Computer secrecy checking device and computer secrecy system

Abstract

The invention provides a computer secrecy checking device and a computer secrecy system. The computer secrecy checking device and the computer secrecy system comprise a checking unit which is used for detecting security vulnerabilities in computer hardware, an operating system and an application program, and the checking unit carries out comprehensive security check on the system in a mode of combining regular scanning and real-time monitoring; and the data acquisition unit is used for acquiring operation behaviors, log files, network communication data and the like of the computer system in real time. According to the computer secrecy checking device and the computer secrecy system, the computer secrecy system can monitor a plurality of system components at the same time through the combination of a multi-channel detection framework of the checking unit and real-time monitoring, so that the comprehensiveness and efficiency of security check are improved; the data acquisition unit adopts a non-intrusive acquisition mode to acquire multi-dimensional data such as computer system operation behaviors and network communication in real time, and high-efficiency and low-delay data acquisition is realized while the system performance is ensured not to be influenced.

Description

Technical Field

[0001] The present invention relates to the technical field of computer confidentiality, and in particular to a computer confidentiality verification device and a computer confidentiality system. Background Art

[0002] The computer confidentiality verification device consists of a verification unit, a data acquisition unit, a data processing unit, a user authority management unit, and a secure storage unit. The verification unit is responsible for security testing of computer hardware and software, the data acquisition unit monitors operation records and user behavior in real time, the data processing unit analyzes the collected data to identify security threats, the user authority management unit controls the user's access to sensitive data, and the secure storage unit encrypts and stores the verification results to ensure information security. Through multi-level monitoring and authority control, the system aims to ensure the confidentiality of the computer system in real time.

[0003] Although the system has certain security functions, it still has many defects. The system may experience performance bottlenecks under high load, resulting in delays or misjudgments. The system rules and algorithms are relatively fixed and lack the ability to flexibly respond to new threats, which can easily cause false positives or omissions and make it difficult to adapt to the ever-changing security environment. Summary of the invention

[0004] In view of the shortcomings of the prior art, the present invention provides a computer security system that solves the problem that the system may have performance bottlenecks under high load, resulting in delays or misjudgments; the system rules and algorithms are relatively fixed, lack the ability to flexibly respond to new threats, easily cause false alarms or missed alarms, and are difficult to adapt to the ever-changing security environment.

[0005] To achieve the above objectives, the present invention is implemented through the following technical solutions: A computer security system, including: a verification unit, used to detect security vulnerabilities in computer hardware, operating systems and applications, and the verification unit performs a comprehensive security check on the system by combining regular scanning and real-time monitoring; a data acquisition unit: used to collect the operation behavior, log files, and network communication data of the computer system in real time, and the data acquisition unit is connected to each module of the computer system through a hardware interface to achieve efficient and low-latency data acquisition; a performance optimization module: used to optimize resource allocation under high-load environments, and the module ensures that the system can run efficiently under high concurrency conditions through hardware resource scheduling and load balancing technology. The performance optimization module adjusts computing resources according to real-time load conditions and allocates resources through the following formula: , in, is the amount of resources allocated, is the current total system resources, is the real-time load value, is the priority weight; Secure storage unit: used for distributed storage of encrypted verification results and sensitive data. The hardware storage unit supports high-reliability data backup and redundant storage, and ensures data confidentiality and integrity through distributed encryption solutions.

[0006] Preferably, the verification unit uses a multi-channel detection architecture, which can monitor multiple system components simultaneously and improve detection efficiency.

[0007] Preferably, the data acquisition unit supports a non-intrusive acquisition method, and is capable of acquiring and transmitting system and network status data in real time, ensuring that system performance is not affected.

[0008] Preferably, the secure storage unit adopts a distributed encrypted storage solution, supports dynamic node expansion and data redundant storage, and ensures the security of data during storage.

[0009] Preferably, a data acquisition unit is connected, and an intelligent algorithm based on deep learning is used to analyze the collected data, and a data processing unit uses a threat scoring formula to perform threat assessment: , in, Score the threat. For abnormal behavior, is the behavior frequency, is the threat type level, is the weight factor, and the data processing unit dynamically adjusts the system's security policy based on real-time data and threat scores; User Rights Management Unit: It is used to dynamically adjust the user's access rights according to the threat score and behavior analysis results, and record the access behavior. The User Rights Management Unit can automatically allocate and adjust rights according to the algorithm model, and generate logs for subsequent auditing; Rule update module: Based on the dynamic learning algorithm, the security detection rule base is automatically updated. The rule update module automatically calculates the rule update frequency based on the security event data collected during system operation using the following formula: , in, is the rule update frequency, is the number of security events within time t, The module can automatically optimize rules based on the real-time threat situation to avoid false positives and false negatives. Intelligent threat detection model: The data processing unit integrates multiple machine learning and deep learning models to identify potential security threats. Through model combination, parameter adjustment and dynamic training, the system can efficiently identify new threats and reduce false alarms.

