Industrial internet data security protection capability assessment method and system

Abstract

The invention discloses an industrial internet data security protection capability assessment method and system, and relates to the technical field of industrial internet data security, and the main scheme is as follows: a data collection module collects and integrates historical policy execution log data, historical vulnerability repair data and historical network traffic data in an industrial internet environment; the data analysis module analyzes the historical data to obtain a security policy execution rate, a vulnerability repair timeliness rate and an illegal access interception rate, and the data evaluation module calculates a data leakage risk index according to the analysis data, judges whether to trigger early warning or not and generates a protection instruction; the adjustment and optimization module calculates system potential assessment indexes according to historical data and all indexes, a preset threshold set judges the system security level, the user interaction module receives the data to generate various charts and risk assessment reports, related personnel are notified in the modes of mails and the like, and comprehensive support is provided for improving the industrial internet data security protection capacity.

Description

Technical Field

[0001] The present invention relates to the field of industrial Internet data security technology, and specifically to an industrial Internet data security protection capability assessment method and system. Background Art

[0002] In the existing technology, some traditional methods are mainly used for early warning monitoring of industrial Internet data security. On the one hand, some enterprises rely on simple network traffic monitoring tools to determine whether there may be data security problems by analyzing abnormal changes in network traffic. On the other hand, some enterprises use conventional vulnerability scanning software to regularly detect vulnerabilities in the system. Once a new vulnerability is found, a reminder will be issued for timely repair. However, this method has a certain lag, because vulnerability scanning is usually performed at a certain time interval. New vulnerabilities may be exploited by attackers between two scans, but the enterprise cannot know in time; The existing industrial Internet data security early warning and monitoring technology still has some defects: the existing technology lacks comprehensive analysis of historical data, only focuses on current network traffic and vulnerabilities, and cannot summarize laws and trends from historical data, making it difficult to accurately predict data security risks that may arise in the future; Existing technologies do not monitor security policy execution comprehensively enough and cannot effectively evaluate the actual implementation effect of security policies, resulting in some security policies being formulated but not truly implemented, thus increasing the risk of data leakage; Existing technologies have limited capabilities in intercepting illegal access, and it is difficult to accurately identify and intercept various new types of illegal access methods. In particular, with the continuous advancement of hacker technology, traditional illegal access interception methods are increasingly unable to cope with complex and changing security threats; Existing technologies need to be improved in terms of accuracy and timeliness of early warnings. Alarms are often issued only after a data security incident has occurred or caused certain losses. It is impossible to issue timely warnings when risks just appear, causing great losses and risks to enterprises. Summary of the invention

[0003] 1. Technical issues to be resolved In view of the shortcomings of the existing technology, the present invention provides an industrial Internet data security protection capability assessment method and system, which integrates historical policy execution, vulnerability repair and network traffic data in real time through the data acquisition module to ensure the comprehensiveness and real-time nature of the data and solve the problem of comprehensive data acquisition; deeply analyze the collected data and calculate the security policy execution rate , Timely rate of vulnerability repair And illegal access interception rate , providing a solid quantitative basis for risk assessment; calculating the data leakage risk index based on the above indicators , assess the risk level, and trigger an early warning once the threshold is reached, solving the problem of inaccurate risk assessment; by adjusting the optimization module, calculate the system security assessment index , which solves the problem of poor overall protection capability of the system; the user interaction module displays data graphs in real time, generates risk assessment reports, and notifies relevant personnel through multiple channels, solving the problem of invalid information communication; (II) Technical solution To achieve the above objectives, the present invention is implemented through the following technical solutions: an industrial Internet data security protection capability evaluation system, comprising: The data collection module is used to collect historical policy execution log data, historical vulnerability repair data, and historical network traffic data from the industrial Internet environment and integrate them into a valid data set; The data analysis module is used to receive valid data sets, analyze historical policy execution log data, historical vulnerability repair data, and historical network traffic data, and obtain the security policy execution rate. , Timely rate of vulnerability repair And illegal access interception rate ; The data evaluation module is used to receive the analysis data from the data analysis module and , Timely rate of vulnerability repair And illegal access interception rate , calculate the data leakage risk index , determine whether to trigger a data leakage risk warning and generate protection instructions; Adjust the optimization module based on historical data and security policy execution rate , Timely rate of vulnerability repair , Illegal access interception rate and data breach risk index , Computing System Security Assessment Index , preset system security assessment index threshold set , according to the system security assessment index and system security assessment index threshold set Determine the system security level; The user interaction module is used to receive the optimization data from the data analysis module and the adjustment and optimization module, generate a risk level prediction line graph, a security policy execution rate bar graph, a vulnerability repair timeliness rate pie chart, an illegal access interception rate line graph and a security level assessment graph, and generate a risk assessment report, which is sent to relevant personnel via email, SMS or system notification.

[0004] In the preferred solution of the above industrial Internet data security protection capability evaluation system: the working steps of the data acquisition module are: Obtain the total number of historical execution strategies within a unit time period through historical strategy execution log data 、Historical execution success rate And historical execution time efficiency ; Obtain the total number of historical security vulnerabilities within a unit time period through historical vulnerability repair data , Historical vulnerability discovery time And historical vulnerability repair time points ; Based on the historical data of security monitoring, historical network traffic data is obtained. The historical network traffic data includes the number of interceptions of historical illegal access within a unit time period. And the number of historical illegal accesses successfully detected in a unit time period .

