Object security level determination method and device, storage medium and electronic device

Abstract

The embodiment of the invention provides an object security level determination method and device, a storage medium and an electronic device.The method comprises the steps that first attribute data, first comment data and first security data about a target object obtained by searching keywords are obtained; obtaining target data included in the target address; processing the target data to obtain second attribute data, second comment data and second security data of the target object; and determining the security level of the target object based on the first attribute data, the first comment data, the first security data, the second attribute data, the second comment data and the second security data. According to the method and the device, the problem of inaccurate determination of the security situation in the prior art is solved, and the effect of accurately determining the security situation is further achieved.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of communications, and in particular, to a method, device, storage medium and electronic device for determining the security level of an object. Background Art

[0002] Among the related technologies, the main shortcomings of the current traditional information technology field are incomplete data collection, poor visualization, lack of intelligent early warning and excessive manual intervention. The data on security situation comes from different independent information systems, making it difficult to accurately determine its security situation.

[0003] It can be seen from this that there is a technical problem in the relevant technology of inaccurately determining the security situation.

[0004] Currently, no effective solution has been proposed for the above-mentioned problems existing in the related technologies. Summary of the invention

[0005] The embodiments of the present invention provide a method, device, storage medium and electronic device for determining the security level of an object, so as to at least solve the problem of inaccurate security situation determination existing in the related art.

[0006] According to one embodiment of the present invention, a method for determining the security level of an object is provided, comprising: obtaining first attribute data, first comment data and first security data about a target object obtained by searching for a keyword; obtaining target data included in a target address; processing the target data to obtain second attribute data, second comment data and second security data of the target object; and determining the security level of the target object based on the first attribute data, the first comment data, the first security data, the second attribute data, the second comment data and the second security data.

[0007] In an exemplary embodiment, the target data is processed to obtain second attribute data, second comment data and second security data of the target object, including: determining object data included in the target data and belonging to the target object; and classifying the object data according to data attributes to obtain the second attribute data, the second comment data and the second security data.

[0008] In an exemplary embodiment, determining the security level of the target object based on the first attribute data, the first comment data, the first security data, the second attribute data, the second comment data and the second security data includes: cleaning the first attribute data and the second attribute data to obtain target attribute data; cleaning the first comment data and the second comment data to obtain target comment data; cleaning the first security data and the second security data to obtain target security data; determining the security level based on the target attribute data, the target comment data and the target security data.

[0009] In an exemplary embodiment, before determining the security level of the target object based on the first attribute data, the first comment data, the first security data, the second attribute data, the second comment data and the second security data, the method further includes: caching the first attribute data, the first comment data, the first security data, the second attribute data, the second comment data and the second security data in a first database; after cleaning the first security data and the second security data, the method further includes: storing the target attribute data, the target comment data and the target security data in a second database.

[0010] In an exemplary embodiment, determining the security level based on the target attribute data, the target comment data and the target security data includes: obtaining a first correspondence between predetermined attribute data and attribute scores; determining a target attribute score corresponding to the target attribute data based on the first correspondence; obtaining a second correspondence between predetermined comment data and comment scores; determining a target comment score corresponding to the target comment data based on the second correspondence; obtaining a third correspondence between predetermined security data and security scores; determining a target security score corresponding to the target security data based on the third correspondence; determining a first weight of the target attribute data, determining a second weight of the target comment data, and determining a third weight of the target security data; determining a first product of the first weight and the target attribute score, determining a second product of the second weight and the target comment score, and determining a third product of the third weight and the target security score; and determining the sum of the first product, the second product and the third product as the security level.

[0011] In an exemplary embodiment, after determining the security level of the target object based on the target scoring data, the method further includes: performing an alarm operation when the security level exceeds a preset level.

[0012] In an exemplary embodiment, after processing the target data to obtain the second attribute data, second comment data and second security data of the target object, the method further includes: performing statistical analysis on the first attribute data and the second attribute data to obtain target statistical attribute data; performing statistical analysis on the first comment data and the second comment data to obtain target statistical comment data; performing statistical analysis on the first security data and the second security data to obtain target statistical security data; determining a first ranking of the target statistical attribute data in the statistical attribute data, wherein the statistical attribute data is data determined based on the attribute data of other objects; determining a second ranking of the target statistical comment data in the statistical comment data, wherein the statistical comment data is data determined based on the comment data of other objects; determining a third ranking of the target statistical security data in the statistical security data, wherein the statistical security data is data determined based on the security data of other objects; and in the event that there is a target ranking that meets a predetermined condition among the first ranking, the second ranking and the third ranking, displaying the data corresponding to the target ranking in the target interface.