[0010] Preferably, the data processing unit adopts a multi-level algorithm model, including a rule engine, a machine learning model and a deep learning network, to improve the accuracy of threat identification. The rule update module is based on a time window intelligent algorithm, and reduces threat identification errors caused by rule aging by adjusting the rule update frequency and learning strategy.

[0011] Preferably, the intelligent threat detection model is automatically adjusted based on an adaptive algorithm, and is capable of processing multi-modal input data, thereby improving the intelligence and adaptability of the system. The system is linked with external security devices through an API interface for collaborative protection.

[0012] Preferably, the permission management unit adopts blockchain technology to perform decentralized permission management, thereby improving the transparency and tamper resistance of permission control.

[0013] The present invention provides a computer confidentiality verification device and a computer confidentiality system. It has the following beneficial effects: the computer confidentiality system of the present invention combines the multi-channel detection architecture of the verification unit with real-time monitoring, and can monitor multiple system components at the same time, thereby improving the comprehensiveness and efficiency of security inspections; the data acquisition unit adopts a non-invasive acquisition method to obtain computer system operation behavior and network communication multi-dimensional data in real time, ensuring that system performance is not affected while achieving efficient and low-latency data acquisition. The performance optimization module dynamically adjusts system resource allocation under high-load environments through hardware resource scheduling and load balancing technology, effectively avoiding performance bottleneck problems, and reasonably allocates computing resources through innovative resource allocation formulas to ensure the stability and efficiency of the system under high concurrency. In addition, the secure storage unit adopts a distributed encrypted storage solution, supports dynamic node expansion and data redundancy, and significantly improves the security and reliability of data storage.

[0014] The present invention fully demonstrates the intelligence and dynamic adaptability of the system through the combination of the data processing unit and the rule update module. The data processing unit is based on a threat scoring algorithm based on deep learning. Through a comprehensive evaluation of the abnormality of behavior, behavior frequency and threat type level, it dynamically adjusts the security strategy of the system and improves the accuracy of threat identification. The rule update module is based on a time window intelligent algorithm, which automatically calculates and optimizes the rule update frequency, effectively reducing the false positives and false negatives caused by rule aging. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] FIG1 is a schematic diagram of the structure of the present invention. DETAILED DESCRIPTION

[0016] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0017] As shown in FIG1 , an embodiment of the present invention provides a computer security system, including: a verification unit: used to detect security vulnerabilities in computer hardware, operating systems, and applications, the verification unit performs a comprehensive security check on the system by combining periodic scanning and real-time monitoring, and the verification unit uses a multi-channel detection architecture, which can monitor multiple system components at the same time to improve detection efficiency; Data acquisition unit: used to collect the operation behavior, log files, and network communication data of the computer system in real time. The data acquisition unit is connected to each module of the computer system through a hardware interface to achieve efficient and low-latency data acquisition. The data acquisition unit supports non-intrusive acquisition methods and can obtain and transmit system and network status data in real time to ensure that system performance is not affected; Performance optimization module: used to optimize resource allocation in a high-load environment. This module uses hardware resource scheduling and load balancing technology to ensure that the system can run efficiently under high concurrency conditions. The performance optimization module adjusts computing resources according to real-time load conditions and allocates resources using the following formula: , in, is the amount of resources allocated, is the current total system resources, is the real-time load value, is the priority weight; Secure storage unit: used for distributed storage of encrypted verification results and sensitive data. The hardware storage unit supports high-reliability data backup and redundant storage, and ensures the confidentiality and integrity of data through distributed encryption solutions. The secure storage unit adopts a distributed encryption storage solution, supports dynamic node expansion and data redundant storage, and ensures the security of data during the storage process.

[0018] A computer security system, characterized in that: a data processing unit: connected to a data acquisition unit, using an intelligent algorithm based on deep learning to analyze the collected data, and the data processing unit uses a threat scoring formula to perform threat assessment: , in, Score the threat. For abnormal behavior, is the behavior frequency, is the threat type level, is the weight factor, and the data processing unit dynamically adjusts the system's security policy based on real-time data and threat scores; User Rights Management Unit: It is used to dynamically adjust the user's access rights according to the threat score and behavior analysis results, and record the access behavior. The User Rights Management Unit can automatically allocate and adjust rights according to the algorithm model, and generate logs for subsequent auditing; Rule update module: Based on the dynamic learning algorithm, the security detection rule base is automatically updated. The rule update module automatically calculates the rule update frequency based on the security event data collected during system operation using the following formula: , in, is the rule update frequency, For time The number of security incidents within The module can automatically optimize rules based on the real-time threat situation to avoid false positives and false negatives. Intelligent threat detection model: The data processing unit integrates multiple machine learning and deep learning models to identify potential security threats. Through model combination, parameter adjustment and dynamic training, the system can efficiently identify new threats and reduce false alarms. The data processing unit adopts a multi-level algorithm model, including a rule engine, a machine learning model and a deep learning network to improve the accuracy of threat identification. The rule update module is based on a time window intelligent algorithm. By adjusting the rule update frequency and learning strategy, the threat identification error caused by rule aging can be reduced. The intelligent threat detection model is automatically adjusted based on an adaptive algorithm, which can process multimodal input data and improve the intelligence and adaptability of the system. The system is linked with external security devices through an API interface for collaborative protection. The training method of the dynamic threat detection model describes how to continuously optimize the model through incremental learning: A sliding window mechanism is used to update the data set in real time to ensure that the model parameters meet the latest threat scenarios.