[0005] In the preferred scheme of the above industrial Internet data security protection capability evaluation system: Calculate the security policy execution rate The method is: According to the total number of historical execution strategies 、Historical execution success rate And historical execution time efficiency , calculate the security policy execution rate , the calculation formula is as follows: ; in, It is The success rate of executing the strategy, It is the sequence number of the execution strategy, and its value is 1, 2, 3, 4. The value range is >0; It is The execution time efficiency of each strategy, The value range is >0; Indicates The importance weight of the execution strategy is in the range of ≥0.

[0006] In the preferred scheme of the above industrial Internet data security protection capability evaluation system: Calculate the vulnerability repair timeliness rate The specific steps are: Set the maximum allowed repair time for each vulnerability ; Based on the total number of historical security vulnerabilities , Historical vulnerability discovery time , Historical vulnerability repair time points and the maximum allowable repair time , calculate vulnerability repair timeliness rate , the specific formula is as follows: ; in, It is The time point when the vulnerability is discovered is taken as >0; It is The time point when the vulnerability is fixed, the value is >0; It is the serial number of the vulnerability discovery, with values ​​of 1, 2, and 3; the total number of security vulnerabilities >0, Indicates An indicator of a successful vulnerability fix. If it was successfully repaired before, =1, otherwise, =0.

[0007] In the preferred scheme of the above industrial Internet data security protection capability evaluation system: Calculate the illegal access interception rate The specific steps are: According to the number of interceptions of historical illegal access and historical illegal access times , calculate the illegal access interception rate The specific formula is as follows: ; Among them, the number of historical illegal accesses detected The value range is a positive integer.

[0008] In the preferred scheme of the above industrial Internet data security protection capability evaluation system: Calculate the data leakage risk index The specific steps are: Get the total number of real-time vulnerabilities And real-time illegal access count ; According to the security policy execution rate , Timely rate of vulnerability repair , Illegal access interception rate , Total number of real-time strategies , the total number of real-time vulnerabilities And real-time illegal access count , calculate the data leakage risk index The specific formula is as follows: ; in, Security policy execution rate The weight coefficient is 0≤ ≤0.4, Timely rate of vulnerability repair The weight coefficient is 0.1≤ ≤0.5, Block rate for illegal access The weight coefficient is 0.2≤ ≤0.5, and + + =1.

[0009] In the preferred solution of the above industrial Internet data security protection capability evaluation system: the specific steps of determining whether to trigger a data leakage risk warning and generating a protection instruction are: Set the data leakage risk index threshold set , the data leakage risk index threshold set F includes the normal risk threshold , first level threshold , Secondary threshold and the third threshold ,in, < < < ; When the data leakage risk index ≤ When the data leakage risk warning is triggered, when <Data leakage risk index ≤ When a data breach occurs, a first-level data breach risk warning is triggered and a primary protection instruction is generated; when <Data leakage risk index ≤ When a second-level data leakage risk warning is triggered, an intermediate protection instruction is generated; when <Data leakage risk index ≤ When a third-level data leakage risk warning is triggered, an advanced protection instruction is generated.

[0010] In the preferred scheme of the above industrial Internet data security protection capability evaluation system: the steps for determining the system security level are as follows: Get the ideal security policy execution rate based on historical data , Timely rate of target vulnerability repair And the maximum illegal access interception rate ; According to the ideal security policy execution rate and security policy execution rate , calculate the potential for improving security policy execution rate , the calculation formula is as follows: ; Timely repair rate based on target vulnerabilities And the timeliness of vulnerability repair , calculate the potential for improving the timeliness of vulnerability repair , the calculation formula is as follows: ; According to the maximum illegal access interception rate And illegal access interception rate , calculate the potential for improving the illegal access interception rate , the calculation formula is as follows: ; Among them, the ideal security policy execution rate The value range is >0; Timely rate of target vulnerability repair The value range is >0; Maximum illegal access interception rate The value range is >0; According to the data breach risk index , Potential for improving security policy execution rate , Potential for improving the timeliness of vulnerability repair And the potential to improve the illegal access interception rate , Computing System Security Assessment Index The specific formula is as follows: ; in, Represents the optimization coefficient of the overall control, and its value range is >0; Security policy execution rate The weight coefficient is 0.2≤ ≤0.3, Timely rate of vulnerability repair The weight coefficient is 0.2≤ ≤0.4, Block rate for illegal access The weight coefficient is 0.3≤ ≤0.5, and + + =1; System security assessment index threshold set Includes normal risk threshold , primary threshold , Intermediate Threshold and Advanced Thresholds ,in, < < < ; When the system security assessment index ≤ , it means no risk; when <System Security Assessment Index ≤ When , the security level is low risk; when <System Security Assessment Index ≤ When , the security level is medium risk; when <System Security Assessment Index ≤ , the security level is high risk.

[0011] In the preferred solution of the above industrial Internet data security protection capability evaluation system: the specific steps of the user interaction module are: Mark the data leakage risk index on the risk level prediction line chart ;Mark the security policy execution rate on the security policy execution rate bar chart ;Mark the vulnerability repair timeliness rate on the vulnerability repair timeliness rate pie chart ; Mark the illegal access interception rate on the illegal access interception rate line chart ; Mark the system safety assessment index on the safety level assessment chart ; Comprehensive data and risk level prediction line chart, security level assessment chart, data leakage risk index and system security assessment index , generate an assessment report and send it via email, SMS and system notification channels.