[0013] According to another embodiment of the present invention, there is provided a device for determining the security level of an object, comprising: a first acquisition module for acquiring first attribute data, first comment data and first security data about a target object obtained by searching for a keyword; a second acquisition module for acquiring target data included in a target address; a processing module for processing the target data to obtain second attribute data, second comment data and second security data of the target object; and a determination module for determining the security level of the target object based on the first attribute data, the first comment data, the first security data, the second attribute data, the second comment data and the second security data.

[0014] According to yet another embodiment of the present invention, a computer-readable storage medium is provided, in which a computer program is stored, wherein the computer program is configured to execute the steps of any one of the above method embodiments when run.

[0015] According to yet another embodiment of the present invention, there is provided an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0016] According to yet another embodiment of the present invention, a computer program product is provided, including a computer program, and when the computer program is executed by a processor, the steps of the method described in each embodiment of the present application are implemented.

[0017] Through the present invention, the first attribute data, first comment data and first security data about the target object can be obtained through keyword search, and the target data obtained from the target address can be processed to obtain the second attribute data, second comment data and second security data about the target object. The security level of the target object can be determined based on the first attribute data, the first comment data, the first security data, the second attribute data, the second comment data and the second security data. Since the security level of the target object is determined based on all the collected data, all information about the security of the target object can be covered, so the problem of inaccurate determination of the security situation existing in the related art can be solved, thereby achieving the effect of accurately determining the security situation. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 is a hardware structure block diagram of a mobile terminal according to a method for determining an object security level according to an embodiment of the present invention;

[0019] Figure 2 is a flow chart of a method for determining a security level of an object according to an embodiment of the present invention;

[0020] Figure 3 is a schematic diagram of a security level awareness management platform according to an embodiment of the present invention;

[0021] Figure 4 is a network topology diagram of a security level awareness management system according to an embodiment of the present invention;

[0022] Figure 5 is a functional architecture diagram of a security level awareness management system platform according to an embodiment of the present invention;

[0023] Figure 6 is an application architecture diagram of a security level perception system platform according to an embodiment of the present invention;

[0024] Figure 7 4 is a structural block diagram of a device for determining a security level of an object according to an embodiment of the present invention. DETAILED DESCRIPTION

[0025] Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings and in combination with the embodiments.

[0026] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0027] The method embodiments provided in the embodiments of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Taking running on a mobile terminal as an example, Figure 1 FIG. 1 is a hardware structure block diagram of a mobile terminal of a method for determining an object security level according to an embodiment of the present invention. Figure 1 As shown, the mobile terminal may include one or more ( Figure 1 Only one is shown in the figure) a processor 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA) and a memory 104 for storing data, wherein the mobile terminal may also include a transmission device 106 and an input / output device 108 for communication functions. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the mobile terminal. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations shown.

[0028] The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the method for determining the object security level in the embodiment of the present invention. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, to implement the above method. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the mobile terminal via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0029] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the mobile terminal. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0030] In this embodiment, a method for determining the security level of an object is provided. Figure 2 is a flow chart of a method for determining the security level of an object according to an embodiment of the present invention. Figure 2 As shown, the process includes the following steps:

[0031] Step S202, obtaining first attribute data, first comment data, and first security data about the target object obtained by searching for the keyword;

[0032] Step S204, obtaining target data included in the target address;

[0033] Step S206, processing the target data to obtain second attribute data, second comment data and second security data of the target object;

[0034] Step S208: determining the security level of the target object based on the first attribute data, the first comment data, the first security data, the second attribute data, the second comment data, and the second security data.

[0035] In the above embodiment, the target object can be a unit, a group, or a company. The first attribute data and the second attribute data can be understood as asset information about the target object, for example: investment information and loan information of a unit or a company, and can also be leasing information or foreign exchange trading information. The first comment data and the second comment data can be understood as information for evaluating the target object, and can include positive information and negative information. The first security data and the second security data can be understood as information about abnormal security issues in the management system of the target object, and can include: information about the management system being attacked, information about the existence of Trojan viruses in the management system, etc. Among them, the management system can be a security level perception management platform. The first security data and the second security data can include data obtained from the security level perception management platform, and can also include data obtained from the website. Among them, the schematic diagram of the security level perception management platform can be found in the attached. Figure 3 ,like Figure 3 As shown, the first security data and the second security data may include the U disk whitelist opening rate, the average number of U disk copied files on the terminal, the comprehensive virus situation, the illegal external machine situation, the interception of information sent from the external network, the interception of external emails, the weak password login situation, the number of special terminal permissions, the anti-virus client upgrade rate, the number of Internet sensitive information interception times, the number of employee inquiries for customer information, the number of weak password logins, the number of virus detections, and overdue work orders, etc., which are monitored by the security component in the information security data layer.

