Security demand analysis method and device, electronic equipment, medium and program product

Abstract

The invention provides a security demand analysis method based on a block chain. The method can be applied to the technical field of block chains and the technical field of artificial intelligence. The method comprises the steps of obtaining business demand data, inputting the preprocessed business demand data into a security demand identification model based on deep learning and natural language processing training, and generating a security demand identification result; calling a pre-constructed security evaluation tool, monitoring the operation state of the target system in real time by the security evaluation tool based on the security demand identification result, and generating a security demand analysis result; and converting the business demand data, the security demand identification result and the security demand analysis result into a metadata structure, and recording the metadata structure into a block chain according to a time sequence.

Description

Technical Field

[0001] The present disclosure relates to the fields of blockchain technology and artificial intelligence, and more specifically to a blockchain-based security requirements analysis method, device, equipment, medium, and program product. Background Art

[0002] With the continuous development of software development and system design, the identification and management of security requirements play a vital role in ensuring system functions and data security. However, in the existing business requirements analysis and design phase, the identification and management of security requirements are still obviously insufficient. Traditional methods usually focus on the realization of business functions, while the identification of security factors mostly relies on the personal security experience of application architects, lacking systematic and intelligent support.

[0003] At present, some existing technologies have studied solutions for security factor identification based on big data. However, existing solutions often rely on a single evaluation model, cannot fully cover security needs in diverse and complex scenarios, and lack dynamic adaptive capabilities. Summary of the invention

[0004] In view of the above problems, the present disclosure provides a security requirements analysis method, apparatus, device, medium and program product based on blockchain.

[0005] According to the first aspect of the present disclosure, a blockchain-based security requirement analysis method is provided, including: obtaining business requirement data, inputting the pre-processed business requirement data into a security requirement identification model trained based on deep learning and natural language processing, and generating a security requirement identification result; calling a pre-built security assessment tool, the security assessment tool monitors the operating status of the target system in real time based on the security requirement identification result, and generates a security requirement analysis result; and converting the business requirement data, the security requirement identification result, and the security requirement analysis result into a metadata structure, and recording them in chronological order in the blockchain.

[0006] According to an embodiment of the present disclosure, after generating the security requirement identification result, the method further includes: calling a security expert knowledge base, performing data association and data supplementation on the security requirement identification result, and generating a supplemented security requirement identification result, wherein the security expert knowledge base is constructed with a knowledge graph based on security rule practice information.

[0007] According to an embodiment of the present disclosure, the security expert knowledge base is constructed with a knowledge graph based on security rule practice information, specifically including: collecting multi-source data related to the security rule practice information, including security rule data, risk assessment information and historical security data; organizing and classifying the multi-source data, and constructing the security expert knowledge base based on the knowledge graph; and reacquiring the experience and knowledge of the security expert at a first time interval, and verifying the consistency and validity to obtain updated content, and updating the security expert knowledge base based on the updated content.

[0008] According to an embodiment of the present disclosure, the security assessment tool includes a core algorithm module and a security requirement analysis module. The construction method of the security assessment tool specifically includes: collecting multi-dimensional assessment data, including system operation data, historical security assessment data and security requirement rule information; based on the multi-dimensional assessment data, developing a core algorithm module including anomaly detection and risk assessment functions; integrating the core algorithm module with a real-time monitoring interface for business processes to obtain abnormal behavior.

[0009] According to an embodiment of the present disclosure, the security assessment tool monitors the operating status of the target system in real time based on the security requirement identification result and generates a security requirement analysis result, which specifically includes: using a predefined anomaly detection algorithm to perform real-time analysis on the target system operating data to identify abnormal behavior; correlating and comparing the identified abnormal behavior with the security requirement identification result to generate a security requirement analysis result.

[0010] According to an embodiment of the present disclosure, the method also includes: obtaining business demand update data at a second time interval; and dynamically adjusting the parameters of the security demand identification model using an adaptive learning algorithm based on the optimized security demand identification results and the business demand update data.

[0011] According to an embodiment of the present disclosure, the business requirement data, the security requirement identification result and the security requirement analysis result are converted into a metadata structure and recorded in a blockchain in chronological order, specifically including: generating a unique hash value for the business requirement data, the security requirement identification result and the security requirement analysis result, and constructing a corresponding timestamp and data pointer to form a metadata structure; verifying the integrity and authenticity of the metadata structure using a consensus mechanism of a blockchain network; and storing the verified metadata structure in a distributed ledger of the blockchain in chronological order.

[0012] According to an embodiment of the present disclosure, the method further includes: storing sensitive business demand data in an off-chain database in an encrypted form, and recording a summary of the encrypted data in the blockchain to establish an on-chain and off-chain association.

[0013] According to an embodiment of the present disclosure, the method also includes: encrypting the business demand data, the security demand identification result and the security demand analysis result, and storing the encrypted data in the blockchain; and managing the access rights of different users to the blockchain data through an access control list.

[0014] The second aspect of the present disclosure provides a security requirement analysis device based on blockchain, including: a security requirement identification result generation module, which is used to: obtain business requirement data, input the pre-processed business requirement data into a security requirement identification model based on deep learning and natural language processing training, and generate a security requirement identification result; a security requirement analysis result generation module, which is used to: call a pre-built security assessment tool, and the security assessment tool monitors the operating status of the target system in real time based on the security requirement identification result, and generates a security requirement analysis result; and a recording module, which is used to: convert the business requirement data, the security requirement identification result and the security requirement analysis result into a hash value and a metadata structure, and record them in chronological order in the blockchain.