[0012] The present invention also discloses an industrial Internet data security protection capability evaluation method, which is used to implement the above industrial Internet data security protection capability evaluation system, and includes the following contents: Step 1: Collect policy execution log data, vulnerability repair data, and network traffic data from the industrial Internet environment and integrate them into a valid data set; Step 2: Analyze the policy execution log data, vulnerability repair data, and network traffic data in the valid data set to obtain the security policy execution rate. , Timely rate of vulnerability repair And illegal access interception rate ; Step 3: According to the security policy execution rate , Timely rate of vulnerability repair And illegal access interception rate , calculate the data leakage risk index , determine whether to trigger a data leakage risk warning and generate protection instructions; Step 4: Based on historical data and security policy execution rate , Timely rate of vulnerability repair , Illegal access interception rate and Data Breach Risk Index , computing system potential assessment index , preset system security assessment index threshold set , according to the system security assessment index Determine the system security level; Step 5: Integrate the data to generate a risk level prediction line graph, a security policy execution rate bar graph, a vulnerability repair timeliness rate pie chart, an illegal access interception rate line graph, and a security level assessment graph, and generate a risk assessment report, which will be sent to relevant personnel via email, SMS, or system notification.

[0013] (III) Beneficial effects The present invention provides an industrial Internet data security protection capability assessment method and system, which has the following beneficial effects: (1) Data collection module: collects historical policy execution log data, historical vulnerability repair data, and historical network traffic data from the industrial Internet environment, integrates them into effective data sets, and comprehensively collects various key data to provide sufficient data basis for subsequent analysis and evaluation, ensuring that no important information sources are missed, and can more accurately reflect the security status of the industrial Internet. By integrating data, different types of data can be processed centrally, improving data availability and management efficiency; (2) Data analysis module: receives valid data sets from the data collection module, analyzes historical policy execution log data, historical vulnerability repair data, and historical network traffic data, and calculates the security policy execution rate. , Timely rate of vulnerability repair And illegal access interception rate , special analysis of different types of data can accurately quantify the security performance of the Industrial Internet in different aspects, provide specific indicators for evaluating the overall security status, and help enterprises quickly understand the advantages and disadvantages of their own security management so as to make targeted improvements; (3) Data evaluation module, which receives the analysis data from the data analysis module and evaluates the security policy execution rate. , Timely rate of vulnerability repair And illegal access interception rate Calculate the data breach risk index , determine whether to trigger a data leakage risk warning and generate protection instructions. By calculating the risk index through multiple indicators, the risk level of data leakage can be assessed more comprehensively and accurately. Timely risk warnings can allow enterprises to take measures to reduce losses before data security incidents occur. The generated protection instructions provide enterprises with specific response strategies and improve the efficiency of security protection; (4) Adjust the optimization module based on historical data and security policy execution rate , Timely rate of vulnerability repair , Illegal access interception rate and Data Breach Risk Index , Computing System Security Assessment Index , preset system security assessment index threshold set , according to the system security assessment index Determine the system security level and calculate the system potential assessment index by integrating various data. This can help enterprises understand the system's improvement potential and security improvement space, provide a reference for formulating long-term security strategies, and determine the security level through a set of preset thresholds, so that enterprises can clearly understand the current security status of the system and reasonably allocate resources for security protection. (5) User interaction module: receives the optimization data from the data analysis module and the adjustment and optimization module, generates a risk level prediction line graph, a security policy execution rate bar graph, a vulnerability repair timeliness rate pie chart, an illegal access interception rate line graph, and a security level assessment graph, and generates a risk assessment report, which is sent to relevant personnel via email, SMS or system notification. It displays the security status in an intuitive graphical form, making it easier for relevant personnel of the enterprise to quickly understand and grasp the security situation of the system, thereby improving the efficiency and accuracy of information communication. It generates a risk assessment report and notifies relevant personnel in a variety of ways to ensure timely information delivery, facilitate decision-making by enterprise management, and increase the company's attention and participation in data security. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 It is a flow chart of the industrial Internet data security protection capability assessment method of the present invention. DETAILED DESCRIPTION