[0036] In the above embodiment, the target address can be any address with access function, which can be a communication software applet, a query software applet, a query web page, a news web page, etc., but not limited thereto. Keywords can be defined according to needs, and the information of the target object can be accurately detected (i.e., the above-mentioned first attribute data, the first comment data, and the first security data). For example, if you want to obtain negative information about the xx unit, you can enter keywords such as xx unit corruption, xx unit violation, or xx unit leakage, and quickly locate and lock the data for this target. In addition, through the keyword management function, the page can be configured regularly to update the keywords, and the data can be captured in sequence every three hours or every four hours. Since the rules for keyword search and information capture are single, the corresponding data will be output only when the keywords are fully matched. Therefore, due to the limitation of the retrieval structure, there may be omission of related data, resulting in the loss of valid data. Therefore, all the data in the target address (i.e., the above-mentioned target data) can be obtained, and after processing the target data, data with a high degree of correlation with the required target (i.e., the above-mentioned second attribute data, the second comment data, and the second security data) can be obtained.

[0037] In the above embodiment, the target data can be collected through the distributed crawler architecture of Scrapy+redies, and the bandwidth speed and machine performance of multiple machines can be fully utilized to obtain data, so as to achieve stable and efficient division of labor data collection. While acquiring data, different anti-climbing mechanisms can also be set according to different channels, which may include: changing User-Agent: different browsers or devices can be simulated to access the target site to reduce the risk of identification; setting delays: random delays can be added between requests to simulate manual browsing behavior and reduce the possibility of triggering machine anti-climbing mechanisms; proxy IP pool: proxy servers can be used to rotate IP addresses when frequently accessing the same network target address; verification code processing: in the case of encountering a graphic verification code, OCR (Optical Character Recognition) technology or a third-party verification code recognition service can be used.

[0038] In the above embodiment, the first attribute data, the first comment data, the first security data of the target object and the target data in the target address can be obtained through the data acquisition system. Figure 4 ,like Figure 4As shown in the figure, the system deploys three servers, which are divided into front-end server, back-end server and crawler server. Among them, the front-end server can include nginx server, static files and file storage, the back-end server can include interface service, data processing service and MySQL database, and the crawler server can include crawler service. The crawler server is connected through a dedicated line, and only the back-end server is allowed to actively send requests to the crawler server. The front-end and back-end of the system are deployed separately, and the front-end server provides services to the outside world, and the back-end server provides interface access for the front-end. The database and files are backed up regularly, and data and files can be restored in time when problems occur. In the later stage, according to the actual situation, the whole environment can adopt a one-master-one-backup deployment mode, and the backup machine is enabled after the main machine goes down. Through the separation of front-end and back-end, reverse proxy and other technologies, load balancing can be achieved and high concurrency can be supported. At the same time, the platform has high security, can encrypt sensitive information, control user permissions, intercept malicious attacks and other capabilities, and has the characteristics of customizability, scalability, high concurrency and high security.

[0039] In the above embodiment, the system can also be unidirectionally connected to the dedicated line of the telecommunications room to ensure data security. The dedicated line of the telecommunications room can adopt a variety of data transmission protocols, which can be TCP / IP, Ethernet, MPLS (Multi-Protocol Label Switching), or SD-WAN (Software Defined Wide Area Network), and the security of data can be enhanced by setting encryption protocols, digital signatures and verification, network segmentation and access control, intrusion detection and prevention systems, etc.

[0040] In the above embodiment, the security level of the target object can be understood as information describing the current security level of the target object, which can include: low security level, medium security level, high security level, relatively high security level, etc., and can be comprehensively judged based on the acquired first attribute data, first comment data, first security data, second attribute data, second comment data and second security data. Through the targeted search of keywords and the comprehensive collection of all target data of the target address, the two collection methods are parallel and can complement each other to ensure the integrity and accuracy of the acquired data.

[0041] Through the present invention, the first attribute data, first comment data and first security data about the target object can be obtained through keyword search, and the target data obtained from the target address can be processed to obtain the second attribute data, second comment data and second security data about the target object. The security level of the target object can be determined based on the first attribute data, the first comment data, the first security data, the second attribute data, the second comment data and the second security data. Since the security level of the target object is determined based on all the collected data, all information about the security of the target object can be covered, so the problem of inaccurate determination of the security situation existing in the related art can be solved, thereby achieving the effect of accurately determining the security situation.

[0042] Optionally, the execution subject of the above steps may be a processor or a server, but is not limited thereto.

[0043] In an exemplary embodiment, the target data is processed to obtain second attribute data, second comment data and second security data of the target object, including: determining object data included in the target data and belonging to the target object; and classifying the object data according to data attributes to obtain the second attribute data, the second comment data and the second security data.

