process. The exception registration form will be transferred to the operation and maintenance person in charge of the asset. The operation and maintenance person in charge reviews the exception registration information. After the review is correct, the security baseline control module can respond to the operation of clicking the operation of agreeing to register the exception and register the verification project as an exception. Thereafter, the exception registration form will be transferred to the system administrator. If the review fails, the operation and maintenance person in charge can click to roll back. The user can initiate the exception registration again. The system administrator reviews the exception registration form again. If the review is correct, click to agree to register the exception, and the exception registration process ends. If the review fails, the system administrator can click Rollback, and the user can initiate the exception registration again. After the relevant exception registration form is approved, the relevant assets are added to the system exception registration list, and will not be included in the subsequent calculation of coverage and compliance rates.

[0135] Figure 3 The schematic diagram of the structure of the security baseline verification data analysis device based on the open architecture provided in this application is as follows: Figure 3 As shown, the security baseline verification data analysis device 400 provided in this embodiment includes:

[0136] The acquisition module 401 is used to acquire the verification data uploaded by each baseline verification tool that has been connected to the open architecture, and perform structured processing on the verification data according to a preset verification data standard format.

[0137] The processing module 402 is used to obtain the target verification items and target verification results uploaded by each baseline verification tool from the configuration management database, and analyze the verification data after structured processing based on the target verification items and the target verification results to obtain the coverage and compliance rate of the verification data. If the coverage rate is less than the first threshold, and / or the compliance rate is less than the second threshold, the verification data that does not match the target verification items and the target verification results is obtained, and a disposal process corresponding to the compliance rate and / or coverage rate is generated and sent according to the unmatched verification data.

[0138] Optionally, the processing module 402 is configured to:

[0139] The actual verification results of the verified items in the verification data are matched with the target verification results of the target verification items, and a first number of the verified items whose actual verification results match the target verification results is counted.

[0140] Determining the coverage rate according to the ratio of the total number of the verified items to the total number of the target verification items;

[0141] Matching the actual verification results of the verification sub-items of the verified items in the verification data with the target verification results of the verification sub-items of the target verification items, and counting a second number of the verification sub-items of the verified items whose actual verification results match the target verification results;

[0142] The compliance rate is determined according to a ratio of the second number to the total number of verification sub-items of the target verification item.

[0143] Optionally, the processing module 402 is configured to:

[0144] If the coverage rate corresponding to the baseline verification tool is less than the first threshold, a list of uncovered assets is generated based on the verified items and the target verification items.

[0145] According to the uncovered asset list, a new coverage improvement disposal sheet is created and a coverage improvement disposal process is initiated. The coverage improvement disposal process includes at least one task to be verified.

[0146] Send the uncovered asset list and the tasks to be verified in the coverage improvement disposal process to the baseline verification tool, so that the baseline verification tool can regenerate and upload the verification data based on the tasks to be verified.

[0147] Optionally, the processing module 402 is configured to:

[0148] If the compliance rate is less than a second threshold, determining the verified items that have failed the verification according to the actual project results of the verification sub-items of the verified items and the target verification results of the verification sub-items of the target verification items;

[0149] Generate an exception handling form according to the verification sub-item of the verified project that failed the verification, and initiate an exception handling process; the exception handling process at least includes the project name of the verification sub-item of the verified project;

[0150] The exception handling process is sent to the baseline verification tool, and a verification data exception reminder is generated according to the baseline verification tool and the project name; the verification data exception reminder indicates that there is an exception in the verification result of the verification sub-item.

[0151] Optionally, the processing module 402 is further configured to:

[0152] The actual verification results of the verified items in the verification data are matched with the target verification results of the target verification items, and a third number of verified items whose actual verification results all meet the target verification results and a fourth number of verified items whose actual verification results all do not meet the target verification results are counted.

[0153] The normal rate is determined according to the ratio of the third quantity to the total number of target verification items. The abnormal rate is determined according to the ratio of the fourth quantity to the total number of target verification items.