[0015] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0016] See also Figure 1 The present invention provides an industrial Internet data security protection capability evaluation system, including: The data collection module is used to collect historical policy execution log data, historical vulnerability repair data, and historical network traffic data from the industrial Internet environment and integrate them into a valid data set; Specifically, historical policy execution log data, which includes the total number of historical policy executions within a unit time period. 、Historical execution success rate And historical execution time efficiency ; Historical vulnerability repair data, including the total number of historical vulnerabilities found in a unit time period , Historical vulnerability discovery time And historical vulnerability repair time points ; Historical network traffic data, including the number of illegal accesses actually intercepted in a unit time period And the number of historical illegal accesses successfully detected in a unit time period ; The data analysis module is used to receive valid data sets, analyze historical policy execution log data, historical vulnerability repair data, and historical network traffic data, and obtain the security policy execution rate. , Timely rate of vulnerability repair And illegal access interception rate ; Specifically, after the data analysis module receives the valid data set from the data collection module, it conducts in-depth analysis of three types of core data: historical policy execution log data, historical vulnerability repair data, and historical network traffic data, and can accurately calculate the security policy execution rate. , evaluate the effectiveness of security policy implementation, and accurately measure the timeliness of vulnerability repairs , reflects the system's response speed and repair capabilities to security vulnerabilities. In addition, the number of illegal accesses actually intercepted in a unit time period is And the number of illegal accesses successfully detected in a unit time period , calculate the illegal access interception rate , effectively evaluate the system’s defense capabilities against cyber attacks; The data evaluation module is used to receive the analysis data from the data analysis module and , Timely rate of vulnerability repair And illegal access interception rate , calculate the data leakage risk index , determine whether to trigger a data leakage risk warning and generate protection instructions; Specifically, the data evaluation module receives the various security indicator data output by the data analysis module, including the security policy execution rate , Timely rate of vulnerability repair And illegal access interception rate ; Further, the data leakage risk index is calculated ,This index is a comprehensive quantitative representation of the data leakage risk currently faced by the system. The data assessment module will also determine whether to trigger the data leakage risk warning mechanism based on the preset risk warning threshold, and generate corresponding protection instructions when necessary to guide the system or management personnel to take emergency measures to reduce risks; Adjust the optimization module based on historical data and security policy execution rate , Timely rate of vulnerability repair , Illegal access interception rate and data breach risk index , Computing System Security Assessment Index , preset system security assessment index threshold set , according to the system security assessment index and system security assessment index threshold set Determine the system security level; Specifically, the adjustment and optimization module comprehensively considers historical data, security policy execution rate, , Timely rate of vulnerability repair , Illegal access interception rate and Data Breach Risk Index Multiple dimensions to calculate the computing system security assessment index ; Furthermore, through the preset system security assessment index threshold set ,This module can automatically determine the current security level of the system and make targeted optimization suggestions. These suggestions may include adjusting security strategies, increasing vulnerability repair efforts, and optimizing network defense mechanisms, etc., aiming to continuously improve the overall security protection capabilities of the system; The user interaction module is used to receive the optimization data from the data analysis module and the adjustment and optimization module, generate a risk level prediction line chart, a security policy execution rate bar chart, a vulnerability repair timeliness rate pie chart, an illegal access interception rate line chart and a security level assessment chart, and generate a risk assessment report, which is sent to relevant personnel via email, SMS or system notification; Specifically, receiving optimization data and evaluation results from the data analysis module and the adjustment optimization module; Furthermore, it generates risk level prediction line graph, security policy execution rate bar graph, vulnerability repair timeliness rate pie chart, illegal access interception rate line graph and security level assessment graph to help users fully understand the security performance and potential risks of the system; Furthermore, the module automatically generates risk assessment reports and sends them to designated relevant personnel in a timely manner through various means such as email, text message or internal system notification, ensuring that they can obtain important safety information in a timely manner and take corresponding actions.

[0017] In the preferred scheme of the above industrial Internet data security protection capability evaluation system: Calculate the security policy execution rate The method is: According to the total number of historical execution strategies 、Historical execution success rate And historical execution time efficiency , calculate the security policy execution rate , the calculation formula is as follows: ; in, It is The success rate of executing the strategy, It is the sequence number of the execution strategy, and its value is 1, 2, 3, 4. The value range is >0; It is The execution time efficiency of each strategy, The value range is >0; Indicates The importance weight of the execution strategy is in the range of ≥0; It should be noted that the operating principle of the present invention is: first, for each execution strategy , calculate the product of its weighted success rate and execution time efficiency ,This product takes into account the success rate, execution efficiency and importance of the strategy; Furthermore, the above products of all strategies are summed up to obtain the comprehensive effect value of all strategies ; Furthermore, in order to obtain the security policy execution rate , divide the above comprehensive effect value by the product of the sum of the importance weights of all strategies and the number of strategies , and multiply by To convert to percentage form, the denominator in the original formula is Implicit in the normalization process.

[0018] This formula comprehensively evaluates the execution effect of security policies, taking into account the success rate, time efficiency and importance, ensuring the accuracy and pertinence of the evaluation results. Its flexibility allows the weights to be adjusted according to the importance of the policies to adapt to different security needs. The quantitative results are intuitive and easy to understand, making it easy for managers to quickly grasp the status of policy execution and provide strong support for decision-making. At the same time, its dynamic nature ensures that the evaluation is adjusted as the environment changes, promoting continuous optimization of policies. Ultimately, this formula not only improves the system's security protection level, but also promotes the continuous improvement of security policies to ensure the security and stability of the industrial Internet environment.

[0019] In the preferred scheme of the above industrial Internet data security protection capability evaluation system: Calculate the vulnerability repair timeliness rate The specific steps are: Set the maximum allowable repair time for each vulnerability based on historical data ; Based on the total number of historical security vulnerabilities , Historical vulnerability discovery time , Historical vulnerability repair time points and the maximum allowable repair time , calculate vulnerability repair timeliness rate The specific formula is as follows: ; in, It is The time point when the vulnerability is discovered is taken as >0; It is The time point when the vulnerability is fixed, the value is >0; It is the serial number of the vulnerability discovery, with values ​​of 1, 2, and 3; the total number of security vulnerabilities >0, Indicates An indicator of a successful vulnerability fix. If it was successfully repaired before, =1, otherwise, =0; It should be noted that the operating principle of the present invention is: for each vulnerability, the time difference from its discovery to its repair is calculated and the maximum permissible repair time By comparison, the formula , to evaluate whether the vulnerability has been fixed in a timely manner, and >0, if the time difference is less than or equal to , then the repair is considered timely and the contribution of this part is positive; Further, through to indicate whether each vulnerability has been successfully fixed; if the vulnerability is successfully fixed, then = 1, otherwise 0, which ensures that only successfully fixed vulnerabilities are affected Have a positive impact; Furthermore, we multiply the timeliness of all vulnerabilities repaired and the success rate of repairs, then sum them up and divide them by the total number of historical security vulnerabilities. , and finally multiply by get ,This value reflects the overall performance of the system in terms of timeliness and success rate of vulnerability repair; Calculate vulnerability repair timeliness rate , provides a quantitative indicator to comprehensively evaluate the system's response speed and repair efficiency to security vulnerabilities, by setting the maximum allowable repair time , and taking into account the time difference between vulnerability discovery and repair and the success of repair, this formula can accurately reflect the actual effectiveness of system vulnerability management and the timeliness of vulnerability repair. It not only helps managers quickly identify vulnerabilities that have been delayed in repair, but also encourages timely repair behavior, thereby enhancing the overall security protection capabilities of the system. In addition, this indicator also promotes the continuous improvement of the vulnerability management process, ensuring that the system can respond quickly and effectively when faced with new threats.