[0015] According to an embodiment of the present disclosure, the security requirement identification result generation module can also be used to call the security expert knowledge base, perform data association and data supplement on the security requirement identification result, and generate a supplemented security requirement identification result, wherein the security expert knowledge base is constructed with a knowledge graph based on security rule practice information.

[0016] According to an embodiment of the present disclosure, the security requirement identification result generation module can also be used to obtain business requirement update data at a second time interval; and based on the optimized security requirement identification results and the business requirement update data, dynamically adjust the parameters of the security requirement identification model using an adaptive learning algorithm.

[0017] According to an embodiment of the present disclosure, the security requirement analysis result generation module may include a security assessment tool construction module, and the security assessment tool construction module may include an assessment data collection unit, a core algorithm module development unit and an integration unit.

[0018] According to an embodiment of the present disclosure, the evaluation data collection unit may collect multi-dimensional evaluation data, including system operation data, historical security evaluation data, and security requirement rule information.

[0019] According to an embodiment of the present disclosure, the core algorithm module development unit may be used to develop a core algorithm module including an anomaly detection function and a risk assessment function based on the multi-dimensional evaluation data.

[0020] According to an embodiment of the present disclosure, the integration unit may be used to integrate the core algorithm module with a real-time monitoring interface for a business process to obtain abnormal behavior.

[0021] According to an embodiment of the present disclosure, the security requirement analysis result generation module can also be used to use a predefined anomaly detection algorithm to perform real-time analysis on the target system operation data to identify abnormal behavior; and to correlate and compare the identified abnormal behavior with the security requirement identification results to generate a security requirement analysis result.

[0022] According to an embodiment of the present disclosure, the recording module may include a metadata structure unit, a verification unit, and a storage unit.

[0023] According to an embodiment of the present disclosure, the metadata structure unit can be used to generate a unique hash value for the business requirement data, the security requirement identification result and the security requirement analysis result, and construct corresponding timestamps and data pointers to form a metadata structure.

[0024] According to an embodiment of the present disclosure, the verification unit can be used to verify the integrity and authenticity of the metadata structure using the consensus mechanism of the blockchain network.

[0025] According to an embodiment of the present disclosure, the storage unit may be used to store the verified metadata structure in a distributed ledger of the blockchain in chronological order.

[0026] According to an embodiment of the present disclosure, the recording module can also be used to store sensitive business demand data in an off-chain database in an encrypted form, and record a summary of the encrypted data in the blockchain to establish an on-chain and off-chain association.

[0027] According to an embodiment of the present disclosure, the recording module can also be used to encrypt the business demand data, the security demand identification results and the security demand analysis results, and store the encrypted data in the blockchain; and manage the access rights of different users to the blockchain data through an access control list.

[0028] A third aspect of the present disclosure provides an electronic device, comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the above method.

[0029] The fourth aspect of the present disclosure further provides a computer-readable storage medium having a computer program or instructions stored thereon, which implements the steps of the above method when the above computer program or instructions are executed by a processor.

[0030] The fifth aspect of the present disclosure further provides a computer program product, including a computer program or instructions, which implement the steps of the above method when the above computer program or instructions are executed by a processor.

[0031] According to the embodiments of the present disclosure, by combining deep learning models, real-time monitoring security assessment tools and blockchain technology, it is possible to optimize the security requirements identification and analysis process, achieve high efficiency in data storage and verification, thereby reducing resource consumption and improving computing efficiency; at the same time, through automated security requirements analysis methods, it is possible to reduce manual participation and potential errors, thereby improving user trust and satisfaction with security processing. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] The above contents and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0033] Figure 1 The application scenario diagram of the blockchain-based security requirements analysis method, device, equipment, medium and program product according to the embodiment of the present disclosure is schematically shown;

[0034] Figure 2 A flowchart of a security requirement analysis method based on blockchain according to an embodiment of the present disclosure is schematically shown;

[0035] Figure 3 A flowchart schematically illustrates a method for constructing a security assessment tool according to an embodiment of the present disclosure;

[0036] Figure 4 A flowchart of a method for recording data to a blockchain according to an embodiment of the present disclosure is schematically shown;

[0037] Figure 5 The structure block diagram of the security requirement analysis device based on blockchain according to an embodiment of the present disclosure is schematically shown; and

[0038] Figure 6 A block diagram of an electronic device suitable for implementing a blockchain-based security requirements analysis method according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0039] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0040] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0041] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0042] When using expressions such as "at least one of A, B, and C, etc.", they should generally be interpreted according to the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0043] First, the technical terms described in this article are explained and described as follows.

[0044] Security requirement identification refers to identifying and determining the security requirements that the system needs to meet during software development and system design to ensure the security and compliance of the system.

[0045] Knowledge graph refers to a knowledge representation method that represents entities and their relationships through the structure of nodes and edges, and is used to build a security expert knowledge base.

[0046] An adaptive learning algorithm refers to a machine learning algorithm that can automatically adjust its parameters and models according to changes in input data to improve the accuracy of recognition and prediction.

[0047] Blockchain technology refers to a distributed ledger technology that ensures the transparency and immutability of data through cryptography and consensus algorithms, and is often used to record and verify process information.