[0044] In the above embodiment, the target data can be processed by the NLP (Neuro-Linguistic Programming, natural language processing) semantic analysis model. The source and type of training data can be public texts, books, news, academic papers, social media, data captured by website crawlers, etc. on the Internet, and the semantic property judgment and semantic degree judgment of the target data are calculated. According to the judgment results, the text sentiment tendency analysis of the target data can be performed, and the sentiment tendency and accuracy grade can be performed on each data. Among them, the semantic property judgment can include positive or negative, and the semantic degree judgment can also include positive or negative.

[0045] In the above embodiment, the object data about the target object included in the target data obtained from the target address is determined, and the second attribute data, second comment data and second security data about the target object are obtained by classification based on the attributes of the object data. Among them, the attributes of the object data may include asset attributes, security attributes, and evaluation attributes, and the evaluation attributes may be judged based on the sentiment tendency evaluation of the text sentiment tendency analysis. For example: the object data may include information that the system of the xx unit has suffered three attacks, information that the xx unit is about to go bankrupt, etc., then the information that the system of the xx unit has suffered three attacks can be attributed to the second security data, and the information that the xx unit is about to go bankrupt can be attributed to the second comment data.

[0046] In an exemplary embodiment, determining the security level of the target object based on the first attribute data, the first comment data, the first security data, the second attribute data, the second comment data and the second security data includes: cleaning the first attribute data and the second attribute data to obtain target attribute data; cleaning the first comment data and the second comment data to obtain target comment data; cleaning the first security data and the second security data to obtain target security data; determining the security level based on the target attribute data, the target comment data and the target security data.

[0047] In the above embodiment, since the data obtained at the target address and the data searched by keywords may have duplication and dirty data, the data needs to be cleaned. The first attribute data and the second attribute data are cleared to obtain the target attribute data; the first comment data and the second comment data are cleaned to obtain the target comment data; the first security data and the second security data are cleaned to obtain the target security data. It can be ensured that the target attribute data, target comment data and target security data obtained after cleaning do not have duplication in the same attribute data.

[0048] In an exemplary embodiment, before determining the security level of the target object based on the first attribute data, the first comment data, the first security data, the second attribute data, the second comment data and the second security data, the method further includes: caching the first attribute data, the first comment data, the first security data, the second attribute data, the second comment data and the second security data in a first database; after cleaning the first security data and the second security data, the method further includes: storing the target attribute data, the target comment data and the target security data in a second database.

[0049] In the above embodiment, the database can design the corresponding fields and parse the data into a database structure for storage. The acquired unprocessed data can be stored in a Redis cache database (i.e., the above first database), and the cleaned data can be stored in a Mysql database (i.e., the above second database). Figure 4, the front-end server can obtain data from Redis in real time, and the back-end server can store the data in the MySQL database, which can avoid data congestion caused by real-time query of data from the database, reduce data pressure, and enable the front-end to respond more quickly. Through regular data cleaning, duplicate data, erroneous data, and incomplete records can be removed to ensure data accuracy and authenticity.

[0050] In an exemplary embodiment, determining the security level based on the target attribute data, the target comment data and the target security data includes: obtaining a first correspondence between predetermined attribute data and attribute scores; determining a target attribute score corresponding to the target attribute data based on the first correspondence; obtaining a second correspondence between predetermined comment data and comment scores; determining a target comment score corresponding to the target comment data based on the second correspondence; obtaining a third correspondence between predetermined security data and security scores; determining a target security score corresponding to the target security data based on the third correspondence; determining a first weight of the target attribute data, determining a second weight of the target comment data, and determining a third weight of the target security data; determining a first product of the first weight and the target attribute score, determining a second product of the second weight and the target comment score, and determining a third product of the third weight and the target security score; and determining the sum of the first product, the second product and the third product as the security level.

[0051] In the above embodiment, according to the requirements of network information security management, a quantitative scoring rule corresponding to the security data (i.e., the above third corresponding relationship) can be established. For example, if the full score is 10, when the problem corresponding to the security data occurs 3 times, the corresponding score is 7, and when the problem corresponding to the security data occurs 9 times, the corresponding score is 1. Based on the assessment requirements set internally by different target objects, the first corresponding relationship between the attribute data and the attribute score, the third corresponding relationship between the security data and the security score, the first weight of the target attribute data, the second weight of the target comment data, and the third weight of the target security data can be determined, and the first product of the first weight and the target attribute score, the second product of the second weight and the target comment score, and the third product of the third weight and the target security score are calculated respectively, and the sum of the first product, the second product, and the third product is determined as the security level. Among them, the assessment requirements set internally by the target object will continue to be adjusted according to the business indicators, so the first corresponding relationship, the second corresponding relationship, the third corresponding relationship, the first weight, the second weight, and the third weight will also change accordingly.