[0020] In the preferred scheme of the above industrial Internet data security protection capability evaluation system: Calculate the illegal access interception rate The specific steps are: According to the number of interceptions of historical illegal access and historical illegal access times , calculate the illegal access interception rate The specific formula is as follows: ; Among them, the number of historical illegal accesses detected The value range of is a positive integer; It should be noted that the operating principle of the present invention is: by Divide by the number of historical illegal accesses , and multiply by This percentage intuitively shows the success rate of the system in blocking illegal access. Finally, according to the calculated Value, can evaluate the illegal access interception capability of the system, The higher the value, the better the system is at blocking illegal access and the stronger its ability to protect the security of industrial Internet data; The above formula calculates the illegal access interception rate The beneficial effect is that it provides an intuitive and quantitative indicator for evaluating the defense capability of the industrial Internet data security protection system against illegal access behaviors, by comparing the number of illegal accesses successfully intercepted. The number of illegal accesses in history , illegal access interception rate This indicator can accurately reflect the efficiency and effectiveness of the system in intercepting illegal access. It not only helps managers quickly understand the security performance of the system, but also provides data support for system optimization, prompting the adoption of more effective security measures to enhance protection capabilities, thereby ensuring the security and integrity of industrial Internet data.

[0021] In the preferred scheme of the above industrial Internet data security protection capability evaluation system: Calculate the data leakage risk index The specific steps are: Get the total number of real-time vulnerabilities And real-time illegal access count ; According to the security policy execution rate , Timely rate of vulnerability repair , Illegal access interception rate , Total number of real-time strategies , the total number of real-time vulnerabilities And real-time illegal access count , calculate the data leakage risk index The specific formula is as follows:

[0022] in, Security policy execution rate The weight coefficient is 0≤ ≤0.4, Timely rate of vulnerability repair The weight coefficient is 0.1≤ ≤0.5, Block rate for illegal access The weight coefficient is 0.2≤ ≤0.5, and + + =1.

[0023] It should be noted that the operating principle of the present invention is: by increasing the security policy execution rate , Timely rate of vulnerability repair And illegal access interception rate Multiply them by their respective weight coefficients and take into account the total number of real-time strategies , the total number of real-time vulnerabilities And real-time illegal access count , to comprehensively assess the data leakage risk of industrial Internet systems. This method can provide a quantified and comparable CRS value to help organizations understand the status of their data protection capabilities and take corresponding improvement measures accordingly; The above formula calculates the data leakage risk index The beneficial effect is that it provides a comprehensive quantitative assessment tool that can comprehensively consider multiple key security factors such as security policy execution, vulnerability repair timeliness, and illegal access interception, and flexibly adjust the importance of each factor through weight coefficients. It not only helps managers quickly understand the level of data leakage risk faced by the system, but also provides a scientific basis for formulating targeted security improvement strategies. In addition, the formula also takes into account real-time data to ensure that the evaluation results can reflect the current security situation and promote the continuous optimization and dynamic adjustment of security measures, thereby more effectively protecting the security of industrial Internet data.

[0024] In the preferred solution of the above industrial Internet data security protection capability evaluation system: the specific steps of determining whether to trigger a data leakage risk warning and generating a protection instruction are: Set the data leakage risk index threshold set , the data leakage risk index threshold set F includes the normal risk threshold , first level threshold , Secondary threshold and the third threshold ,in, < < < ; When the data leakage risk index ≤ When the data leakage risk warning is triggered, when <Data leakage risk index ≤ When a data breach occurs, a first-level data breach risk warning is triggered and a primary protection instruction is generated; when <Data leakage risk index ≤ When a second-level data leakage risk warning is triggered, an intermediate protection instruction is generated; when <Data leakage risk index ≤ When a third-level data leakage risk warning is triggered, an advanced protection instruction is generated; It should be noted that the operating principle of the present invention is: Level 1 data leakage risk warning: indicates that some early risk signals have appeared in the system, which need to be paid attention to and corresponding measures should be taken to prevent them. It may be that some small security vulnerabilities have begun to appear, or there are some local problems in the implementation of security policies. It may be that the security policy execution rate of a key device has dropped, or some new potential vulnerabilities have been discovered but have not yet been exploited. Primary protection instructions: including strengthening the monitoring of key equipment and data, increasing the frequency of security policy execution checks on specific equipment, arranging technical personnel to quickly fix some low-risk vulnerabilities, and strengthening user rights management; Level 2 data leakage risk warning: indicates that the risk level of the system is already obvious and urgent measures need to be taken to deal with it. At this time, some data may be at risk of being leaked, or the security performance of the system has been greatly reduced. The vulnerabilities of multiple devices are not repaired in time, resulting in a significant impact on the overall security of the system, or the frequency of illegal access begins to increase. Intermediate protection instructions: temporarily suspend some business operations involving sensitive data, organize professional teams to conduct in-depth vulnerability detection and repair of the system, adjust network firewall rules to strengthen access control, etc.; Level 3 data leakage risk warning: means that the system is in a highly dangerous state and the possibility of data leakage is very high. For example, a large number of security policies are not implemented at all, there are multiple serious vulnerabilities in the system and there are obvious signs of attacks, illegal access is frequent and difficult to intercept, and strong measures must be taken immediately; Advanced protection instructions: This is the most stringent and urgent protection measure, which cuts off the connection with external high-risk networks, activates the data leakage emergency plan, transfers important data to a secure storage device for backup, and organizes technical forces to fully respond to possible attacks.