[0048] Security requirements identification and management play a vital role in software development and system design. However, the current business requirements analysis and design phase usually focuses on the realization of business functions, and the identification of security factors mainly depends on the personal security experience of application architects. The traditional security requirements analysis method usually includes the following steps: collecting business requirements of users and business parties through demand surveys and interviews; security experts analyze the collected requirements and identify potential security requirements; based on the identified security requirements, the system is evaluated for security and further identifies potential security risks; finally, a detailed security requirements document is written to provide a reference for subsequent development and testing.

[0049] Although this method has been widely used, it still has obvious limitations and shortcomings. First, the existing technology mainly relies on manual analysis and the experience of security experts, which is prone to omissions and inaccurate evaluations, resulting in the inability to fully identify potential security needs. Secondly, the manual analysis process is time-consuming, difficult to meet the rapidly developing business needs, and has low efficiency. In addition, due to reliance on personal experience, the identification accuracy of security needs is low, which easily leads to security vulnerabilities in the system. Finally, the existing technology lacks adaptive capabilities and is difficult to dynamically respond to changes in business needs and security threats, limiting its application in complex and rapidly changing environments.

[0050] At present, some technical solutions attempt to use big data to identify and manage security factors. For example, by building a specific evaluation model, combined with debugging node collection and feature expansion, security requirements are analyzed and evaluated. These solutions have improved the efficiency and coverage of security requirement identification to a certain extent. However, existing solutions rely on a single evaluation model, which makes it difficult to fully cover security requirements in diverse and complex scenarios; at the same time, its static evaluation method lacks dynamic adaptive capabilities and cannot respond to rapidly changing business needs and security threats in a timely manner. In addition, existing technologies generally lack intelligent means such as deep learning and natural language processing, which limits the accuracy and flexibility of recognition in complex environments.

[0051] Based on this, an embodiment of the present disclosure provides a security requirement analysis method based on blockchain, the method comprising: obtaining business requirement data, inputting the pre-processed business requirement data into a security requirement identification model based on deep learning and natural language processing training, and generating a security requirement identification result; calling a pre-built security assessment tool, the security assessment tool monitors the operating status of the target system in real time based on the security requirement identification result, and generates a security requirement analysis result; and converting the business requirement data, the security requirement identification result, and the security requirement analysis result into a metadata structure, and recording them in a chronological order in the blockchain. The security requirement analysis method based on blockchain provided by the present disclosure can optimize the security requirement identification and analysis process by combining a deep learning model, a real-time monitoring security assessment tool, and blockchain technology, and achieve high efficiency in data storage and verification, thereby reducing resource consumption and improving computing efficiency; at the same time, through an automated security requirement analysis method, it can reduce manual participation and potential errors, and improve users' trust and satisfaction with security processing.

[0052] It should be noted that the blockchain-based security requirements analysis method, device, equipment, medium and program product determined in this disclosure can be used in the fields of blockchain technology and artificial intelligence technology, and can also be used in various fields other than the fields of blockchain technology and artificial intelligence technology. The application fields of the blockchain-based security requirements analysis method, device, equipment, medium and program product provided in the embodiments of this disclosure are not limited.

[0053] In the technical solution of the present disclosure, the user information (including but not limited to user personal information, user image information, user device information, such as location information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved are all information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with relevant laws, regulations and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0054] In the scenario of using personal information for automated decision-making, the methods, devices, and systems provided by the embodiments of the present disclosure provide users with corresponding operation portals for users to choose to agree or reject the automated decision-making results; if the user chooses to reject, the expert decision-making process will be entered. The expression "automated decision-making" here refers to the activity of automatically analyzing and evaluating a person's behavioral habits, interests and hobbies, or economic, health, credit status, etc. through computer programs, and making decisions. The expression "expert decision-making" here refers to the activity of making decisions by people who specialize in a certain field, have specialized experience, knowledge and skills, and have reached a certain level of professionalism.

[0055] Figure 1 The application scenario diagram of the blockchain-based security requirements analysis method, apparatus, device, medium and program product according to an embodiment of the present disclosure is schematically shown.

[0056] like Figure 1 As shown, the application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 is used to provide a medium for a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired, wireless communication links, or optical fiber cables, etc.

[0057] The user can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 through the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only for example).

[0058] The first terminal device 101, the second terminal device 102, and the third terminal device 103 may be various electronic devices having display screens and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.

[0059] The server 105 may be a server that provides various services, such as a background management server (only as an example) that provides support for websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103. The background management server may analyze and process the received data such as user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal device.

[0060] It should be noted that the security requirement analysis method based on blockchain provided in the embodiment of the present disclosure can generally be executed by the server 105. Accordingly, the security requirement analysis device based on blockchain provided in the embodiment of the present disclosure can generally be set in the server 105. The security requirement analysis method based on blockchain provided in the embodiment of the present disclosure can also be executed by a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105. Correspondingly, the security requirement analysis device based on blockchain provided in the embodiment of the present disclosure can also be set in a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105.

[0061] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0062] The following will be based on Figure 1 The scene described by Figure 2 to Figure 4 The blockchain-based security requirements analysis method of the disclosed embodiment is described in detail.

[0063] Figure 2The flowchart of the blockchain-based security requirements analysis method according to an embodiment of the present disclosure is schematically shown.

[0064] like Figure 2 As shown, the blockchain-based security requirements analysis method of this embodiment includes operations S210 to S230, and the transaction processing method can be executed by server 105.

