Method, system and device for monitoring network information security vulnerabilities and storage medium

Abstract

The invention relates to the technical field of network information security vulnerability monitoring, and discloses a network information security vulnerability monitoring method, system and device and a storage medium, and the method comprises the steps: obtaining network information security data; performing initialization processing on the network information security data to obtain a preprocessed data sequence; performing autocorrelation calculation on the preprocessed data sequence to obtain an autocorrelation sequence; performing cross-correlation calculation on the self-correlation sequence to obtain a cross-correlation sequence; screening out a suspicious parameter interval according to the self-correlation sequence and the cross-correlation sequence, and determining a suspected information leakage sequence; calculating based on the self-correlation sequence, the cross-correlation sequence and the suspected information leakage sequence to obtain the leakage probability of the sensitive data; and according to the leakage probability of the sensitive data, analyzing the security of the data information to obtain a corresponding security report. According to the method, the accuracy and efficiency of information monitoring can be improved, and the security and integrity of network data transmission are guaranteed.

Description

Technical Field

[0001] The present invention relates to the technical field of monitoring network information security loopholes, and in particular to a monitoring method, system, device and storage medium for network information security loopholes. Background Art

[0002] With the rapid development of network technology and the increasing popularity of informatization, network information security issues have become increasingly prominent. Information leakage, data tampering, and unauthorized access security issues have brought great risks to network communications, user privacy, and the transmission of sensitive information. In order to ensure the security of network information, especially in the process of large-scale data transmission and storage, it is necessary to monitor and analyze potential network security vulnerabilities in real time to discover and repair these security issues as early as possible.

[0003] In one prior art, Chinese patent publication number CN108443516B proposes a trusted cloud platform monitoring method based on security risk assessment. The method constructs and initializes a cloud platform monitoring model based on security risk assessment, collects cloud platform resource usage information, and performs security risk assessment. Its core steps include optimizing the cloud platform monitoring model parameters using the gray wolf optimization algorithm, and constructing a security risk assessment function to monitor and warn potential risks in real time.

[0004] Although this technology can effectively reduce the computational complexity of the monitoring model and improve the accuracy and comprehensiveness of risk assessment, there is still data redundancy in the data acquisition process in actual applications, lack of intelligent analysis of suspicious data, inability to accurately judge the security performance of the data, and lack of intelligent matching of historical data with current data, which can easily lead to security vulnerabilities. Summary of the invention

[0005] The present invention provides a method, system, device and storage medium for monitoring network information security vulnerabilities to solve the problem that in practical applications, there is a lack of multi-level security screening technology in the data acquisition process, which makes it impossible to effectively screen out potential information leakage data and leads to poor monitoring results.

[0006] In a first aspect, in order to solve the above technical problems, the present invention provides a method, system, device and storage medium for monitoring network information security vulnerabilities, including:

[0007] Acquire network information security data, including network communication data, user behavior data, system log data, sensitive information transmission data and historical data;

[0008] Initializing the network information security data to obtain a preprocessed data sequence;

[0009] Performing autocorrelation calculation on the preprocessed data sequence, calculating the autocorrelation coefficient corresponding to each lag time, and arranging all the autocorrelation coefficients to obtain an autocorrelation sequence corresponding to the preprocessed data sequence;

[0010] Performing cross-correlation calculation on the autocorrelation sequence, calculating the cross-correlation coefficient corresponding to each lag time, and arranging all the cross-correlation coefficients to obtain a cross-correlation sequence corresponding to the pre-processed data sequence;

[0011] Screening out a suspicious parameter interval according to the autocorrelation sequence and the cross-correlation sequence, and determining a suspected information leakage sequence according to the suspicious parameter interval;

[0012] Calculating based on the autocorrelation sequence, the cross-correlation sequence, and the suspected information leakage sequence to obtain a leakage probability of sensitive data;

[0013] According to the leakage probability of the sensitive data, the security of the data information is analyzed to obtain a corresponding security report.

[0014] Preferably, performing autocorrelation calculation on the preprocessed data sequence, calculating the autocorrelation coefficient corresponding to each lag time, and arranging all the autocorrelation coefficients to obtain an autocorrelation sequence corresponding to the preprocessed data sequence, comprises:

[0015] The autocorrelation coefficient is calculated by the following formula:

[0016]

[0017] Where R(τ) is the autocorrelation coefficient, τ=1,2,...,n is the lag time, and x i is the i-th feature data, x i+τ It represents the data value of the current index i in the x sequence, which is lagged by τ time points. μ is the expected value, and n 0 is the starting value of the data, N is the total number of feature points, and i is the coordinate value of the feature data point;

[0018] The autocorrelation coefficients corresponding to different lag times are arranged in sequence to form an autocorrelation sequence.

[0019] Preferably, performing cross-correlation calculation on the autocorrelation sequence, calculating the cross-correlation coefficient corresponding to each lag time, and arranging all the cross-correlation coefficients to obtain a cross-correlation sequence corresponding to the pre-processed data sequence, comprises:

[0020] The mutual correlation coefficient is calculated by the following formula:

[0021]

[0022] Where C(τ) is the cross-correlation coefficient, τ = 1, 2, ..., n is the lag time, and x i is the ith characteristic data value of the x sequence, y i is the ith data value of the y sequence, μ x is the expected value of the sequence x, y i+τ It represents the data value of the y series at the time point lag τ relative to the current index i, μ y is the expected value of the sequence y, n 0 is the starting value of the data, N is the total number of feature points, and i is the coordinate value of the feature data point;

[0023] The cross-correlation coefficients corresponding to different lag times are arranged in sequence to form a cross-correlation sequence.

[0024] Preferably, screening out a suspicious parameter interval according to the autocorrelation sequence and the cross-correlation sequence, and determining a suspected information leakage sequence according to the suspicious parameter interval includes:

[0025] According to the density distribution of the autocorrelation sequence and the cross-correlation sequence, abnormal density analysis is performed to obtain the autocorrelation coefficient and the cross-correlation coefficient at each moment;

[0026] According to the autocorrelation coefficient and the cross-correlation coefficient, an interval threshold is set, and a suspicious parameter interval that meets the interval threshold is determined;

[0027] According to the suspicious parameter interval, data analysis is performed to obtain a suspected information leakage sequence.