[0025] In the preferred scheme of the above industrial Internet data security protection capability evaluation system: the steps for determining the system security level are as follows: Get the ideal security policy execution rate based on historical data , Timely rate of target vulnerability repair And the maximum illegal access interception rate ; According to the ideal security policy execution rate and security policy execution rate , calculate the potential for improving security policy execution rate , the calculation formula is as follows: ; Timely repair rate based on target vulnerabilities And the timeliness of vulnerability repair , calculate the potential for improving the timeliness of vulnerability repair , the calculation formula is as follows: ; According to the maximum illegal access interception rate And illegal access interception rate , calculate the potential for improving the illegal access interception rate , the calculation formula is as follows: ; Among them, the ideal security policy execution rate The value range is >0; Timely rate of target vulnerability repair The value range is >0; Maximum illegal access interception rate The value range is >0; According to the data breach risk index , Potential for improving security policy execution rate , Potential for improving the timeliness of vulnerability repair And the potential to improve the illegal access interception rate , Computing System Security Assessment Index The specific formula is as follows: ; in, Represents the optimization coefficient of the overall control, and its value range is >0; Security policy execution rate The weight coefficient is 0.2≤ ≤0.3, Timely rate of vulnerability repair The weight coefficient is 0.2≤ ≤0.4, Block rate for illegal access The weight coefficient is 0.3≤ ≤0.5, and + + =1; It should be noted that the operating principle of the present invention is: this formula comprehensively considers the data leakage risk index , Potential for improving security policy execution rate , Potential for improving the timeliness of vulnerability repair And the potential to improve the illegal access interception rate , combined with the weight coefficient, provides a quantitative tool for the evaluation of industrial Internet data security protection capabilities, helping enterprises to better understand the security status of the system and take corresponding measures to optimize and improve it; This formula has many beneficial effects. First, it comprehensively considers the risk of data leakage and multiple improvement potential factors, comprehensively evaluates the security status of the system, and avoids the one-sidedness of a single indicator; Furthermore, by introducing weight coefficients and considering the potential for reducing data leakage risks, enterprises are encouraged to pay attention to potential risks and take active measures to reduce them. Overall, this formula provides a quantitative tool for evaluating the data security protection capabilities of the industrial Internet, which helps enterprises to carry out targeted security optimization and improve the overall security and stability of the system. System security assessment index threshold set Includes normal risk threshold , primary threshold , Intermediate Threshold and Advanced Thresholds ,in, < < < ; When the system security assessment index ≤ , it means no risk; when <System Security Assessment Index ≤ When , the security level is low risk; when <System Security Assessment Index ≤ When , the security level is medium risk; when <System Security Assessment Index ≤ When , the security level is high risk; It should be noted that the operating principle of the present invention is: No risk: The system is in a very safe state, all indicators are within a relatively ideal range, security policies are well implemented, vulnerabilities are repaired in a timely manner, illegal access is effectively blocked, and the risk of data leakage is extremely low; Risk-free protection instructions: Continuously monitor system status, maintain the enforcement of existing security policies, and conduct regular security checks and vulnerability scans to ensure that the security of the system does not decline; Low risk: The system has some minor security issues, but the overall risk is controllable. Some security policies may not be fully implemented, or a few vulnerabilities may not be fixed in a timely manner. There is also room for improvement in illegal access interception. Low-risk protection instructions: Strengthen the supervision of security policy execution, increase the frequency of security policy execution inspections, organize a dedicated team to urgently fix unpatched vulnerabilities, and optimize network access control rules to increase the rate of illegal access interception; Medium risk: The system's security status has obvious problems, which need to be taken seriously and corresponding measures should be taken. There are some deficiencies in security policy execution, vulnerability repair, and illegal access interception, and the risk of data leakage has increased. Medium-risk protection instructions: suspend some non-critical businesses, concentrate resources on vulnerability repair and security policy enforcement, conduct in-depth security assessments on the system, identify security weaknesses and develop targeted solutions, and at the same time, strengthen monitoring of network traffic to prevent further expansion of illegal access; High risk: The system is in a highly dangerous state, the possibility of data leakage is high, security policies are hardly implemented effectively, a large number of vulnerabilities exist and have not been fixed, and illegal access occurs frequently and is difficult to intercept; High-risk protection instructions: Immediately launch the emergency plan, cut off the connection with the external high-risk network, back up and transfer key data, organize a professional security team to handle the emergency, restore the security of the system as soon as possible, and at the same time, promptly inform the management and regulatory authorities of the situation so that further measures can be taken.