[0065] In operation S210, business requirement data is acquired, and the pre-processed business requirement data is input into a security requirement identification model based on deep learning and natural language processing training to generate a security requirement identification result.

[0066] In the process of software development and system design, business requirement data is an important basis for ensuring system functionality and security. Business requirement data covers detailed descriptions of system functions, performance, security and other related requirements by users and business parties. Its accuracy and comprehensiveness directly affect the rationality of system design and the quality of the final product.

[0067] Specifically, business requirement data can be obtained in the following ways: collecting comprehensive business requirement information through in-depth communication with users and business parties; collecting existing functional specifications, security assessment reports, project management records and other documents; using development and test data from past projects to extract valuable business requirement information and security vulnerability cases.

[0068] According to the embodiments of the present disclosure, after the business demand data is acquired, it needs to be pre-processed to convert it into a format suitable for further analysis and processing. Specifically, data cleaning can be performed, for example: deleting irrelevant or duplicate information to ensure that the data set contains only useful business demand content; unifying the data format, correcting format errors, and ensuring data consistency and readability; identifying and removing redundant data to reduce the complexity and resource consumption of data processing. Further, data conversion can be performed, for example: applying word segmentation, part-of-speech tagging, named entity recognition, etc. to convert unstructured text data into a structured vector representation; unifying the scale and format of different data sources to ensure the consistency of data before entering the model; extracting key features from the business demand description so that the model can more effectively identify and analyze security requirements.

[0069] In an embodiment of the present disclosure, the security requirement identification model is an intelligent model that combines deep learning technology and natural language processing technology (NLP) to automatically identify and analyze security requirements in software development or system design. Specifically, after inputting the pre-processed business requirement data, the security requirement identification model uses NLP technology to pre-process and semantically analyze the text data, such as word segmentation, part-of-speech tagging, dependency syntax parsing, etc., to convert the original text into an input format that the model can process (such as word vector); the deep learning model automatically learns the security features and deep semantic analysis in the business requirement text of the input data to capture long-distance dependencies and hidden relationships. Through the training parameters and predefined rules of the model, the security requirement identification model can automatically generate security requirement outputs related to business requirements, such as identifying specific security requirements such as data encryption, access control, and permission management. The output security requirement identification results can include specific security rules, potential threat types and their corresponding solution suggestions to provide support for subsequent security assessments.

[0070] According to the embodiments of the present disclosure, the security requirement identification model, through the combination of deep learning and NLP, can be used for data processing and basic semantic understanding based on NLP and for complex pattern recognition based on deep learning. The collaborative work of the two enables the security requirement identification model to automatically generate security requirement outputs related to business needs efficiently and accurately, thereby reducing manual intervention and improving the security and adaptability of the system.

[0071] Furthermore, after the security requirement identification model is used to generate the security requirement identification result, the method provided by the embodiment of the present disclosure also includes: calling the security expert knowledge base, performing data association and data supplementation on the security requirement identification result, and generating a supplemented security requirement identification result. The security expert knowledge base is constructed by a knowledge graph based on security rule practice information, so that the security requirement identification model can further optimize the security requirement identification result in combination with expert knowledge in the security field, thereby improving the comprehensiveness and accuracy of security requirement identification.

[0072] The security expert knowledge base is based on the knowledge graph based on security rule practice information. The construction method can specifically include the following steps:

[0073] 1) Collect multi-source data related to the security rules and practices information. For example, such data includes but is not limited to security requirement identification rules data, risk assessment information, security vulnerability cases, solutions, industry standards and other historical security data, as well as security practice experience summarized during project development and operation and maintenance;

[0074] 2) Sort and classify the collected multi-source data, remove redundant information and ensure data consistency. During the sorting process, natural language processing technology can be used to structure unstructured data; and / or, data can be grouped through classification algorithms, for example, by field, application scenario or risk type.

[0075] 3) Use knowledge graph technology to model the sorted and classified data, and intuitively represent the relationship between different entries in the knowledge base as a graph structure. For example, the nodes in the knowledge graph represent specific security requirements or vulnerability types, and the edges represent the relationship or impact between different requirements.

[0076] Furthermore, to ensure the real-time and validity of the security expert knowledge base, the latest experience and knowledge of the security experts can be re-acquired at a first time interval (such as weekly or monthly). During the update process, consistency checking and validity verification algorithms are used to perform quality control on the newly added data to ensure that the updated content is compatible with the content of the existing knowledge base and to remove possible conflicts and inconsistencies.

[0077] According to an embodiment of the present disclosure, after calling the security expert knowledge base, the empirical rules therein can verify the correctness of the identification results, mark possible missed security requirements, and automatically generate supplementary suggestions. In addition, through the reasoning ability of the knowledge graph, potential security requirements in complex business scenarios can be identified. For example, when a business requirement involves cross-module data sharing, the security expert knowledge base can prompt the need for additional access control and data encryption mechanisms. In addition, the regular update mechanism ensures the real-time nature of the knowledge base content and meets the challenges of rapidly changing business needs and security threats.

[0078] Furthermore, in order to improve the adaptability and accuracy of the security requirement identification model, the embodiments of the present disclosure also include: obtaining business requirement update data at a second time interval (such as every month); and based on the optimized security requirement identification results and business requirement update data, dynamically adjusting the parameters and identification rules of the security requirement identification model using an adaptive learning algorithm.