[0028] Preferably, the leakage probability of sensitive data is obtained by calculating based on the autocorrelation sequence, the cross-correlation sequence and the suspected information leakage sequence, including:

[0029] Calculating the autocorrelation eigenvalue and the cross-correlation eigenvalue according to the autocorrelation sequence and the cross-correlation sequence;

[0030] Extracting a leakage feature value from the suspected information leakage sequence according to the autocorrelation feature value and the cross-correlation feature value;

[0031] Obtaining a sensitive data leakage probability according to the autocorrelation coefficient, the mutual correlation coefficient and the leakage characteristic value;

[0032] The leakage probability of sensitive data is calculated by the following formula:

[0033]

[0034] Among them, C is the leakage probability of sensitive data, R(τ) is the autocorrelation coefficient, C(τ) is the mutual correlation coefficient, L is the characteristic value of the suspected information leakage sequence, N is the total number of feature points, α, β, γ are weight coefficients, and δ is a constant.

[0035] Preferably, the security of the data information is analyzed according to the leakage probability of the sensitive data to obtain a corresponding security report, including:

[0036] When the leakage probability of the sensitive data is higher than a set leakage probability threshold, the vulnerability type is identified, and a security report including a repair plan is generated according to the vulnerability type;

[0037] When the leakage probability of the sensitive data is higher than a set threat level assessment threshold, the threat level is assessed and a security report including a threat level report is generated.

[0038] Preferably, when the leakage probability of the sensitive data is higher than a set leakage probability threshold, the vulnerability type is identified, and a security report including a repair solution is generated according to the vulnerability type, including:

[0039] Obtaining a preliminary vulnerability type according to the sensitive data leakage probability and the mapping relationship between the preset vulnerability characteristics and the probability range;

[0040] Comparing the preliminary vulnerability type with known vulnerability types in a database to obtain a determined vulnerability type;

[0041] According to the determined vulnerability type, a corresponding repair solution is generated from a repair solution library;

[0042] The output includes a data leakage security report including the identified vulnerability type and a repair solution.

[0043] In a second aspect, the present invention provides a network information security vulnerability monitoring system, comprising:

[0044] A data acquisition module is used to acquire network information security data, which includes network communication data, user behavior data, system log data, sensitive information transmission data and historical data;

[0045] An initialization processing module, used to perform initialization processing on the network information security data to obtain a preprocessed data sequence;

[0046] An autocorrelation calculation module, used to perform autocorrelation calculation on the preprocessed data sequence, calculate the autocorrelation coefficient corresponding to each lag time, and obtain an autocorrelation sequence corresponding to the preprocessed data sequence according to the arrangement of all the autocorrelation coefficients;

[0047] A cross-correlation calculation module, used for performing cross-correlation calculation on the autocorrelation sequence, calculating the cross-correlation coefficient corresponding to each lag time, and obtaining a cross-correlation sequence corresponding to the pre-processed data sequence according to the arrangement of all the cross-correlation coefficients;

[0048] A screening module, used to screen out suspicious parameter intervals according to the autocorrelation sequence and the cross-correlation sequence, and determine a suspected information leakage sequence according to the suspicious parameter interval;

[0049] A leakage probability calculation module, used to calculate based on the autocorrelation sequence, the cross-correlation sequence and the suspected information leakage sequence to obtain a leakage probability of sensitive data;

[0050] The result output module is used to analyze the security of data information according to the leakage probability of the sensitive data and obtain a corresponding security report.

[0051] In a third aspect, the present invention further provides an electronic device comprising a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor implements any one of the above-mentioned methods for monitoring network information security vulnerabilities when executing the computer program.

[0052] In a fourth aspect, the present invention further provides a computer-readable storage medium, which includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute any one of the above-mentioned methods for monitoring network information security vulnerabilities.

[0053] Compared with the prior art, the present invention has the following beneficial effects:

[0054] In the present invention, the method can collect and monitor comprehensive data by acquiring multi-dimensional network information security data including network communication data, user behavior data, system log data, sensitive information transmission data and historical data. The data is then initialized to form a preprocessed data sequence. By performing autocorrelation calculations and cross-correlation calculations on these data sequences, autocorrelation sequences and cross-correlation sequences are generated. Then, the autocorrelation and cross-correlation sequences are screened by density distribution analysis, the suspicious parameter interval is determined, and the suspected information leakage sequence is finally identified. Based on these analysis results, the method of the present invention can calculate the probability of sensitive data leakage and generate a report reflecting data security. When the leakage probability reaches the set threshold, the vulnerability type can be automatically identified, and a detailed security report including a repair plan can be generated. In summary, the beneficial effect of the present invention is that it can improve the accuracy and efficiency of information monitoring, quickly respond to potential security risks, and ensure the security and integrity of network data transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Figure 1 It is a flowchart of a method for monitoring network information security vulnerabilities provided by the first embodiment of the present invention;

[0056] Figure 2 It is a schematic diagram of the structure of a method for monitoring network information security vulnerabilities provided by the second embodiment of the present invention. DETAILED DESCRIPTION

[0057] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0058] Reference Figure 1 The first embodiment of the present invention provides a method for monitoring network information security vulnerabilities, comprising the following steps:

[0059] S11, obtaining network information security data, wherein the network information security data includes network communication data, user behavior data, system log data, sensitive information transmission data and historical data.

[0060] S12, performing initialization processing on the network information security data to obtain a preprocessed data sequence.

[0061] S13, performing autocorrelation calculation on the preprocessed data sequence, calculating the autocorrelation coefficient corresponding to each lag time, and arranging all the autocorrelation coefficients to obtain an autocorrelation sequence corresponding to the preprocessed data sequence.

[0062] S14, performing cross-correlation calculation on the autocorrelation sequence, calculating the cross-correlation coefficient corresponding to each lag time, and arranging all the cross-correlation coefficients to obtain a cross-correlation sequence corresponding to the pre-processed data sequence.

[0063] S15, screening out suspicious parameter intervals according to the autocorrelation sequence and the cross-correlation sequence, and determining a suspected information leakage sequence according to the suspicious parameter intervals.

[0064] S16, performing calculation based on the autocorrelation sequence, the cross-correlation sequence and the suspected information leakage sequence to obtain a leakage probability of sensitive data.

[0065] S17, analyzing the security of the data information according to the leakage probability of the sensitive data, and obtaining a corresponding security report.

[0066] It is worth noting that network information security refers to protecting the security of network systems and the information stored, processed and transmitted to prevent unauthorized access, use, modification, disclosure, destruction, deletion or interception of information. Its goal is to ensure the confidentiality, integrity and availability of information.

[0067] In order to facilitate the understanding of the present invention, some preferred embodiments of the present invention are further described below.

[0068] In step S11, network information security data is obtained.

[0069] Preferably, the network information security data includes network communication data, user behavior data, system log data, sensitive information transmission data and historical data.