[0019] The following incremental learning formula is introduced: , in, represents the updated model parameters, is the vector or matrix of model parameters, represents the model parameters before updating, is the vector or matrix of model parameters, is the learning rate, is the loss function, The gradient of the loss function represents the gradient of the model parameter response adjustment. The edge computing architecture is introduced as a support for the performance optimization module, allowing some security analysis tasks to be completed on edge devices to reduce the load on the central server.

[0020] Describe how edge nodes are distributed and implement task allocation through the following formula: , in, Assign proportions to tasks, Calculate the capacity weight for the nth node, is the real-time load of the nth node, Wi is the computing power weight of other nodes except the nth node, Ci is the actual load of other nodes except the nth node, and the training method of the dynamic threat detection model is added to describe how to continuously optimize the model through incremental learning: A sliding window mechanism is used to update the data set in real time to ensure that the model parameters meet the latest threat scenarios.

[0021] The following incremental learning formula is introduced: , in, Represents the updated model parameters, the vector or matrix of model parameters is the updated model parameters, Represents the model parameters before updating, which is the vector or matrix of model parameters. is the learning rate, is the loss function, is the gradient of the loss function, which indicates the gradient of the model parameters to be adjusted.

[0022] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A computer security verification device, characterized in that: include: Verification unit: used to detect security vulnerabilities in computer hardware, operating systems and applications. The verification unit conducts a comprehensive security check on the system through a combination of regular scanning and real-time monitoring; Data acquisition unit: used to collect the operation behavior, log files, and network communication data of the computer system in real time. The data acquisition unit is connected to each module of the computer system through a hardware interface to achieve efficient and low-latency data acquisition; Performance optimization module: used to optimize resource allocation in a high-load environment. This module uses hardware resource scheduling and load balancing technology to ensure that the system can run efficiently under high concurrency conditions. The performance optimization module adjusts computing resources according to real-time load conditions and allocates resources using the following formula: ， in, is the amount of resources allocated, is the current total system resources, is the real-time load value, is the priority weight; Secure storage unit: used for distributed storage of encrypted verification results and sensitive data. The hardware storage unit supports high-reliability data backup and redundant storage, and ensures data confidentiality and integrity through distributed encryption solutions.

2. A computer security verification device according to claim 1, characterized in that: The verification unit uses a multi-channel detection architecture, which can monitor multiple system components simultaneously and improve detection efficiency.

3. A computer security verification device according to claim 1, characterized in that: The data acquisition unit supports non-intrusive acquisition mode, and can acquire and transmit system and network status data in real time to ensure that system performance is not affected.

4. A computer security verification device according to claim 1, characterized in that: The secure storage unit adopts a distributed encrypted storage solution, supports dynamic node expansion and data redundant storage, and ensures the security of data during storage.

5. A computer security system, characterized in that: Data processing unit: connected to the data collection unit, uses an intelligent algorithm based on deep learning to analyze the collected data, and uses the threat scoring formula to perform threat assessment: ， in, Score the threat. For abnormal behavior, is the behavior frequency, is the threat type level, is the weight factor, and the data processing unit dynamically adjusts the system's security policy based on real-time data and threat scores; User Rights Management Unit: It is used to dynamically adjust the user's access rights according to the threat score and behavior analysis results, and record the access behavior. The User Rights Management Unit can automatically allocate and adjust rights according to the algorithm model, and generate logs for subsequent auditing; Rule update module: Based on the dynamic learning algorithm, the security detection rule base is automatically updated. The rule update module automatically calculates the rule update frequency based on the security event data collected during system operation using the following formula: ， in, is the rule update frequency, For time The number of security incidents within The module can automatically optimize rules based on the real-time threat situation to avoid false positives and false negatives. Intelligent threat detection model: The data processing unit integrates multiple machine learning and deep learning models to identify potential security threats. Through model combination, parameter adjustment and dynamic training, the system can efficiently identify new threats and reduce false alarms.

6. A computer security system according to claim 5, characterized in that: The data processing unit adopts a multi-level algorithm model, including a rule engine, a machine learning model and a deep learning network, to improve the accuracy of threat identification. The rule update module is based on a time window intelligent algorithm and reduces threat identification errors caused by rule aging by adjusting the rule update frequency and learning strategy.

7. A computer security system according to claim 5, characterized in that: The intelligent threat detection model is automatically adjusted based on an adaptive algorithm, and can process multimodal input data to improve the intelligence and adaptability of the system. The system is linked with external security devices through an API interface to perform collaborative protection.

8. A computer security system according to claim 5, characterized in that: The authority management unit adopts blockchain technology to perform decentralized authority management, thereby improving the transparency and tamper resistance of authority control.

Images