[0052] In the above embodiment, Figure 5 This is the functional architecture diagram of the security level perception management system platform, such as Figure 5 As shown, the risk rule management module under the security incident analysis module can flexibly formulate different weight coefficients and corresponding calculation formulas according to the assessment requirements set within the target object, and can calculate the security level of different target objects. Among them, the security incident analysis module can also include: terminal management, APT weak passwords, self-service equipment, U disk management, sensitive information leakage prevention, behavior investigation management, Internet management, VPN management, and vulnerability summary management. Figure 3 As shown, the risk rule management module can automatically customize the information security model layer in the model library according to the needs: according to the requirements of network information security management, the relevant institutional and business security situation scoring model can be established, the scoring table can be designed and quantitative evaluation and assessment can be carried out (i.e. corresponding to the third corresponding relationship mentioned above); quantitative evaluation models of different dimensions can be carried out according to the assessment requirements set within the target object; evaluation and security policy models can also be established according to the provisions of the security disposal strategy; relevant model engines can also be established and embedded in the system process to realize active management, early warning, automatic disposal and blocking of information security. Identity authentication can use the Shiro security framework to control user permissions, realize the login of the Uass unified authentication system, and divide the permissions and roles of various functions of the system according to the relationship between employees and organizations. In this embodiment, the management platform can also include: system management module, task management module, approval management module, risk management module, public opinion monitoring module, and Internet exposure information module. Among them, the system management module can include employee management, role management, organization management, menu management, scheduled task log, and parameter setting modules; the task management module can include task issuance, my tasks, task templates, and task reminder modules; the approval management module can include pending processes, completed processes, my processes, process templates, process management, and employee ongoing processes modules; the risk management module can include risk issuance, risk events, and risk template modules.

[0053] In an exemplary embodiment, after determining the security level of the target object based on the target scoring data, the method further includes: performing an alarm operation when the security level exceeds a preset level.

[0054] In the above embodiment, the target scoring data can be understood as the target attribute score, the target comment score and the target security score. The security level of the target object can be determined based on the target scoring data. When the security level exceeds the preset level, an alarm signal will be automatically triggered to remind relevant personnel to take corresponding management measures, wherein the preset level can be a low security level, a medium security level, or a level between a low security level and a medium security level, etc. In this embodiment, when various potential risks are detected, alarm reminders can be sent to relevant personnel in a timely manner through SMS, email, etc. For example, when negative hot sensitive public opinion information about the target object is detected, the information can be sent to relevant personnel.

[0055] In the above embodiment, the preset level for triggering the alarm can be adapted and adjusted according to the alarm rules of the target business. In the alarm event platform, the alarm details are matched with tags or keywords, which are automatically associated with the handling script in the operation and maintenance toolbox to realize the alarm and linkage processing of the fault, which is more flexible than the threshold of the monitoring alarm of the traditional monitoring tool. Example: The alarm information content can be that there is a process on the xx platform xx that needs to be reviewed. Please log in to the system to view similar business reminders of xxxx. It can be routed through the unified communication platform. When the system platform detects various potential risks and requires manual assistance from relevant users to locate and eliminate them, SMS / emails can be sent to relevant personnel in a timely manner. Intelligent handling solves the false alarms and missed alarms of monitoring alarms. Relevant personnel can quickly locate the fault through the log information of the automation tool (query of the top ten processes occupying memory), and then execute the corresponding memory reduction script tool with one click to quickly handle the memory alarm, which can improve the intelligence level and timeliness of monitoring. The platform can adopt 7*24 hours network monitoring, and monitoring events can be reached through multiple channels and methods such as voice, SMS, and email. At the same time, it can match related assets, automatically integrate and suppress events, and perform preliminary analysis, judgment, filtering and disposal of alarm matters. The platform can break the data barriers of different technology management systems, integrate basic heterogeneous data such as institutional information, employee information, terminal data, application system data, behavior logs, special permissions, etc., and provide managers at all levels of institutions with a more sophisticated, complete and intuitive technology risk management platform based on management.

[0056] In an exemplary embodiment, after processing the target data to obtain the second attribute data, second comment data and second security data of the target object, the method further includes: performing statistical analysis on the first attribute data and the second attribute data to obtain target statistical attribute data; performing statistical analysis on the first comment data and the second comment data to obtain target statistical comment data; performing statistical analysis on the first security data and the second security data to obtain target statistical security data; determining a first ranking of the target statistical attribute data in the statistical attribute data, wherein the statistical attribute data is data determined based on the attribute data of other objects; determining a second ranking of the target statistical comment data in the statistical comment data, wherein the statistical comment data is data determined based on the comment data of other objects; determining a third ranking of the target statistical security data in the statistical security data, wherein the statistical security data is data determined based on the security data of other objects; and in the event that there is a target ranking that meets a predetermined condition among the first ranking, the second ranking and the third ranking, displaying the data corresponding to the target ranking in the target interface.