[0070] It is worth noting that network communication data refers to all information data transmitted in the network system, including but not limited to data packets, protocol messages, requests and responses. It mainly involves the communication process and data transmission between networks, and can be used to analyze network traffic and identify potential attacks or abnormal behaviors. User behavior data describes the user's operation activities in the system, such as login information, page access records, click behavior, input data and other interactive operations. These data can be used to analyze user behavior patterns and detect abnormal operations or unauthorized access behaviors. System log data includes various log records generated by the system, such as operating system logs, application logs, error logs, and security audit logs. These logs record the system operation status, user activities, error reports and other system events in detail, and are an important data source for locating and analyzing network security issues. Sensitive information transmission data refers to data flows involving confidential or sensitive information, such as personal identity information, financial data, passwords, and encryption keys. These data transmitted in network communications are targets of potential information leakage, so special attention needs to be paid to their transmission and access. Historical data refers to relevant data records collected and stored in the past, which are used for comparative analysis with current data. For example, historical data can help identify abnormal behaviors, trend changes, or potential threat patterns in current network activities. Through the accumulation and analysis of historical data, risks can be assessed more accurately and preventive measures can be taken.

[0071] Optionally, network communication data can be obtained using network packet capture tools, such as Wireshark, tcpdump, etc., which can capture network communication data packets in real time and analyze them. Network device logs, such as routers, firewalls and other network devices, will record network traffic logs. Configuring and accessing these devices can also obtain network communication related data.

[0072] Optionally, user behavior data can be obtained through application logs, which can be obtained by collecting application user interaction logs and recording user operation behaviors, such as clicks, inputs, etc. At the same time, using a dedicated user behavior analysis (UBA) tool can also record the user's access to the system, application or page.

[0073] Optionally, operating systems (such as Windows and Linux) generate system logs, including security logs, event logs, etc., which can be accessed and managed through built-in log management tools such as Windows' event viewer or Linux's syslog service. Applications also generate log files, which can be obtained from the log directory. In order to centrally manage and analyze log data, log management tools such as ELK Stack or SIEM tools can be used to achieve comprehensive monitoring and real-time analysis of multi-source log data.

[0074] Optionally, sensitive data scanning tools can be used to classify and identify data in the system and monitor the storage and transmission of sensitive information. Network packet analysis tools (such as packet capture tools) can identify sensitive information during data transmission to ensure that it complies with established security policies. Through data access control systems, access and transmission logs of sensitive information can be recorded to help monitor and analyze potential risks.

[0075] Optionally, historical data can be read from the stored database records to discover potential risks by comparing and analyzing the change trends. Using the log storage system, historical logs can be archived and managed, and can be quickly retrieved and compared and analyzed through centralized management tools. Backup files are also a source of historical data and can be used for data recovery, tracing historical operations, and analyzing system status changes.

[0076] In step S12, the network information security data is initialized to obtain a preprocessed data sequence.

[0077] Specifically, the process of initializing the network information security data needs to include the following specific steps: data cleaning, first cleaning the network communication data, user behavior data, system log data, sensitive information transmission data and historical data, and removing redundant, incomplete, invalid or erroneous data entries. The purpose of this step is to improve the quality of the data so that it is more accurate and representative in subsequent calculations and analysis; data conversion, converting raw data in different formats into a unified format. For example, converting the timestamp in the log file to a standard time format, and converting text data to structured data for deeper calculations and analysis; missing value filling, in the initialization process, identifying missing values ​​or null values ​​in the data, and filling them according to certain strategies, interpolation methods, mean filling and other strategies can be used to ensure the integrity and continuity of the data; outlier processing, detecting and processing outliers or abnormal values ​​in the data, for abnormal data that may have a significant impact on the analysis results, you can choose to remove or use appropriate methods for alternative processing, so as to ensure the accuracy and stability of data analysis; data smoothing transformation, smoothing transformation of the data sequence, removing the noise therein, retaining the main trends and features. This step helps to reduce data volatility and improve the analysis of data trends. Through the above initialization processing steps, a clean, unified, complete, and non-abnormal interference pre-processed data sequence is finally obtained, which provides a good data foundation for subsequent analysis operations such as autocorrelation calculation and cross-correlation calculation.

[0078] Optionally, when the data is converted into a sequence, it is first arranged in time or event order, and then divided into two main sequences, namely, the x sequence and the y sequence. These sequences represent data streams of specific dimensions or features. In the process of forming the x sequence and the y sequence, they are sorted and classified according to specific feature values ​​to ensure that the data has logical consistency and traceability. Afterwards, these sequences are normalized or standardized for subsequent analysis. In the present invention, autocorrelation and cross-correlation calculations are used to reveal their time correlation and mutual correlation.

[0079] In step S13, autocorrelation calculation is performed on the preprocessed data sequence, the autocorrelation coefficient corresponding to each lag time is calculated, and an autocorrelation sequence corresponding to the preprocessed data sequence is obtained by arranging all the autocorrelation coefficients.

[0080] Preferably, the performing of autocorrelation calculation on the preprocessed data sequence, calculating the autocorrelation coefficient corresponding to each lag time, and obtaining an autocorrelation sequence corresponding to the preprocessed data sequence according to the arrangement of all the autocorrelation coefficients, comprises:

[0081] The autocorrelation coefficient is calculated by the following formula:

[0082]

[0083] Where R(τ) is the autocorrelation coefficient, τ=1,2,...,n is the lag time, and x i is the i-th feature data, x i+τ It represents the data value of the current index i in the x sequence, which is lagged by τ time points. μ is the expected value, and n 0 is the starting value of the data, N is the total number of feature points, and i is the coordinate value of the feature data point;

[0084] The autocorrelation coefficients corresponding to different lag times are arranged in sequence to form an autocorrelation sequence.

[0085] Autocorrelation calculation forms an autocorrelation sequence by comparing each data point with its corresponding point at lag time and calculating the autocorrelation coefficients of different lag times in sequence. This process represents the repetitive and periodic changes of data at different time steps, helping to identify the laws and trends of the data. By arranging these autocorrelation coefficients, the intrinsic characteristics of the data can be analyzed and provide a basis for subsequent processing.

[0086] Specifically, R(τ) is the result of the autocorrelation calculation, which indicates the correlation of the data series itself at different lag times. By calculating the autocorrelation coefficients at different lag times, the repeatability and trend changes of the data over time can be determined. A high autocorrelation coefficient indicates that the data has a strong correlation over the lag time. τ=1,2,...,n is the lag time, which refers to the offset of the data in time. The lag time is used to indicate the time span of the displacement of the data series relative to itself. For example, τ=1 indicates a comparison with the previous data point, while τ=2 indicates a comparison with the data point two time steps ago. The autocorrelation coefficients at different lag times can reflect the degree of correlation of the data over time. i is the i-th feature data, which is a specific data point in the sequence. It indicates the position of the data in the time series. The correlation between each data point is calculated by comparing it with its lagged time point. μ is the expected value, which is the average value of the data and represents the central tendency of the data set. In the autocorrelation calculation, the expected value is subtracted from each data point to remove the influence of the average value, so as to better measure the actual changes and correlations between the data. N is the total number of feature points, which indicates the total length of the data sequence or the total number of data points. It is used in the calculation to standardize the correlation calculation so that the results are consistent and comparable.