[0026] In the preferred solution of the above industrial Internet data security protection capability evaluation system: the specific steps of the user interaction module are: The user interaction module first reads the risk level prediction line chart, which shows the changing trend of data leakage risk in the future. On the chart, the corresponding data leakage risk index of each time point is clearly marked. , users can intuitively see the fluctuation of risks over time and understand the degree of data leakage risk faced by the system at different times; The security policy execution rate bar chart presents the security policy execution status in different time periods in an intuitive bar chart format. Each bar represents a specific time period, and the height of the bar corresponds to the security policy execution rate in that time period. , mark the security policy execution rate value of each time period on the bar chart, so that users can quickly understand the execution effect of the system's security policies in different periods; The vulnerability repair timeliness rate pie chart shows the timeliness of vulnerability repair in a proportional form. The entire pie chart represents all vulnerability situations, and different fan-shaped areas correspond to different vulnerability repair statuses, such as timely repair and untimely repair. The specific value of the vulnerability repair timeliness rate is clearly marked on the pie chart, so that users can see the system's vulnerability repair efficiency at a glance; The illegal access interception rate line chart reflects the changes in illegal access interception. The line in the chart represents the numerical changes in the illegal access interception rate at different time points. The illegal access interception rate at each time point is accurately marked on the line, so that users can understand the dynamic changes of the system's defense capability against illegal access over time. The security level assessment chart clarifies the current security level of the system and marks the corresponding system security assessment index according to different security level ranges. , you can quickly understand the overall security status of the system and the security level range of the current security assessment index; Comprehensive data and risk level prediction line chart, security level assessment chart, data leakage risk index and system security assessment index , generate an assessment report and send it via email, SMS and system notification channels.

[0027] On the other hand, the present invention also discloses an industrial Internet data security protection capability evaluation method, which is used to implement the above industrial Internet data security protection capability evaluation system, including the following contents: Step 1: Collect policy execution log data, vulnerability repair data, and network traffic data from the industrial Internet environment and integrate them into a valid data set; Step 2: Analyze the policy execution log data, vulnerability repair data, and network traffic data in the valid data set to obtain the security policy execution rate. , Timely rate of vulnerability repair And illegal access interception rate ; Step 3: According to the security policy execution rate , Timely rate of vulnerability repair And illegal access interception rate , calculate the data leakage risk index , determine whether to trigger a data leakage risk warning and generate protection instructions; Step 4: Based on historical data and security policy execution rate , Timely rate of vulnerability repair , Illegal access interception rate and Data Breach Risk Index , computing system potential assessment index , preset system security assessment index threshold set , according to the system security assessment index Determine the system security level; Step 5: Integrate the data to generate a risk level prediction line graph, a security policy execution rate bar graph, a vulnerability repair timeliness rate pie chart, an illegal access interception rate line graph, and a security level assessment graph, and generate a risk assessment report, which will be sent to relevant personnel via email, SMS, or system notification.

[0028] The above embodiments may be implemented in whole or in part by software, hardware, firmware or any other combination thereof. When implemented using software, the above embodiments may be implemented in whole or in part in the form of a computer program product. A person of ordinary skill in the art may appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein may be implemented in electronic hardware or in combination with computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution.

[0029] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0030] The above description is only a specific implementation manner of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application.

Claims

1. Industrial Internet data security protection capability assessment system, characterized by: include: The data collection module is used to collect historical policy execution log data, historical vulnerability repair data, and historical network traffic data from the industrial Internet environment and integrate them into a valid data set; The data analysis module is used to receive valid data sets, analyze historical policy execution log data, historical vulnerability repair data, and historical network traffic data, and obtain the security policy execution rate. , Timely rate of vulnerability repair And illegal access interception rate ; The data evaluation module is used to receive the analysis data from the data analysis module and , Timely rate of vulnerability repair And illegal access interception rate , calculate the data leakage risk index , determine whether to trigger a data leakage risk warning and generate protection instructions; Adjust the optimization module based on historical data and security policy execution rate , Timely rate of vulnerability repair , Illegal access interception rate and data breach risk index , Computing System Security Assessment Index , preset system security assessment index threshold set , according to the system security assessment index and system security assessment index threshold set Determine the system security level; The user interaction module is used to receive the optimization data from the data analysis module and the adjustment and optimization module, generate a risk level prediction line graph, a security policy execution rate bar graph, a vulnerability repair timeliness rate pie chart, an illegal access interception rate line graph and a security level assessment graph, and generate a risk assessment report, which is sent to relevant personnel via email, SMS or system notification.

2. The industrial Internet data security protection capability evaluation system according to claim 1 is characterized in that: The working steps of the data acquisition module are: Obtain the total number of historical execution strategies within a unit time period through historical strategy execution log data 、Historical execution success rate And historical execution time efficiency ; Obtain the total number of historical security vulnerabilities within a unit time period through historical vulnerability repair data , Historical vulnerability discovery time And historical vulnerability repair time points ; Based on the historical data of security monitoring, historical network traffic data is obtained. The historical network traffic data includes the number of interceptions of historical illegal access within a unit time period. And the number of historical illegal accesses successfully detected in a unit time period .

3. The industrial Internet data security protection capability evaluation system according to claim 2 is characterized in that: Calculate the security policy execution rate The method is: According to the total number of historical execution strategies 、Historical execution success rate And historical execution time efficiency , calculate the security policy execution rate , the calculation formula is as follows: ； in, It is The success rate of executing the strategy, It is the sequence number of the execution strategy, and its value is 1, 2, 3, 4. The value range is >0; It is The execution time efficiency of each strategy, The value range is >0; Indicates The importance weight of the execution strategy is in the range of ≥0.

4. The industrial Internet data security protection capability evaluation system according to claim 3 is characterized in that: Calculate vulnerability repair timeliness rate The specific steps are: Set the maximum allowed repair time for each vulnerability ; Based on the total number of historical security vulnerabilities , Historical vulnerability discovery time , Historical vulnerability repair time points and the maximum allowable repair time , calculate vulnerability repair timeliness rate The specific formula is as follows: ； in, It is The time point when the vulnerability is discovered is taken as >0; It is The time point when the vulnerability is fixed, the value is >0; It is the serial number of the vulnerability discovery, with values ​​of 1, 2, and 3; the total number of security vulnerabilities >0, Indicates An indicator of a successful vulnerability fix. If it was successfully repaired before, =1, otherwise, =0.