[0057] In the above embodiment, the target statistical attribute data may be the number of times the first attribute data and the second attribute data are jointly counted, the target statistical comment data may be the number of times the first comment data and the second comment data are jointly counted, and the target statistical security data may be the number of times the first security data and the second security data are jointly counted. The first ranking of the target statistical attribute data in the attribute data of other objects, the second ranking of the target statistical comment data in the comment data of other objects, and the third ranking of the target statistical security data in the security data of other objects are respectively determined. When there is a target ranking that meets the predetermined conditions in the first ranking, the second ranking, and the third ranking, the data corresponding to the target ranking can be displayed in the target interface. Among them, the target interface can be a computer interface, or it can be any device with a visual interface such as a projection interface. The predetermined condition can be data with the target ranking as TOP1, or data with TOP3, but is not limited to this.

[0058] In the above embodiment, the overall situation and ranking of the science and technology risk indicator data of the target object and other objects can be displayed through highly customized data visualization charts. The visualization system can be integrated into the homepage of the system platform to dynamically and real-time reflect the development trend of various risk items, and provide a multi-dimensional, timely and quantitative comprehensive rating evaluation and detailed full data for the security situation, so as to effectively carry out risk perception warning and early risk disposal, enhance user experience, quickly achieve the expected visualization effect, and facilitate system operation users to quickly locate various current risk warning information, so as to facilitate fast and efficient processing. Example: TOP 5 special terminal permissions, TOP 5 USB file export times, TOP 5 anti-virus client upgrade rate, TOP 5 Internet sensitive information interception times, TOP 5 employee customer information query times, TOP 5 weak password login times, TOP 5 virus detection times, etc. The platform can be used to centrally display risks and strengthen the "machine control" management of offline production data use. For example, if an employee applies for the use rights of offline production data for work, the platform can track the employee's terminal special permissions, mailbox outbound situations, Internet behavior logs and other matters, and comprehensively analyze and judge the leakage risk of production data. It is also possible to sort, split, summarize and display the existing multiple management-related detailed data. Through the data report function, the detailed data can be sorted and split into the notification data of each agency; the data screening model can be set to form the data items that need to be focused on; the data in different tables can be compared to form data details that are convenient for notification; weight values ​​can be set for each notification data to obtain the comprehensive score of each agency and conduct ranking assessment.

[0059] In the above embodiment, the hot words of data obtained from different channels can be highlighted, and the table chart showing the number of dates in the past 7 days, the bar chart showing the number of public opinion sentiments in the past 7 days, and the pie chart showing the proportion of information in each channel in the past 7 days can be displayed by date, channel, quantity, positive / negative, proportion, accuracy and other dimensions. The form configuration function for the display mode of negative information monitoring can also be set, and personalized display can be performed by checking different chart types. It is also possible to customize line charts (area charts), bar charts (bar charts), scatter charts (bubble charts), K-line charts, pie charts (ring charts), radar charts (filled radar charts), chord charts, force-oriented layout charts, maps, dashboards, funnel charts, event river charts and other 12 types of charts through Echarts software, and provide titles, details bubbles, legends, value domains, data areas, timelines, toolboxes and other 7 interactive components, supporting the linkage and mix-and-match display of multiple charts and components. It is also possible to achieve multi-channel and multi-dimensional real-time display through a single connection through a dedicated line in the telecommunications room. Multi-channel can be understood as referring to data from major platforms such as Weibo, Toutiao, Xinhuanet, and People's Daily Online; multi-dimensional can be understood as date, channel, quantity, positive / negative, proportion, accuracy, etc.; for the cached data crawled by the crawler program deployed in the telecommunications room, the platform can read it unidirectionally once every four hours and request it back for updates.

[0060] In an exemplary embodiment, the application architecture diagram of the security level perception system platform can be found in Figure 6 ,like Figure 6As shown in the figure, the system can realize flexible parameter configuration and management through parameter control, such as customized development of front-end interface, operation process configuration, parameterized configuration of back-end product components, etc., including system general parameters and business function parameters, log parameters, URL parameter routing, template parameters, database parameters, etc. With target attribute data, target comment data, and target security data as data sets, network security confrontation as the core, and RPA intelligent robots as process engines, the basic framework of information security data layer, model layer, application layer, security layer and visual display layer is built, which can realize the development and application of various information security related functions, integrate information security capabilities, and manage all information security work; build comprehensive management affairs such as information technology risk prevention and control, process approval, instruction issuance, public opinion monitoring, and proactively manage the technological risks of various institutions. Complete the full process, automation, and intelligent machine control and collaborative linkage of network security incident handling, realize active defense, comprehensive monitoring, intelligent analysis, accurate response, and rapid disposal of security operation mechanisms, and effectively respond to network attacks. Among them, the RPA robot workflow can include demand analysis, design and development, configuration and testing, approval and deployment, monitoring and maintenance, setting parameters, submitting applications, and starting robots. You can use scheduled task monitoring to capture specific task threads, and verify each form element according to specific business needs to trigger RPA automated approval. In addition, since RPA calls the batch processing interface through batch capture tasks, it does not interfere with manual approval. When RPA reports an error, manual approval will temporarily intervene.