[0087] It is worth noting that the formation of an autocorrelation sequence based on the arrangement of the autocorrelation coefficients corresponding to different lag times means that the autocorrelation coefficients calculated for each lag time are arranged in sequence, starting from τ = 0, and arranged in sequence according to the order of lag time until the preset maximum lag value. This forms a sequence of autocorrelation coefficients, namely the "autocorrelation sequence". By looking at the autocorrelation sequence, you can intuitively observe the change in the correlation of the data sequence at different time lags. A high autocorrelation value indicates that the data has strong repeatability or periodicity at the corresponding lag time, while a low autocorrelation value indicates a weak correlation.

[0088] In step S14, cross-correlation calculation is performed on the autocorrelation sequence, the cross-correlation coefficient corresponding to each lag time is calculated, and the cross-correlation sequence corresponding to the pre-processed data sequence is obtained according to the arrangement of all the cross-correlation coefficients.

[0089] Preferably, performing cross-correlation calculation on the autocorrelation sequence, calculating the cross-correlation coefficient corresponding to each lag time, and arranging all the cross-correlation coefficients to obtain a cross-correlation sequence corresponding to the pre-processed data sequence includes:

[0090] The mutual correlation coefficient is calculated by the following formula:

[0091]

[0092] Where C(τ) is the cross-correlation coefficient, τ = 1, 2, ..., n is the lag time, and x i is the ith characteristic data value of the x sequence, y i is the i-th data value of the y sequence, y i+τ It represents the data value of the y series at the time point lag τ relative to the current index i, μ x is the expected value of the sequence x, μ y is the expected value of the sequence y, n 0 is the starting value of the data, N is the total number of feature points, and i is the coordinate value of the feature data point;

[0093] The cross-correlation coefficients corresponding to different lag times are arranged in sequence to form a cross-correlation sequence.

[0094] Specifically, the formula reveals the correlation between two data series at different time offsets by calculating the cross-correlation coefficients at different lag times. Then all the calculated cross-correlation coefficients are arranged in the order of lag time to form a cross-correlation sequence, which helps to analyze the relationship between the two series.

[0095] Specifically, the cross-correlation coefficient reflects the correlation between two series at different time offsets and is usually used to analyze the synchronization, similarity or causal relationship between them. A high cross-correlation coefficient indicates that the two series are highly correlated at a certain lag time and there is a mutual influence of time offset. The lag time represents the offset between the x series and the y series. By changing the value of τ, the correlation between the two series at different time steps can be observed, thereby analyzing their time dependence and potential causal relationship. i is the ith characteristic data value of the x sequence, y i is the i-th data value of the y sequence, y i+τ It represents the data value of the y series at the time point lagged by τ relative to the current index i, and is used to calculate the correlation between the data points at each lagged time point. Each data point is calculated with the corresponding point of the lagged time to determine the correlation at different time offsets. x is the expected value of the sequence x, μ y is the expected value of the sequence y. In the calculation, it is used to remove the central trend of the data, so as to more accurately reflect the correlation between the data without being affected by the mean of the data itself. The removal of the mean helps to identify the actual change pattern of the data. N is the total number of feature points, which is used to standardize the calculation results so that the cross-correlation coefficient is consistent under different sequence lengths. The standardization process helps to analyze the comparability of correlations under different lag times. Through the coordinated calculation of the above parameters, the cross-correlation coefficient measures the similarity or correlation between the x sequence and the y sequence at different lag times. The cross-correlation coefficients of all lag times are arranged in sequence to form a cross-correlation sequence, which helps to analyze the correlation characteristics between the two data sequences over time.

[0096] It is worth noting that the formation of a cross-correlation sequence based on the arrangement of the cross-correlation coefficients corresponding to different lag times means that the cross-correlation coefficients calculated at all different lag times are arranged in the order of the lag time, starting from τ=0, to form a cross-correlation coefficient sequence. This cross-correlation sequence describes the correlation relationship between the x-sequence and the y-sequence at different time offsets. After arranging all the cross-correlation coefficients calculated above in the order of the lag time, a complete cross-correlation sequence is formed. This sequence is used to analyze the changes in the strength of the correlation between two data sequences at different time points, and to help identify the correlation and potential causal relationship between the data.

[0097] In step S15, a suspicious parameter interval is screened out according to the autocorrelation sequence and the cross-correlation sequence, and a suspected information leakage sequence is determined according to the suspicious parameter interval.

[0098] Preferably, screening out a suspicious parameter interval according to the autocorrelation sequence and the cross-correlation sequence, and determining a suspected information leakage sequence according to the suspicious parameter interval includes:

[0099] According to the density distribution of the autocorrelation sequence and the cross-correlation sequence, abnormal density analysis is performed to obtain the autocorrelation coefficient and the cross-correlation coefficient at each moment;

[0100] According to the autocorrelation coefficient and the cross-correlation coefficient, an interval threshold is set, and a suspicious parameter interval that meets the interval threshold is determined;

[0101] According to the suspicious parameter interval, data analysis is performed to obtain a suspected information leakage sequence.

[0102] Specifically, anomaly density analysis is to estimate the distribution of autocorrelation coefficients and cross-correlation coefficients at different time points to identify anomalies in the data. Optionally, density estimation methods such as kernel density estimation (KDE) can be used to draw probability density curves of the data and find areas with lower density, which can represent abnormal data points. By analyzing the distribution of data density, it is possible to determine which points deviate significantly from the majority of the data, which correspond to potential information leaks or abnormal events. Anomaly density analysis helps identify features in the data sequence that are rare or significantly deviate from other data points.

[0103] Specifically, after completing the abnormal density analysis, it is necessary to set an interval threshold to screen out suspicious parameter intervals. Optionally, the interval threshold can be determined by statistical analysis, such as selecting points with a density lower than a preset percentile as abnormal points. The purpose of setting the threshold is to screen out the abnormal parts of the autocorrelation coefficient and the cross-correlation coefficient to further determine the potential risks or leakage points in the data. Reasonable setting of the interval threshold can ensure that the screened data is representative and valuable for analysis.