[0154] If the normal rate is less than the third threshold and the abnormal rate is greater than the fourth threshold, a logic abnormality reminder of the baseline verification tool is generated. The logic abnormality reminder indicates that the verification logic of the baseline verification tool is abnormal.

[0155] Optionally, the processing module 402 is further configured to:

[0156] Generate and initiate the exception registration process based on the exception registration information. The exception registration information at least includes the baseline verification tool and the verification project name.

[0157] In the configuration management database, the verification item name of the baseline verification tool is marked as an exception item. The verification data is not obtained or matched for the exception item.

[0158] The security baseline verification data analysis device provided in this embodiment can execute the method provided in the above method embodiment. Its implementation principle and technical effect are similar, and this embodiment will not be described in detail here.

[0159] Figure 4 This is a schematic diagram of the server structure provided for this application. Figure 4 As shown, the server 500 provided in this embodiment includes: at least one processor 501 and a memory 502. Optionally, the device 50 further includes a communication component 503. The processor 501, the memory 502 and the communication component 503 are connected via a bus 504.

[0160] In a specific implementation process, at least one processor 501 executes the computer-executable instructions stored in the memory 502, so that at least one processor 501 executes the above method.

[0161] The specific implementation process of the processor 501 can be found in the above method embodiment, and its implementation principle and technical effect are similar, so this embodiment will not be repeated here.

[0162] In the above embodiments, it should be understood that the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. The general-purpose processor may be a microprocessor or the processor may be any conventional processor, etc. The steps of the method disclosed in the invention may be directly embodied as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0163] The memory may include a high-speed memory (Random Access Memory, RAM), and may also include a non-volatile memory (Non-volatile Memory, NVM), such as at least one disk memory.

[0164] The bus may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of the present application is not limited to only one bus or one type of bus.

[0165] The present application also provides a computer program product, including a computer program, which implements the above method when executed by a processor.

[0166] The present application also provides a computer-readable storage medium, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, the above method is implemented.

[0167] The above-mentioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general or special-purpose computer.

[0168] An exemplary readable storage medium is coupled to a processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (ASIC). Of course, the processor and the readable storage medium can also exist in the device as discrete components.

[0169] The division of units is only a logical function division, and there may be other divisions in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interface, device or unit, which can be electrical, mechanical or other forms.

[0170] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0171] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0172] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods of various embodiments of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, ROM, RAM, disk or optical disk, etc., which can store program codes.

[0173] Those skilled in the art will appreciate that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed. The aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk, etc., various media that can store program codes.

[0174] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0175] Finally, it should be noted that those skilled in the art will readily conceive of other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. The present invention is intended to cover any variations, uses or adaptations of the present invention, which follow the general principles of the present invention and include common knowledge or customary technical means in the art not disclosed by the present invention, are not limited to the precise structure described above and shown in the drawings, and may be modified and changed in various ways without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.

Claims

1. A security baseline verification data analysis method based on an open architecture, characterized in that: include: Acquire the verification data uploaded by each baseline verification tool that has been connected to the open architecture, and perform structured processing on the verification data according to a preset verification data standard format; Obtaining the target verification items and target verification results uploaded by each of the baseline verification tools from the configuration management database, and analyzing the structured verification data based on the target verification items and the target verification results to obtain the coverage and compliance rate of the verification data; If the coverage rate is less than the first threshold and / or the compliance rate is less than the second threshold, the verification data that does not match the target verification item and the target verification result is obtained, and based on the mismatching verification data, the disposal process corresponding to the compliance rate and / or the coverage rate is generated and sent.