5. The industrial Internet data security protection capability evaluation system according to claim 4 is characterized in that: Calculate the illegal access interception rate The specific steps are: According to the number of interceptions of historical illegal access and historical illegal access times , calculate the illegal access interception rate The specific formula is as follows: ； Among them, the number of historical illegal accesses detected The value range of is a positive integer.

6. The industrial Internet data security protection capability evaluation system according to claim 5 is characterized in that: Calculate the data breach risk index The specific steps are: Get the total number of real-time vulnerabilities And real-time illegal access count ; According to the security policy execution rate , Timely rate of vulnerability repair , Illegal access interception rate , Total number of real-time strategies , the total number of real-time vulnerabilities And real-time illegal access count , calculate the data leakage risk index The specific formula is as follows: ； in, Security policy execution rate The weight coefficient is 0.1≤ ≤0.4, Timely rate of vulnerability repair The weight coefficient is 0.1≤ ≤0.5, Block rate for illegal access The weight coefficient is 0.2≤ ≤0.5, and + + =1.

7. The industrial Internet data security protection capability evaluation system according to claim 6 is characterized in that: The specific steps to determine whether a data leakage risk warning is triggered and generate protection instructions are: Set the data leakage risk index threshold set , the data leakage risk index threshold set F includes the normal risk threshold , first level threshold , Secondary threshold and the third threshold ,in, < < < ; When the data leakage risk index ≤ When the data leakage risk warning is triggered, when <Data leakage risk index ≤ When a data breach occurs, a first-level data breach risk warning is triggered and a primary protection instruction is generated; when <Data leakage risk index ≤ When a second-level data leakage risk warning is triggered, an intermediate protection instruction is generated; when <Data leakage risk index ≤ When a third-level data leakage risk warning is triggered, an advanced protection instruction is generated.

8. The industrial Internet data security protection capability evaluation system according to claim 7 is characterized in that: The steps to determine the system security level are as follows: Get the ideal security policy execution rate based on historical data , Timely rate of target vulnerability repair And the maximum illegal access interception rate ; According to the ideal security policy execution rate and security policy execution rate , calculate the potential for improving security policy execution rate , the calculation formula is as follows: ； Timely repair rate based on target vulnerabilities And the timeliness of vulnerability repair , calculate the potential for improving the timeliness of vulnerability repair , the calculation formula is as follows: ； According to the maximum illegal access interception rate And illegal access interception rate , calculate the potential for improving the illegal access interception rate , the calculation formula is as follows: ； Among them, the ideal security policy execution rate The value range is >0; Timely rate of target vulnerability repair The value range is >0; Maximum illegal access interception rate The value range is >0; According to the data breach risk index , Potential for improving security policy execution rate , Potential for improving the timeliness of vulnerability repair And the potential to improve the illegal access interception rate , Computing System Security Assessment Index The specific formula is as follows: ； in, Represents the optimization coefficient of the overall control, and its value range is >0; Security policy execution rate The weight coefficient is 0.2≤ ≤0.3, Timely rate of vulnerability repair The weight coefficient is 0.2≤ ≤0.4, Block rate for illegal access The weight coefficient is 0.3≤ ≤0.5, and + + =1; System security assessment index threshold set Includes normal risk threshold , primary threshold , Intermediate Threshold and Advanced Thresholds ,in, < < < ; When the system security assessment index ≤ , it means no risk; when <System Security Assessment Index ≤ When , the security level is low risk; when <System Security Assessment Index ≤ When , the security level is medium risk; when <System Security Assessment Index ≤ , the security level is high risk.

9. The industrial Internet data security protection capability evaluation system according to claim 8 is characterized in that: The specific steps of the user interaction module are: Mark the data leakage risk index on the risk level prediction line chart ; Mark the security policy execution rate on the security policy execution rate bar chart ;Mark the vulnerability repair timeliness rate on the vulnerability repair timeliness rate pie chart ; Mark the illegal access interception rate on the illegal access interception rate line chart ; Mark the system safety assessment index on the safety level assessment chart ; Comprehensive data and risk level prediction line chart, security level assessment chart, data leakage risk index and system security assessment index , generate an assessment report and send it via email, SMS and system notification channels.

10. An industrial Internet data security protection capability assessment method, used to implement an industrial Internet data security protection capability assessment system according to any one of claims 1 to 9, characterized in that: The following steps are involved: Step 1: Collect policy execution log data, vulnerability repair data, and network traffic data from the industrial Internet environment and integrate them into a valid data set; Step 2: Analyze the policy execution log data, vulnerability repair data, and network traffic data in the valid data set to obtain the security policy execution rate. , Timely rate of vulnerability repair And illegal access interception rate ; Step 3: According to the security policy execution rate , Timely rate of vulnerability repair And illegal access interception rate , calculate the data leakage risk index , determine whether to trigger a data leakage risk warning and generate protection instructions; Step 4: Based on historical data and security policy execution rate , Timely rate of vulnerability repair , Illegal access interception rate and Data Breach Risk Index , computing system potential assessment index , preset system security assessment index threshold set , according to the system security assessment index Determine the system security level; Step 5: Integrate the data to generate a risk level prediction line graph, a security policy execution rate bar graph, a vulnerability repair timeliness rate pie chart, an illegal access interception rate line graph, and a security level assessment graph, and generate a risk assessment report, which will be sent to relevant personnel via email, SMS, or system notification.

Images