[0104] Specifically, once the suspicious parameter interval is determined, further data analysis is required to confirm whether there is an actual risk of information leakage. Data analysis can include: comparing the autocorrelation and cross-correlation change patterns within the suspicious parameter interval and analyzing their differences from normal data. Use regression analysis or time series analysis to evaluate the impact of abnormal data on the overall data. Classify or cluster the suspicious data to identify potential abnormal patterns or information leakage trends. By conducting in-depth analysis of the screened suspicious parameters, it is possible to determine whether there is a real security threat and help generate more targeted repair solutions or security strategies. This step is an important part of converting data screening results into actual security measures and risk prevention and control recommendations.

[0105] It is worth noting that after the density analysis of autocorrelation and cross-correlation and the interval threshold screening, a set of suspicious parameter intervals are obtained. These intervals correspond to the range of autocorrelation and cross-correlation values ​​at specific time points, indicating that the data in these time periods show abnormalities or potential risks. In each suspicious parameter interval, identify the specific data points associated with the interval. In other words, all data points that meet the conditions in these intervals are extracted from the original data sequence or the preprocessed data sequence. These data points are continuous in time and are also discrete data points selected based on certain characteristics. The data points extracted from the suspicious parameter interval are arranged in the order of time or event occurrence to form a new data sequence. This sequence retains the time or logical order of the data, so that it can better reflect its changing trends and patterns. The sorted data point set is used as a new sequence, called the suspected information leakage sequence. This sequence contains all data points that meet the conditions of the suspicious parameter interval and can be further used for risk analysis and confirmation of data leakage.

[0106] In step S16, a calculation is performed based on the autocorrelation sequence, the cross-correlation sequence and the suspected information leakage sequence to obtain a leakage probability of sensitive data.

[0107] The step of calculating based on the autocorrelation sequence, the cross-correlation sequence, and the suspected information leakage sequence to obtain the leakage probability of sensitive data includes:

[0108] Calculating the autocorrelation eigenvalue and the cross-correlation eigenvalue according to the autocorrelation sequence and the cross-correlation sequence;

[0109] Extracting a leakage feature value from the suspected information leakage sequence according to the autocorrelation feature value and the cross-correlation feature value;

[0110] Obtaining a sensitive data leakage probability according to the autocorrelation coefficient, the mutual correlation coefficient and the leakage characteristic value;

[0111] The leakage probability of sensitive data is calculated by the following formula:

[0112]

[0113] Among them, C is the leakage probability of sensitive data, R(τ) is the autocorrelation coefficient, C(τ) is the cross-correlation coefficient, L is the leakage eigenvalue, N is the total number of feature points, α, β, γ are weight coefficients, and δ is a constant.

[0114] Specifically, the autocorrelation eigenvalues ​​are derived from the analysis of the autocorrelation sequence. First, an autocorrelation analysis is performed on a data sequence to calculate the autocorrelation coefficients at different lag times, which constitute the autocorrelation sequence. Optionally, the extraction of autocorrelation eigenvalues ​​involves selecting and analyzing representative or significant points from the autocorrelation sequence. For example, the maximum value (indicating a strong correlation of the data at the lag time), the minimum value (indicating a weak correlation or an inverse relationship), the average value, etc. of the autocorrelation coefficient can be extracted. These eigenvalues ​​reflect the autocorrelation characteristics of the sequence at different lag times and are used to describe the inherent regularity and repeatability of the sequence over time.

[0115] Specifically, the cross-correlation eigenvalue is obtained by analyzing the mutual relationship between two different sequences. In cross-correlation analysis, the similarity or correlation of two sequences is measured by calculating the cross-correlation coefficients at different lag times, and these cross-correlation coefficients constitute the cross-correlation sequence. When extracting eigenvalues ​​from the cross-correlation sequence, the maximum value at a specific lag time and its corresponding lag time point are focused on, which indicates that the two sequences have the strongest correlation at this lag time. Optionally, features such as the average cross-correlation coefficient and standard deviation can also be focused on to describe the overall relationship changes between the two sequences at different time offsets.

[0116] In the present invention, the autocorrelation eigenvalue reflects the correlation of a sequence at different times, and is extracted by analyzing the variation pattern and characteristic points of the autocorrelation coefficient. The cross-correlation eigenvalue reflects the correlation between two sequences at different time offsets, and is obtained by analyzing the variation trend and significant points of the cross-correlation coefficient.

[0117] Specifically, the normal pattern or characteristics of the data are determined by analyzing the obtained autocorrelation eigenvalues ​​and cross-correlation eigenvalues. These eigenvalues ​​describe the correlation characteristics of the data in time and with other sequences, and are the basis for judging anomalies and abnormal patterns. The suspected information leakage sequence is compared with the above eigenvalues. Specifically, the data in the suspected information leakage sequence is compared with the autocorrelation and cross-correlation eigenvalues ​​to analyze whether they deviate significantly from the normal pattern. The more obvious the deviation of the data point, the more it indicates that there is a leakage risk. In the suspected information leakage sequence, those eigenvalues ​​that are significantly different from the autocorrelation eigenvalues ​​and cross-correlation eigenvalues ​​are extracted. These features include extreme values, peak positions, change rates, etc. According to the specific degree of deviation, the eigenvalues ​​that are more representative of leakage can be further screened and determined. For example, if a certain feature point shows obvious anomalies in the autocorrelation and cross-correlation analysis, such as an abnormally high cross-correlation coefficient or a mutation point of the autocorrelation coefficient, it can be marked as a leakage feature value.

[0118] Specifically, C is the probability of leakage of sensitive data, which is the calculated probability value of sensitive data leakage. It reflects the possibility of data leakage under specific conditions. R(τ) is the autocorrelation coefficient, which is the autocorrelation coefficient calculated at the lag time τ, reflecting the correlation of the data series itself at different time points. C(τ) is the cross-correlation coefficient, which is the cross-correlation coefficient of two data series at the lag time, reflecting the similarity or degree of association between them. L is the leakage feature value, which is the feature value extracted from the suspected information leakage sequence and is used to represent specific features related to data leakage. The leakage feature value directly reflects the leakage pattern or feature, and by combining the analysis of autocorrelation and cross-correlation, it helps to more accurately identify the existence of leakage risks. α, β, and γ are weight coefficients, which are weight coefficients for the degree of influence of the autocorrelation coefficient, cross-correlation coefficient, and leakage feature value. They are mainly used to balance the importance of each parameter in the calculation. The setting of different weight coefficients can reflect the sensitivity of data leakage under different conditions. For example, the weight can be adjusted according to actual needs to increase the importance of certain features.

[0119] In step S17, the security of the data information is analyzed according to the leakage probability of the sensitive data to obtain a corresponding security report.

[0120] Preferably, the security of the data information is analyzed according to the leakage probability of the sensitive data to obtain a corresponding security report, including:

[0121] When the leakage probability of the sensitive data is higher than a set leakage probability threshold, the vulnerability type is identified, and a security report including a repair plan is generated according to the vulnerability type;

[0122] When the leakage probability of the sensitive data is higher than a set threat level assessment threshold, the threat level is assessed and a security report including a threat level report is generated.