2. The method according to claim 1, characterized in that The verification data after structured processing is analyzed based on the target verification items and the target verification results to obtain the coverage rate and compliance rate of the verification data, including: Matching actual verification results of the verified items in the verification data with target verification results of the target verification items, and counting a first number of verified items whose actual verification results match the target verification results; Determining the coverage rate according to the ratio of the total number of the verified items to the total number of the target verification items; Matching the actual verification results of the verification sub-items of the verified items in the verification data with the target verification results of the verification sub-items of the target verification items, and counting a second number of the verification sub-items of the verified items whose actual verification results match the target verification results; The compliance rate is determined according to a ratio of the second number to the total number of verification sub-items of the target verification item.

3. The method according to claim 1, characterized in that: If the coverage rate is less than the first threshold, obtaining the verification data that does not match the target verification item and the target verification result, and generating and sending a disposal process corresponding to the coverage rate according to the unmatched verification data, including: If the coverage rate corresponding to the baseline verification tool is less than a first threshold, generating a list of uncovered assets according to the verified items and the target verification items; According to the uncovered asset list, a new coverage improvement disposal sheet is created, and a coverage improvement disposal process is initiated; the coverage improvement disposal process includes at least one task to be verified; The uncovered asset list and the tasks to be verified in the coverage improvement disposal process are sent to the baseline verification tool, so that the baseline verification tool regenerates and uploads verification data according to the tasks to be verified.

4. The method according to claim 1, characterized in that If the compliance rate is less than a second threshold, obtaining the verification data that does not match the target verification item and the target verification result, and generating and sending a disposal process corresponding to the compliance rate according to the unmatched verification data, including: If the compliance rate is less than a second threshold, determining the verified items that have failed the verification according to the actual project results of the verification sub-items of the verified items and the target verification results of the verification sub-items of the target verification items; Generate an exception handling form according to the verification sub-item of the verified project that failed the verification, and initiate an exception handling process; the exception handling process at least includes the project name of the verification sub-item of the verified project; The exception handling process is sent to the baseline verification tool, and a verification data exception reminder is generated according to the baseline verification tool and the project name; the verification data exception reminder indicates that there is an exception in the verification result of the verification sub-item.

5. The method according to any one of claims 1 to 4, characterized in that The method further comprises: Matching actual verification results of the verified items in the verification data with target verification results of the target verification items, and counting a third number of verified items whose actual verification results all meet the target verification results, and a fourth number of verified items whose actual verification results all do not meet the target verification results; Determine the normal rate according to the ratio of the third number to the total number of the target verification items; determine the abnormal rate according to the ratio of the fourth number to the total number of the target verification items; If the normal rate is less than the third threshold and the abnormal rate is greater than the fourth threshold, a logic abnormality reminder of the baseline verification tool is generated; the logic abnormality reminder indicates that there is an abnormality in the verification logic of the baseline verification tool.

6. The method according to claims 1-4, characterized in that: The method further comprises: Generate and initiate an exception registration process based on the exception registration information; the exception registration information at least includes a baseline verification tool and a verification project name; In the configuration management database, the name of the verification item of the baseline verification tool is marked as an exception item; the verification data is not acquired or matched for the exception item.

7. A security baseline verification data analysis device based on an open architecture, characterized in that: include: An acquisition module, used to acquire the verification data uploaded by each baseline verification tool that has been connected to the open architecture, and perform structured processing on the verification data according to a preset verification data specification format; A processing module is used to obtain the target verification items and target verification results uploaded by each of the baseline verification tools from the configuration management database, and analyze the verification data after structured processing based on the target verification items and the target verification results to obtain the compliance rate and coverage rate of the verification data; if the compliance rate and / or the coverage rate do not match the first threshold, the verification data that does not match the target verification items and the target verification results is obtained, and based on the mismatching verification data, a disposal process corresponding to the compliance rate and / or the coverage rate is generated and sent.

8. A server, characterized in that: include: Memory, processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory, so that the processor performs the method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 6 when executed by a processor.

10. A computer program product, characterized in that The invention comprises a computer program, which implements the method according to any one of claims 1 to 6 when being executed by a processor.

Images