[0079] Due to the expansion of system functions, changes in business rules, and the dynamic development of the security environment, business requirements need to be constantly updated to adapt to new application scenarios. Update data sources can include real-time monitoring data collected during system operation, updated functional requirements documents, security audit reports, and externally input industry security specifications. Through the integrated analysis of business requirements update data, new content and its related features can be extracted to identify changes related to security requirements.

[0080] Specifically, adaptive learning algorithms can be used to dynamically adjust model parameters. For example, the updated data can be merged with the existing business demand data, and the optimized recognition results can be used as a benchmark to analyze the newly added or modified requirements and evaluate their impact on the existing rules and models. For example, incremental learning and deep reinforcement learning techniques can be applied to optimize the core parameters of the security demand recognition model, such as weights and learning rates, by training only for newly added data without affecting system operation.

[0081] Furthermore, the dynamic adjustment process of the adaptive learning algorithm can also include verification and optimization of the updated security requirement identification model. The performance of the adjusted model is evaluated through the verification data set to ensure its recognition accuracy and responsiveness to new requirements. Multiple rounds of iterative optimization can improve the adaptability of the model in complex business scenarios and achieve dynamic response to the rapidly changing security environment.

[0082] According to the embodiments of the present disclosure, the security demand identification model can continuously optimize its parameters and effectively respond to dynamic business needs and emerging security threats. Compared with the traditional static model adjustment method, the present disclosure not only improves the accuracy and efficiency of identification, but also significantly enhances the flexibility and adaptability of the model and reduces maintenance costs.

[0083] In operation S220, a pre-built security assessment tool is called, and the security assessment tool monitors the operating status of the target system in real time based on the security requirement identification result to generate a security requirement analysis result. The security assessment tool may include a core algorithm module and a security requirement analysis module.

[0084] Figure 3 The flowchart of the method for constructing a security assessment tool according to an embodiment of the present disclosure is schematically shown.

[0085] like Figure 3 As shown, the method for constructing a security assessment tool in this embodiment may include operations S310 to S330.

[0086] In operation S310, multi-dimensional assessment data is collected, including system operation data, historical security assessment data, and security requirement rule information. For example, it includes real-time system performance indicators, log files, user behavior data, network traffic information, etc.; previous security audit reports, vulnerability scanning results, security event records, etc.; as well as industry security standards, internal company security policies, security best practices, etc.

[0087] In operation S320, a core algorithm module including anomaly detection and risk assessment functions is developed based on the multi-dimensional evaluation data.

[0088] Specifically, the core algorithm module can use machine learning algorithms (such as support vector machines, random forests, deep learning models, etc.) and statistical methods (such as time series analysis, outlier detection algorithms, etc.) to analyze the operating data of the target system in real time and identify abnormal events that deviate from normal behavior patterns. At the same time, the identified abnormal behavior is correlated and compared with the pre-generated security requirement identification results to determine whether the abnormal behavior violates specific security requirements or triggers security rules, and the risk level faced by the current system can also be evaluated.

[0089] For example, if the security requirement identification result stipulates that "all user data transmission must be encrypted", and the anomaly detection module identifies unencrypted data transmission behavior, the core algorithm module can map this behavior to a security risk that violates the security requirement. For example, a weighted scoring mechanism can be used to quantitatively score different types of security threats according to their severity and probability of occurrence, and generate a comprehensive security requirement analysis report.

[0090] In operation S330, the core algorithm module is integrated with a real-time monitoring interface for business processes to obtain abnormal behaviors. For example, system operation data is transmitted to the core algorithm module in real time through an API interface, a message queue, a log collection tool, etc.

[0091] According to the embodiments of the present disclosure, the constructed security assessment tool combines multi-dimensional assessment data and deep learning algorithms, which can more accurately identify potential security risks in the system, reduce false positives and missed positives, and reduce the workload of manual analysis; through integration with the real-time monitoring interface, the security assessment tool can instantly detect and respond to abnormal behaviors in the system, thereby improving the system's security response speed.

[0092] Return to reference Figure 2 In operation S230, the business requirement data, the security requirement identification result and the security requirement analysis result are converted into a metadata structure and recorded in the blockchain in chronological order.

[0093] Figure 4 The flowchart of the method for recording data to a blockchain according to an embodiment of the present disclosure is schematically shown.

[0094] like Figure 4 As shown, the method of recording data to a blockchain in this embodiment may include operations S410 to S430.

[0095] In operation S410, a unique hash value is generated for the business demand data, the security demand identification result, and the security demand analysis result, and a corresponding timestamp and data pointer are constructed to form a metadata structure. The hash value is an encrypted summary of the data content, which can provide a unique identifier to ensure that the data has not been tampered with while ensuring data privacy; the timestamp is used to record the specific time when the data is generated or processed, which can provide a basis for subsequent data tracing and sorting; the data pointer records the physical or logical storage path of the data, ensuring that the original data can be quickly accessed when needed, while avoiding the waste of storage resources caused by directly storing large-scale original data.

[0096] According to the embodiments of the present disclosure, a complete metadata structure can be formed by combining hash values, timestamps, and data pointers. The metadata structure can not only effectively manage business demand data, security demand identification results, and security demand analysis results in a lightweight manner, but also has a high degree of security and traceability. The hash value ensures the uniqueness and immutability of the data, the timestamp provides the timing information of the data, and the data pointer realizes the association between the metadata structure and the original data, providing technical support for the complete management of the data during storage, verification, and calling.