[0123] Preferably, when the leakage probability of the sensitive data is higher than a set leakage probability threshold, the vulnerability type is identified, and a security report including a repair solution is generated according to the vulnerability type, including:

[0124] Obtaining a preliminary vulnerability type according to the sensitive data leakage probability and the mapping relationship between the preset vulnerability characteristics and the probability range;

[0125] Comparing the preliminary vulnerability type with known vulnerability types in a database to obtain a determined vulnerability type;

[0126] According to the determined vulnerability type, a corresponding repair solution is generated from a repair solution library;

[0127] The output includes a data leakage security report including the identified vulnerability type and a repair solution.

[0128] Specifically, when the probability of leakage of sensitive data is higher than the set leakage probability threshold, the system identifies a specific vulnerability type and generates a security report including a repair plan based on the vulnerability type. This part involves real-time judgment of the calculation results and subsequent action suggestions to help users quickly identify and resolve potential security issues. When the leakage probability is higher than the set threat level assessment threshold, the system further assesses the severity of the threat and generates a security report including a threat assessment report. This report helps users understand and quantify the possible impact of data leakage so that more targeted protective measures can be taken.

[0129] Specifically, when the probability of sensitive data leakage is higher than the set leakage probability threshold, the system will perform the following operations: identify the preliminary vulnerability type, the system will preliminarily determine the possible vulnerability type based on the leakage probability and the mapping relationship between the preset vulnerability characteristics and the probability range; compare the known vulnerability database, compare the identified preliminary vulnerability type with the known vulnerability types in the database, and confirm the specific vulnerability type; generate a repair plan, the system will retrieve the repair plan corresponding to the vulnerability type from the repair plan library, and generate a complete security report including the vulnerability type and repair plan. This can help users effectively respond to confirmed security threats and improve the security and protection capabilities of the system.

[0130] Optionally, the known vulnerability types in the database may include common vulnerability types such as SQL injection, cross-site scripting (XSS), cross-site request forgery (CSRF), buffer overflow, etc. These known vulnerability types can be used to compare the potential risks detected by the system, help determine the specific security threat type and formulate corresponding repair plans for it.

[0131] The following describes the working process of the present invention by taking a relatively common scenario as an example. The working process is as follows:

[0132] Assume that there is a large amount of sensitive data transmission in a network system, and potential information leakage risks need to be monitored. First, the system will obtain various types of data, including network communication data (such as data packets, protocol messages), user behavior data (such as login records, operation records), system log data (such as error logs, security audit logs), sensitive information transmission data (such as personal identity information, financial data) and historical data. After the initial collection of these data, they are cleaned, format converted, missing value filled, outlier processing and other steps to obtain a preprocessed data sequence.

[0133] Next, the system performs autocorrelation analysis on the preprocessed data sequence, calculates the autocorrelation coefficients at different lag times, and generates an autocorrelation sequence. Subsequently, the autocorrelation sequence is cross-correlated, the cross-correlation coefficients at different lag times are calculated, and a cross-correlation sequence is formed. Based on the density distribution of the autocorrelation and cross-correlation sequences, the system screens out suspicious parameter intervals through abnormal density analysis and set interval thresholds. By further analyzing these suspicious parameter intervals, the system can determine the suspected information leakage sequence.

[0134] In the next step, the system extracts the leakage eigenvalues ​​based on the autocorrelation eigenvalues, cross-correlation eigenvalues ​​and suspected information leakage sequences, and calculates the leakage probability of sensitive data in combination with the weight coefficient and other parameters. If the probability is higher than the set threshold, the system will identify the vulnerability type and generate a security report including a repair plan. The entire process aims to monitor network security in real time, identify and respond to potential information leakage risks, and improve the security and protection capabilities of the system.

[0135] In summary, the present invention provides a monitoring method for network information security vulnerabilities, including: acquiring network information security data, the network information security data including network communication data, user behavior data, system log data, sensitive information transmission data and historical data; initializing the network information security data to obtain a preprocessed data sequence; performing autocorrelation calculation on the preprocessed data sequence, calculating the autocorrelation coefficient corresponding to each lag time, and arranging all the autocorrelation coefficients to obtain an autocorrelation sequence corresponding to the preprocessed data sequence; performing cross-correlation calculation on the autocorrelation sequence, calculating the cross-correlation coefficient corresponding to each lag time, and arranging all the cross-correlation coefficients to obtain a cross-correlation sequence corresponding to the preprocessed data sequence; screening out suspicious parameter intervals according to the autocorrelation sequence and the cross-correlation sequence, and determining a suspected information leakage sequence according to the suspicious parameter interval; performing calculation based on the autocorrelation sequence, the cross-correlation sequence and the suspected information leakage sequence to obtain a leakage probability of sensitive data; analyzing the security of data information according to the leakage probability of sensitive data to obtain a corresponding security report.

[0136] In the present invention, the method can collect and monitor comprehensive data by acquiring multi-dimensional network information security data including network communication data, user behavior data, system log data, sensitive information transmission data and historical data. The data is then initialized to form a preprocessed data sequence. By performing autocorrelation calculations and cross-correlation calculations on these data sequences, autocorrelation sequences and cross-correlation sequences are generated. Then, the autocorrelation and cross-correlation sequences are screened by density distribution analysis, the suspicious parameter interval is determined, and the suspected information leakage sequence is finally identified. Based on these analysis results, the method of the present invention can calculate the probability of sensitive data leakage and generate a report reflecting data security. When the leakage probability reaches the set threshold, the vulnerability type can be automatically identified, and a detailed security report including a repair plan can be generated. In summary, the beneficial effect of the present invention is that it can improve the accuracy and efficiency of information monitoring, quickly respond to potential security risks, and ensure the security and integrity of network data transmission.

[0137] Reference Figure 2 The second embodiment of the present invention provides a network information security vulnerability monitoring system, including:

[0138] A data acquisition module is used to acquire network information security data, which includes network communication data, user behavior data, system log data, sensitive information transmission data and historical data;

[0139] An initialization processing module, used to perform initialization processing on the network information security data to obtain a preprocessed data sequence;

[0140] An autocorrelation calculation module, used to perform autocorrelation calculation on the preprocessed data sequence, calculate the autocorrelation coefficient corresponding to each lag time, and obtain an autocorrelation sequence corresponding to the preprocessed data sequence according to the arrangement of all the autocorrelation coefficients;

[0141] A cross-correlation calculation module, used for performing cross-correlation calculation on the autocorrelation sequence, calculating the cross-correlation coefficient corresponding to each lag time, and obtaining a cross-correlation sequence corresponding to the pre-processed data sequence according to the arrangement of all the cross-correlation coefficients;

[0142] A screening module, used to screen out suspicious parameter intervals according to the autocorrelation sequence and the cross-correlation sequence, and determine a suspected information leakage sequence according to the suspicious parameter interval;

[0143] A leakage probability calculation module, used to calculate based on the autocorrelation sequence, the cross-correlation sequence and the suspected information leakage sequence to obtain a leakage probability of sensitive data;

[0144] The result output module is used to analyze the security of data information according to the leakage probability of the sensitive data and obtain a corresponding security report.