[0061] In the above embodiment, the system can enhance the target object's security situation assessment, data analysis and early warning processing capabilities, and further enhance the level of refinement of scientific and technological risk management, judge and warn of the current network and possible threats that will appear in the future, timely discover security threats hidden in its network, and achieve early and rapid discovery of threatening malicious behaviors, accurately locate the victim and the source of the attack, and trace the intrusion path and the background of the attacker. It can solve the security problems in the enterprise network from the source and help to take preventive measures for network security.

[0062] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for enabling a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0063] In this embodiment, a device for determining the security level of an object is also provided, and the device is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. As used below, the term "module" can implement a combination of software and / or hardware of a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0064] Figure 7 is a structural block diagram of a device for determining an object security level according to an embodiment of the present invention. Figure 7 As shown, the device includes

[0065] A first acquisition module 72, used to acquire first attribute data, first comment data and first security data about a target object obtained by searching for a keyword;

[0066] A second acquisition module 74, used to acquire target data included in the target address;

[0067] A processing module 76, configured to process the target data to obtain second attribute data, second comment data and second security data of the target object;

[0068] The determination module 78 is used to determine the security level of the target object based on the first attribute data, the first comment data, the first security data, the second attribute data, the second comment data and the second security data.

[0069] In an exemplary embodiment, the processing module 76 can process the target data to obtain the second attribute data, second comment data and second security data of the target object in the following manner: determine the object data included in the target data and belonging to the target object; classify the object data according to data attributes to obtain the second attribute data, the second comment data and the second security data.

[0070] In an exemplary embodiment, the determination module 78 can determine the security level of the target object based on the first attribute data, the first comment data, the first security data, the second attribute data, the second comment data and the second security data in the following manner: clean the first attribute data and the second attribute data to obtain target attribute data; clean the first comment data and the second comment data to obtain target comment data; clean the first security data and the second security data to obtain target security data; determine the security level based on the target attribute data, the target comment data and the target security data.

[0071] In an exemplary embodiment, the device can also be used to cache the first attribute data, the first comment data, the first security data, the second attribute data, the second comment data and the second security data in a first database before determining the security level of the target object based on the first attribute data, the first comment data, the first security data, the second attribute data, the second comment data and the second security data; the device can also be used to store the target attribute data, the target comment data and the target security data in a second database after cleaning the first security data and the second security data.

[0072] In an exemplary embodiment, the determination module 78 can determine the security level based on the target attribute data, the target comment data and the target security data in the following manner: obtain a first correspondence between predetermined attribute data and attribute scores; determine the target attribute score corresponding to the target attribute data based on the first correspondence; obtain a second correspondence between predetermined comment data and comment scores; determine the target comment score corresponding to the target comment data based on the second correspondence; obtain a third correspondence between predetermined security data and security scores; determine the target security score corresponding to the target security data based on the third correspondence; determine a first weight of the target attribute data, determine a second weight of the target comment data, and determine a third weight of the target security data; determine a first product of the first weight and the target attribute score, determine a second product of the second weight and the target comment score, and determine a third product of the third weight and the target security score; and determine the sum of the first product, the second product and the third product as the security level.

[0073] In an exemplary embodiment, the device may also be used to, after determining the security level of the target object based on the target rating data, perform an alarm operation when the security level exceeds a preset level.

[0074] In an exemplary embodiment, the device can also be used to, after processing the target data to obtain the second attribute data, second comment data and second security data of the target object: perform statistical analysis on the first attribute data and the second attribute data to obtain target statistical attribute data; perform statistical analysis on the first comment data and the second comment data to obtain target statistical comment data; perform statistical analysis on the first security data and the second security data to obtain target statistical security data; determine a first ranking of the target statistical attribute data in the statistical attribute data, wherein the statistical attribute data is data determined based on the attribute data of other objects; determine a second ranking of the target statistical comment data in the statistical comment data, wherein the statistical comment data is data determined based on the comment data of other objects; determine a third ranking of the target statistical security data in the statistical security data, wherein the statistical security data is data determined based on the security data of other objects; and if there is a target ranking that meets a predetermined condition among the first ranking, the second ranking and the third ranking, display the data corresponding to the target ranking in the target interface.

[0075] It should be noted that the above modules can be implemented by software or hardware. For the latter, it can be implemented in the following ways, but not limited to: the above modules are all located in the same processor; or the above modules are located in different processors in any combination.

[0076] An embodiment of the present invention further provides a computer-readable storage medium, in which a computer program is stored, wherein the computer program is configured to execute the steps of any of the above method embodiments when running.