[0097] In operation S420, the metadata structure is verified for integrity and authenticity using the consensus mechanism of the blockchain network. For example, the metadata structure can be passed to the verification nodes in the blockchain network, and each node independently verifies the received metadata structure. The verification may include recalculating the hash value, verifying whether it is consistent with the hash value recorded in the metadata structure, and checking the correctness of the timestamp and data pointer. The matching of the hash value ensures that the data has not been tampered with during transmission and storage, while the verification of the timestamp and data pointer verifies whether the generation time and relevance of the data are accurate.

[0098] After completing the verification of a single node, the blockchain network can use a consensus mechanism to confirm the consistency of the verification results of all nodes. For example, it can include proof of work, proof of stake, or Byzantine fault tolerance algorithms, which decide whether the metadata structure has passed the verification by voting or reaching a consensus. For example, in the mechanism of the Byzantine fault tolerance algorithm, only after more than two-thirds of the nodes have verified the metadata structure can it be considered legal and allowed to be stored in the blockchain. Through this distributed verification method, the risk of single point failure is avoided, while ensuring the common recognition of the authenticity of the metadata structure by the entire network.

[0099] The verified metadata structure is then recorded in the blockchain's distributed ledger, with each record linked to the previous block to form a chain structure. This design not only enhances the data integrity verification capability, but also ensures that any tampering with the stored data will be discovered immediately, as tampering will destroy the hash match of the entire chain.

[0100] In operation S430, the verified metadata structure is stored in the distributed ledger of the blockchain in chronological order. The chronological storage mechanism of the blockchain can use a timestamp to record the specific time when the data is generated, forming a chain record containing time information to facilitate data management and tracing.

[0101] Furthermore, in order to ensure data privacy while improving the security and efficiency of storage and access, sensitive business demand data can also be stored on and off the chain. Specifically, sensitive business demand data is not directly stored on the blockchain, but is stored in the off-chain database after being processed by encryption technology. The off-chain database is responsible for storing complete business demand data, and its storage method is processed by encryption algorithms to ensure that even if the data is stored on an external server, unauthorized users cannot directly access and interpret it.

[0102] At the same time, in order to achieve the relevance and traceability of data on and off the chain, a unique summary can be generated for the encrypted data stored in the off-chain database, and the summary can be recorded in the blockchain. The generation of the summary ensures the directionality of the on-chain record to the off-chain data. At the same time, through the uniqueness of the summary, the integrity and consistency of the off-chain stored data can be quickly verified. For example, when it is necessary to verify a piece of sensitive business demand data, it is only necessary to compare the summary stored on the chain with the summary recalculated from the off-chain encrypted data to confirm whether the off-chain data has been tampered with. The summary recorded on the chain not only provides a data integrity verification mechanism, but also enhances the audit capability of data access: due to the decentralized and tamper-proof characteristics of the blockchain, the data summary recorded on the chain can ensure that modifications and accesses to sensitive business demand data are recorded.

[0103] Furthermore, in response to the security management requirements of sensitive data, the embodiments of the present disclosure also provide a method for encrypting and storing business demand data, security demand identification results, and security demand analysis results in a blockchain. The user's access rights to blockchain data are managed through an access control list to achieve secure storage and rights management of data.

[0104] Specifically, in the data storage phase, the business demand data, security demand identification results, and security demand analysis results are first encrypted. Similarly, the encryption process can use encryption algorithms to convert raw data into unreadable ciphertext to ensure that the data is not obtained or tampered with by unauthorized users during transmission and storage.

[0105] In the data access management stage, refined management of user access rights is achieved through access control lists. The access control list records the permission information of each user in the blockchain, including the permission to read, write or modify specific data. According to the user's role and authentication level, the permissions defined in the access control list are dynamically matched to ensure that only authorized users can access or operate specific blockchain data. In addition, the access control list can also provide a dynamic update mechanism, allowing user permissions to be adjusted according to changes in business needs or security policies, thereby improving the flexibility and adaptability of data access management.

[0106] Based on the above blockchain-based security requirements analysis method, the present disclosure also provides a blockchain-based security requirements analysis device. Figure 5 The device is described in detail.

[0107] Figure 5 The structural block diagram of the blockchain-based security requirements analysis device according to an embodiment of the present disclosure is schematically shown.

[0108] like Figure 5 As shown, the blockchain-based security requirement analysis device 500 of this embodiment includes a security requirement identification result generation module 510, a security requirement analysis result generation module 520, and a recording module 530.

[0109] The security requirement identification result generation module 510 can be used to obtain business requirement data, input the pre-processed business requirement data into a security requirement identification model based on deep learning and natural language processing training, and generate a security requirement identification result. In one embodiment, the security requirement identification result generation module 510 can be used to perform the operation S210 described above, which will not be repeated here.

[0110] The security requirement analysis result generation module 520 can be used to call a pre-built security assessment tool, which monitors the operating status of the target system in real time based on the security requirement identification result and generates a security requirement analysis result. In one embodiment, the security requirement analysis result generation module 520 can be used to perform the operation S220 described above, which will not be repeated here.

[0111] The recording module 530 may be used to convert the business demand data, the security demand identification result, and the security demand analysis result into a hash value and a metadata structure, and record them in a chronological order in the blockchain. In one embodiment, the recording module 530 may be used to perform the operation S230 described above, which will not be described in detail here.