[0145] In an optional implementation, the autocorrelation calculation module is specifically used to:

[0146] The autocorrelation coefficient is calculated by the following formula:

[0147]

[0148] Where R(τ) is the autocorrelation coefficient, τ=1,2,...,n is the lag time, and x i is the i-th feature data, x i+τ It represents the data value of the current index i in the x sequence, which is lagged by τ time points. μ is the expected value, and n 0 is the starting value of the data, N is the total number of feature points, and i is the coordinate value of the feature data point;

[0149] The autocorrelation coefficients corresponding to different lag times are arranged in sequence to form an autocorrelation sequence.

[0150] In an optional implementation, the cross-correlation calculation module is specifically used to:

[0151] The mutual correlation coefficient is calculated by the following formula:

[0152]

[0153] Where C(τ) is the cross-correlation coefficient, τ = 1, 2, ..., n is the lag time, and x i is the ith characteristic data value of the x sequence, y i is the i-th data value of the y sequence, y i+τ It represents the data value of the y series at the time point lag τ relative to the current index i, μ x is the expected value of the sequence x, μ y is the expected value of the sequence y, n 0 is the starting value of the data, N is the total number of feature points, and i is the coordinate value of the feature data point;

[0154] The cross-correlation coefficients corresponding to different lag times are arranged in sequence to form a cross-correlation sequence.

[0155] In an optional implementation, the screening module is specifically used for:

[0156] According to the density distribution of the autocorrelation sequence and the cross-correlation sequence, abnormal density analysis is performed to obtain the autocorrelation coefficient and the cross-correlation coefficient at each moment;

[0157] According to the autocorrelation coefficient and the cross-correlation coefficient, an interval threshold is set, and a suspicious parameter interval that meets the interval threshold is determined;

[0158] According to the suspicious parameter interval, data analysis is performed to obtain a suspected information leakage sequence.

[0159] In an optional implementation manner, the leakage probability calculation module is specifically used to:

[0160] Calculating the autocorrelation eigenvalue and the cross-correlation eigenvalue according to the autocorrelation sequence and the cross-correlation sequence;

[0161] Extracting a leakage feature value from the suspected information leakage sequence according to the autocorrelation feature value and the cross-correlation feature value;

[0162] Obtaining a sensitive data leakage probability according to the autocorrelation coefficient, the mutual correlation coefficient and the leakage characteristic value;

[0163] The leakage probability of sensitive data is calculated by the following formula:

[0164]

[0165] Among them, C is the leakage probability of sensitive data, R(τ) is the autocorrelation coefficient, C(τ) is the cross-correlation coefficient, L is the leakage eigenvalue, N is the total number of feature points, α, β, γ are weight coefficients, and δ is a constant.

[0166] In an optional implementation, the result output module is specifically used to:

[0167] When the leakage probability of the sensitive data is higher than a set leakage probability threshold, the vulnerability type is identified, and a security report including a repair plan is generated according to the vulnerability type;

[0168] When the leakage probability of the sensitive data is higher than a set threat level assessment threshold, the threat level is assessed and a security report including a threat level report is generated.

[0169] It should be noted that the network information security vulnerability monitoring system provided in the embodiment of the present invention is used to execute all the process steps of the network information security vulnerability monitoring method of the above embodiment. The working principles and beneficial effects of the two correspond one to one, and thus will not be described in detail.

[0170] The embodiment of the present invention further provides an electronic device. The electronic device includes: a processor, a memory, and a computer program stored in the memory and executable on the processor, such as a program for monitoring a network information security vulnerability. When the processor executes the computer program, the steps in the above-mentioned embodiments of the method for monitoring a network information security vulnerability are implemented, such as Figure 1Alternatively, when the processor executes the computer program, the functions of the modules / units in the above-mentioned device embodiments are realized, such as the result output module.

[0171] Exemplarily, the computer program may be divided into one or more modules / units, which are stored in the memory and executed by the processor to implement the present invention. The one or more modules / units may be a series of computer program instruction segments capable of implementing specific functions, which are used to describe the execution process of the computer program in the electronic device.

[0172] The electronic device may be a computing device such as a desktop computer, a notebook, a PDA, and a smart tablet. The electronic device may include, but is not limited to, a processor and a memory. Those skilled in the art will appreciate that the above components are merely examples of electronic devices and do not constitute a limitation on the electronic device. The electronic device may include more or fewer components than the above components, or may combine certain components, or different components. For example, the electronic device may also include input and output devices, network access devices, buses, etc.

[0173] The processor may be a central processing unit (CPU), other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc. The processor is the control center of the electronic device, and uses various interfaces and lines to connect various parts of the entire electronic device.

[0174] The memory can be used to store the computer program and / or module, and the processor realizes various functions of the electronic device by running or executing the computer program and / or module stored in the memory, and calling the data stored in the memory. The memory can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area can store data created according to the use of the mobile phone (such as audio data, a phone book, etc.), etc. In addition, the memory can include a high-speed random access memory, and can also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0175] Wherein, if the module / unit integrated in the electronic device is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on such an understanding, the present invention implements all or part of the processes in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. Wherein, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, U disk, mobile hard disk, disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electric carrier signal, telecommunication signal and software distribution medium. It should be noted that the content contained in the computer-readable medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electric carrier signals and telecommunication signals.

[0176] It should be noted that the device embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. In addition, in the accompanying drawings of the device embodiments provided by the present invention, the connection relationship between the modules indicates that there is a communication connection between them, which may be specifically implemented as one or more communication buses or signal lines. A person of ordinary skill in the art may understand and implement it without paying any creative effort.