[0077] In an exemplary embodiment, the computer-readable storage medium may include, but is not limited to, various media that can store computer programs, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk.

[0078] An embodiment of the present invention further provides an electronic device, including a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0079] In an exemplary embodiment, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0080] An embodiment of the present invention further provides a computer program product, including a computer program, which implements the steps of the method in each embodiment of the present application when the computer program is executed by a processor.

[0081] For specific examples in this embodiment, reference may be made to the examples described in the above embodiments and exemplary implementation modes, and this embodiment will not be described in detail herein.

[0082] Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by a general computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in a different order than here, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present invention is not limited to any specific combination of hardware and software.

[0083] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for determining the security level of an object, characterized in that: include: Acquire first attribute data, first comment data, and first security data about the target object obtained by searching the keyword; Obtain target data included in the target address; Processing the target data to obtain second attribute data, second comment data and second security data of the target object; A security level of the target object is determined based on the first attribute data, the first comment data, the first security data, the second attribute data, the second comment data, and the second security data.

2. The method according to claim 1, characterized in that Processing the target data to obtain second attribute data, second comment data, and second security data of the target object includes: determining object data included in the target data and belonging to the target object; The object data is classified according to data attributes to obtain the second attribute data, the second comment data and the second security data.

3. The method according to claim 1, characterized in that Determining the security level of the target object based on the first attribute data, the first comment data, the first security data, the second attribute data, the second comment data, and the second security data includes: Cleaning the first attribute data and the second attribute data to obtain target attribute data; Cleaning the first comment data and the second comment data to obtain target comment data; Cleaning the first security data and the second security data to obtain target security data; The security level is determined based on the target attribute data, the target comment data, and the target security data.

4. The method according to claim 3, characterized in that Before determining the security level of the target object based on the first attribute data, the first comment data, the first security data, the second attribute data, the second comment data, and the second security data, the method further includes: caching the first attribute data, the first comment data, the first security data, the second attribute data, the second comment data, and the second security data in a first database; After cleaning the first security data and the second security data, the method further includes: storing the target attribute data, the target comment data and the target security data in a second database.

5. The method according to claim 3, characterized in that: Determining the security level based on the target attribute data, the target comment data, and the target security data includes: Acquire a first correspondence between predetermined attribute data and attribute scores; Determine a target attribute score corresponding to the target attribute data based on the first corresponding relationship; Obtaining a second correspondence between predetermined review data and review scores; Determine a target review score corresponding to the target review data based on the second corresponding relationship; Obtaining a third correspondence between predetermined safety data and a safety score; Determine a target safety score corresponding to the target safety data based on the third corresponding relationship; determining a first weight of the target attribute data, determining a second weight of the target comment data, and determining a third weight of the target security data; Determining a first product of the first weight and the target attribute score, determining a second product of the second weight and the target review score, and determining a third product of the third weight and the target safety score; A sum of the first product, the second product, and the third product is determined as the security level.

6. The method according to claim 1, characterized in that After determining the safety level of the target object based on the target scoring data, the method further includes: When the security level exceeds a preset level, an alarm operation is performed.

7. The method according to claim 1, characterized in that After processing the target data to obtain the second attribute data, the second comment data and the second security data of the target object, the method further includes: Performing statistical analysis on the first attribute data and the second attribute data to obtain target statistical attribute data; Performing statistical analysis on the first comment data and the second comment data to obtain target statistical comment data; Performing statistical analysis on the first safety data and the second safety data to obtain target statistical safety data; Determining a first ranking of the target statistical attribute data in the statistical attribute data, wherein the statistical attribute data is data determined based on attribute data of other objects; Determining a second ranking of the target statistical comment data in the statistical comment data, wherein the statistical comment data is data determined based on comment data of other objects; Determining a third ranking of the target statistical safety data in the statistical safety data, wherein the statistical safety data is data determined based on safety data of other objects; When there is a target sorting satisfying a predetermined condition among the first sorting, the second sorting, and the third sorting, data corresponding to the target sorting is displayed in a target interface.

8. A device for determining the security level of an object, characterized in that: include: A first acquisition module, used to acquire first attribute data, first comment data and first security data about a target object obtained by searching for a keyword; A second acquisition module, used for acquiring target data included in the target address; A processing module, used for processing the target data to obtain second attribute data, second comment data and second security data of the target object; A determination module is used to determine the security level of the target object based on the first attribute data, the first comment data, the first security data, the second attribute data, the second comment data and the second security data.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the computer program is configured to execute the method according to any one of claims 1 to 7 when executed.

10. An electronic device comprising a memory and a processor, characterized in that: A computer program is stored in the memory, and the processor is configured to run the computer program to perform the method according to any one of claims 1 to 7.

Images