[0112] According to an embodiment of the present disclosure, the security requirement identification result generation module 510 can also be used to call the security expert knowledge base, perform data association and data supplement on the security requirement identification result, and generate a supplemented security requirement identification result, wherein the security expert knowledge base is constructed with a knowledge graph based on security rule practice information.

[0113] According to an embodiment of the present disclosure, the security requirement identification result generation module 510 can also be used to obtain business requirement update data at a second time interval; and based on the optimized security requirement identification results and the business requirement update data, dynamically adjust the parameters of the security requirement identification model using an adaptive learning algorithm.

[0114] According to an embodiment of the present disclosure, the security requirement analysis result generating module 520 may include a security assessment tool building module, and the security assessment tool building module may include an assessment data collecting unit, a core algorithm module developing unit, and an integration unit.

[0115] The evaluation data collection unit may collect multi-dimensional evaluation data, including system operation data, historical security evaluation data, and security requirement rule information. In one embodiment, the evaluation data collection unit may be used to perform the operation S310 described above, which will not be described in detail here.

[0116] The core algorithm module development unit can be used to develop a core algorithm module including anomaly detection function and risk assessment function based on the multi-dimensional evaluation data. In one embodiment, the core algorithm module development unit can be used to perform the operation S320 described above, which will not be repeated here.

[0117] The integration unit may be used to integrate the core algorithm module with a real-time monitoring interface for a business process to obtain abnormal behavior. In one embodiment, the integration unit may be used to perform the operation S330 described above, which will not be described in detail here.

[0118] According to an embodiment of the present disclosure, the security requirement analysis result generation module 520 can also be used to perform real-time analysis on the target system operation data using a predefined anomaly detection algorithm to identify abnormal behavior; and to correlate and compare the identified abnormal behavior with the security requirement identification results to generate a security requirement analysis result.

[0119] According to an embodiment of the present disclosure, the recording module 530 may include a metadata structure unit, a verification unit, and a storage unit.

[0120] The metadata structure unit can be used to generate a unique hash value for the business requirement data, the security requirement identification result, and the security requirement analysis result, and construct a corresponding timestamp and data pointer to form a metadata structure. In one embodiment, the metadata structure unit can be used to perform the operation S410 described above, which will not be repeated here.

[0121] The verification unit may be used to verify the integrity and authenticity of the metadata structure using the consensus mechanism of the blockchain network. In one embodiment, the verification unit may be used to perform the operation S420 described above, which will not be described in detail here.

[0122] The storage unit may be used to store the verified metadata structure in a distributed ledger of the blockchain in chronological order. In one embodiment, the storage unit may be used to perform the operation S430 described above, which will not be described in detail herein.

[0123] According to an embodiment of the present disclosure, the recording module 530 can also be used to store sensitive business demand data in an off-chain database in an encrypted form, and record a summary of the encrypted data in the blockchain to establish an on-chain and off-chain association.

[0124] According to an embodiment of the present disclosure, the recording module 530 can also be used to encrypt the business demand data, the security demand identification results and the security demand analysis results, and store the encrypted data in the blockchain; and manage the access rights of different users to the blockchain data through an access control list.

[0125] According to an embodiment of the present disclosure, any multiple modules of the security requirement identification result generation module 510, the security requirement analysis result generation module 520, and the recording module 530 can be combined into one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the security requirement identification result generation module 510, the security requirement analysis result generation module 520, and the recording module 530 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware, and firmware, or in an appropriate combination of any of them. Alternatively, at least one of the security requirement identification result generation module 510, the security requirement analysis result generation module 520, and the recording module 530 may be at least partially implemented as a computer program module, and when the computer program module is executed, the corresponding function may be executed.

[0126] Figure 6 A block diagram of an electronic device suitable for implementing a blockchain-based security requirements analysis method according to an embodiment of the present disclosure is schematically shown.

[0127] like Figure 6 As shown, the electronic device 600 according to an embodiment of the present disclosure includes a processor 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage part 608 to a random access memory (RAM) 603. The processor 601 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a dedicated microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 601 may also include an onboard memory for caching purposes. The processor 601 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0128] In RAM 603, various programs and data required for the operation of electronic device 600 are stored. Processor 601, ROM 602 and RAM 603 are connected to each other via bus 604. Processor 601 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 602 and / or RAM 603. It should be noted that the program can also be stored in one or more memories other than ROM 602 and RAM 603. Processor 601 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in the one or more memories.

[0129] According to an embodiment of the present disclosure, the electronic device 600 may further include an input / output (I / O) interface 605, which is also connected to the bus 604. The electronic device 600 may further include one or more of the following components connected to the input / output (I / O) interface 605: an input portion 606 including a keyboard, a mouse, etc.; an output portion 607 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 608 including a hard disk, etc.; and a communication portion 609 including a network interface card such as a LAN card, a modem, etc. The communication portion 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the input / output (I / O) interface 605 as needed. A removable medium 611, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 610 as needed, so that a computer program read therefrom is installed into the storage portion 608 as needed.

[0130] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0131] According to an embodiment of the present disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, it may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus or a device. For example, according to an embodiment of the present disclosure, the computer-readable storage medium may include the ROM 602 and / or RAM 603 described above and / or one or more memories other than ROM 602 and RAM 603.

[0132] The embodiment of the present disclosure also includes a computer program product, which includes a computer program, and the computer program includes a program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the security requirements analysis method based on blockchain provided by the embodiment of the present disclosure.