[0177] The specific embodiments described above further illustrate the purpose, technical solutions and beneficial effects of the present invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. It is particularly pointed out that for those skilled in the art, any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for monitoring network information security vulnerabilities, characterized in that: Executed by a computer, including: Acquire network information security data, including network communication data, user behavior data, system log data, sensitive information transmission data and historical data; Initializing the network information security data to obtain a preprocessed data sequence; Performing autocorrelation calculation on the preprocessed data sequence, calculating the autocorrelation coefficient corresponding to each lag time, and arranging all the autocorrelation coefficients to obtain an autocorrelation sequence corresponding to the preprocessed data sequence; Performing cross-correlation calculation on the autocorrelation sequence, calculating the cross-correlation coefficient corresponding to each lag time, and arranging all the cross-correlation coefficients to obtain a cross-correlation sequence corresponding to the pre-processed data sequence; Screening out a suspicious parameter interval according to the autocorrelation sequence and the cross-correlation sequence, and determining a suspected information leakage sequence according to the suspicious parameter interval; Calculating based on the autocorrelation sequence, the cross-correlation sequence, and the suspected information leakage sequence to obtain a leakage probability of sensitive data; According to the leakage probability of the sensitive data, the security of the data information is analyzed to obtain a corresponding security report.

2. The method for monitoring network information security vulnerabilities according to claim 1, characterized in that: The step of performing autocorrelation calculation on the preprocessed data sequence, calculating the autocorrelation coefficient corresponding to each lag time, and arranging all the autocorrelation coefficients to obtain an autocorrelation sequence corresponding to the preprocessed data sequence includes: The autocorrelation coefficient is calculated by the following formula: Where R(τ) is the autocorrelation coefficient, τ=1,2,...,n is the lag time, and x i is the i-th feature data, x i+τ It represents the data value at τ time points lagging behind the current index i in the x sequence, μ is the expected value, n0 is the number of starting points of the data, N is the total number of feature points, and i is the coordinate value of the feature data point; The autocorrelation coefficients corresponding to different lag times are arranged in sequence to form an autocorrelation sequence.

3. The method for monitoring network information security vulnerabilities according to claim 1, characterized in that: The cross-correlation calculation is performed on the autocorrelation sequence, the cross-correlation coefficient corresponding to each lag time is calculated, and the cross-correlation sequence corresponding to the pre-processed data sequence is obtained according to the arrangement of all the cross-correlation coefficients, including: The mutual correlation coefficient is calculated by the following formula: Where C(τ) is the cross-correlation coefficient, τ = 1, 2, ..., n is the lag time, and x i is the ith characteristic data value of the x sequence, y i is the i-th data value of the y sequence, y i+τ It represents the data value of the y series at the time point lag τ relative to the current index i, μ x is the expected value of the sequence x, μ y is the expected value of the sequence y, n0 is the starting value of the data, N is the total number of feature points, and i is the coordinate value of the feature data point; The cross-correlation coefficients corresponding to different lag times are arranged in sequence to form a cross-correlation sequence.

4. The method for monitoring network information security vulnerabilities according to claim 1, characterized in that: The screening out a suspicious parameter interval according to the autocorrelation sequence and the cross-correlation sequence, and determining a suspected information leakage sequence according to the suspicious parameter interval, includes: According to the density distribution of the autocorrelation sequence and the cross-correlation sequence, abnormal density analysis is performed to obtain the autocorrelation coefficient and the cross-correlation coefficient at each moment; According to the autocorrelation coefficient and the cross-correlation coefficient, an interval threshold is set, and a suspicious parameter interval that meets the interval threshold is determined; According to the suspicious parameter interval, data analysis is performed to obtain a suspected information leakage sequence.

5. The method for monitoring network information security vulnerabilities according to claim 1, characterized in that: The step of calculating based on the autocorrelation sequence, the cross-correlation sequence, and the suspected information leakage sequence to obtain the leakage probability of sensitive data includes: Calculating the autocorrelation eigenvalue and the cross-correlation eigenvalue according to the autocorrelation sequence and the cross-correlation sequence; Extracting a leakage feature value from the suspected information leakage sequence according to the autocorrelation feature value and the cross-correlation feature value; Obtaining a sensitive data leakage probability according to the autocorrelation coefficient, the mutual correlation coefficient and the leakage characteristic value; The leakage probability of sensitive data is calculated by the following formula: Among them, C is the leakage probability of sensitive data, R(τ) is the autocorrelation coefficient, C(τ) is the cross-correlation coefficient, L is the leakage eigenvalue, N is the total number of feature points, α, β, γ are weight coefficients, and δ is a constant.

6. The method for monitoring network information security vulnerabilities according to claim 5, characterized in that: The security of the data information is analyzed according to the leakage probability of the sensitive data to obtain a corresponding security report, including: When the leakage probability of the sensitive data is higher than a set leakage probability threshold, the vulnerability type is identified, and a security report including a repair plan is generated according to the vulnerability type; When the leakage probability of the sensitive data is higher than a set threat level assessment threshold, the threat level is assessed and a security report including a threat level report is generated.

7. The method for monitoring network information security vulnerabilities according to claim 6, characterized in that: When the leakage probability of the sensitive data is higher than the set leakage probability threshold, the vulnerability type is identified, and a security report including a repair solution is generated according to the vulnerability type, including: Obtaining a preliminary vulnerability type according to the sensitive data leakage probability and the mapping relationship between the preset vulnerability characteristics and the probability range; Comparing the preliminary vulnerability type with known vulnerability types in a database to obtain a determined vulnerability type; According to the determined vulnerability type, a corresponding repair solution is generated from a repair solution library; The output includes a data leakage security report including the identified vulnerability type and a repair solution.

8. A network information security vulnerability monitoring system, characterized in that: include: A data acquisition module is used to acquire network information security data, which includes network communication data, user behavior data, system log data, sensitive information transmission data and historical data; An initialization processing module, used to perform initialization processing on the network information security data to obtain a preprocessed data sequence; An autocorrelation calculation module, used to perform autocorrelation calculation on the preprocessed data sequence, calculate the autocorrelation coefficient corresponding to each lag time, and obtain an autocorrelation sequence corresponding to the preprocessed data sequence according to the arrangement of all the autocorrelation coefficients; A cross-correlation calculation module, used for performing cross-correlation calculation on the autocorrelation sequence, calculating the cross-correlation coefficient corresponding to each lag time, and obtaining a cross-correlation sequence corresponding to the pre-processed data sequence according to the arrangement of all the cross-correlation coefficients; A screening module, used to screen out suspicious parameter intervals according to the autocorrelation sequence and the cross-correlation sequence, and determine a suspected information leakage sequence according to the suspicious parameter interval; A leakage probability calculation module, used to calculate based on the autocorrelation sequence, the cross-correlation sequence and the suspected information leakage sequence to obtain a leakage probability of sensitive data; The result output module is used to analyze the security of data information according to the leakage probability of the sensitive data and obtain a corresponding security report.

9. An electronic device, characterized in that: The method comprises a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein when the processor executes the computer program, the method for monitoring network information security vulnerabilities as described in any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute the method for monitoring network information security vulnerabilities as described in any one of claims 1 to 7.

Images