[0133] The above functions defined in the system / device of the embodiment of the present disclosure are performed when the computer program is executed by the processor 601. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0134] In one embodiment, the computer program may rely on tangible storage media such as optical storage devices, magnetic storage devices, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of signals on a network medium, and downloaded and installed through the communication part 609, and / or installed from a removable medium 611. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0135] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 609, and / or installed from the removable medium 611. When the computer program is executed by the processor 601, the above functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the system, device, apparatus, module, unit, etc. described above can be implemented by a computer program module.

[0136] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0137] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0138] It will be appreciated by those skilled in the art that the features described in the various embodiments of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations or combinations are not explicitly described in the present disclosure. In particular, without departing from the spirit and teachings of the present disclosure, the features described in the various embodiments of the present disclosure may be combined and / or combined in a variety of ways. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0139] The embodiments of the present disclosure are described above. However, these embodiments are only for illustrative purposes and are not intended to limit the scope of the present disclosure. Although the embodiments are described above, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. Without departing from the scope of the present disclosure, those skilled in the art may make a variety of substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A security requirements analysis method based on blockchain, characterized in that: The method comprises: Obtain business demand data, input the pre-processed business demand data into the security demand identification model based on deep learning and natural language processing training, and generate security demand identification results; Calling a pre-built security assessment tool, wherein the security assessment tool monitors the operating status of the target system in real time based on the security requirement identification result and generates a security requirement analysis result; and The business requirement data, the security requirement identification result and the security requirement analysis result are converted into a metadata structure and recorded in the blockchain in chronological order.

2. The method according to claim 1, characterized in that: After generating the security requirement identification result, the method further includes: The security expert knowledge base is called to perform data association and data supplement on the security requirement identification result to generate a supplemented security requirement identification result, wherein the security expert knowledge base is constructed with a knowledge graph based on security rule practice information.

3. The method according to claim 2, characterized in that The security expert knowledge base is constructed based on a knowledge graph based on security rule practice information, specifically including: Collecting multi-source data related to the safety rule practice information, including safety rule data, risk assessment information, and historical safety data; Arrange and classify the multi-source data, and build the security expert knowledge base based on the knowledge graph; and The experience and knowledge of the security expert are reacquired at a first time interval, and consistency and validity verification is performed to obtain updated content, and the security expert knowledge base is updated based on the updated content.

4. The method according to any one of claims 1 to 3, characterized in that: The security assessment tool includes a core algorithm module and a security requirement analysis module. The construction method of the security assessment tool specifically includes: Collect multi-dimensional assessment data, including system operation data, historical security assessment data, and security requirement rule information; Based on the multi-dimensional evaluation data, develop a core algorithm module including anomaly detection function and risk assessment function; as well as The core algorithm module is integrated with a real-time monitoring interface for business processes to capture abnormal behaviors.

5. The method according to claim 4, characterized in that The security assessment tool monitors the operating status of the target system in real time based on the security requirement identification result and generates a security requirement analysis result, which specifically includes: Use predefined anomaly detection algorithms to analyze target system operation data in real time to identify abnormal behavior; and The identified abnormal behaviors are correlated and compared with the security requirement identification results to generate security requirement analysis results.

6. The method according to claim 2, characterized in that The method further comprises: Acquiring business demand update data at a second time interval; and Based on the optimized security requirement identification results and the business requirement update data, the parameters of the security requirement identification model are dynamically adjusted using an adaptive learning algorithm.

7. The method according to any one of claims 1 to 3, 5 to 6, characterized in that: The converting of the business demand data, the security demand identification result and the security demand analysis result into a metadata structure and recording them in a chronological order into the blockchain specifically includes: Generate a unique hash value for the business requirement data, the security requirement identification result, and the security requirement analysis result, and construct a corresponding timestamp and data pointer to form a metadata structure; Verifying the integrity and authenticity of the metadata structure using the consensus mechanism of the blockchain network; and The verified metadata structure is stored in a chronological order in the blockchain’s distributed ledger.

8. The method according to claim 7, characterized in that The method further comprises: Sensitive business requirement data is stored in an encrypted form in an off-chain database, and a summary of the encrypted data is recorded in the blockchain to establish an on-chain and off-chain association.

9. The method according to claim 7, characterized in that: The method further comprises: Encrypting the business requirement data, the security requirement identification result, and the security requirement analysis result, and storing the encrypted data in a blockchain; and Access control lists are used to manage different users’ access rights to blockchain data.

10. A security demand analysis device based on blockchain, characterized in that: The device comprises: A security requirement identification result generation module is used to: obtain business requirement data, input the pre-processed business requirement data into a security requirement identification model based on deep learning and natural language processing training, and generate a security requirement identification result; A security requirement analysis result generating module is used to: call a pre-built security assessment tool, the security assessment tool monitors the operating status of the target system in real time based on the security requirement identification result, and generates a security requirement analysis result; and The recording module is used to convert the business demand data, the security demand identification result and the security demand analysis result into a hash value and a metadata structure, and record them in a blockchain in chronological order.

11. An electronic device, comprising: one or more processors; a memory for storing one or more computer programs, It is characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 9.

12. A computer-readable storage medium having a computer program or instruction stored thereon, characterized in that: When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 9 are implemented.

13. A computer program product comprising a computer program or instructions, characterized in that When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 9 are implemented.

Images