Data center security auditing system based on cloud computing

Abstract

The invention discloses a data center security auditing system based on cloud computing, and particularly relates to the field of cloud computing, which comprises a data region division module, a data acquisition module, a data preprocessing module, a data analysis module, a data center comprehensive security evaluation module, a data center security level determination module and a man-machine interaction module, through deep analysis of network security, system operation and log security, evaluation coefficients including a network security evaluation coefficient, a system performance evaluation coefficient and a log security evaluation coefficient are calculated according to a specific mathematical model, and an audit security evaluation index is calculated through each evaluation coefficient. The auditing safety evaluation index is compared with each safety level lower limit value, the safety level of the target data center is judged, corresponding early warning signals are made according to different safety levels, and the accuracy of system safety early warning and the intelligence of system processing analysis are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of cloud computing, and more specifically, to a data center security audit system based on cloud computing. Background Art

[0002] With the continuous development of information technology, cloud computing, as a groundbreaking technological innovation, has profoundly changed the way all walks of life operate. In the information age, data centers face multiple security threats from both inside and outside, which may not only lead to data loss and damage, but also have a serious impact on the company's reputation and business continuity. Therefore, it is particularly important to establish a data center security audit system based on cloud computing. Through the security audit system, security incidents in the data center can be monitored and recorded in real time, and potential security threats can be discovered and responded to in a timely manner, thereby ensuring the security and stability of the data center.

[0003] The traditional data center security audit system includes a log management module, a behavior monitoring module, and an alarm module. The log management module records in detail all operation logs in the enterprise network system, including user logins, management operations, database operations, network traffic, etc. These log data provide valuable original information for subsequent security analysis; the behavior monitoring module monitors user behavior and application behavior in the enterprise network system in real time, and promptly discovers and warns of abnormal operations by comparing normal behavior patterns and abnormal behavior patterns; the alarm module can automatically trigger the alarm mechanism when the system detects potential security threats or abnormal behaviors, and promptly notify relevant personnel to handle them.

[0004] However, it still has some shortcomings in actual use. For example, with the continuous development of information technology, new types of network attacks emerge in an endless stream, and traditional data center security audit systems are difficult to cope with these complex and changeable new attacks; in the era of big data, the amount of data in enterprise network systems is huge and complex, and traditional data center security audit systems may face performance bottlenecks when processing this data; it is relatively weak in intelligence and has difficulty automatically adapting to and responding to the ever-changing network environment. Summary of the invention

[0005] In order to overcome the above-mentioned defects of the prior art, an embodiment of the present invention provides a data center security audit system based on cloud computing, and solves the problems raised in the above-mentioned background technology through the following scheme.

[0006] To achieve the above object, the present invention provides the following technical solutions:

[0007] Data area division module: The data center is determined as the target data area, and the target data area is divided into sub-data areas by equal time division, and marked as 1, 2, ..., n in sequence;

[0008] Data collection module: collects data from each sub-data area, including network security data, system performance data, and log security data, and transmits the collected data to the data preprocessing module;

[0009] Data preprocessing module: preprocesses the data collected by the data acquisition module and transmits the preprocessed data to the data analysis module;

[0010] Data analysis module: Analyzes the pre-processed data, calculates the network security assessment coefficient, system performance assessment coefficient and log security assessment coefficient of the target data area, and transmits them to the comprehensive security assessment module of the data center;

[0011] Data center comprehensive security assessment module: Calculates the audit security assessment index of the target data area based on the network security assessment coefficient, system performance assessment coefficient, and log security assessment coefficient;

[0012] Data center security level determination module: used to determine the security level of the target data area and transmit the security level of the target data area to the human-computer interaction module;

[0013] Human-computer interaction module: Based on the received security level, it sends a control signal to the target data area.

[0014] Preferably, the data area division module reads the data and the timestamp information corresponding to the data from the database, sets the time interval for each sub-data area according to actual needs, the time interval is a fixed time, marks the timestamp at the beginning of the data as the start time, divides the timestamp into different time periods according to the set time interval, and traverses all the timestamp information, each time period corresponds to a sub-data area, and classifies the data points whose timestamps fall in the same time period into the corresponding sub-data area, marks each divided sub-data area, and marks them in sequence as 1, 2, ..., n.

[0015] Preferably, the data acquisition module includes a network security data acquisition unit, a system performance data acquisition unit, a log security data acquisition unit and a data transmission unit. The network security data acquisition unit is used to collect network traffic, network bandwidth and end-to-end delay in the target data area, which are marked as L, D and t respectively. d The system performance data collection unit is used to collect the total amount of transmitted data packets, the number of successfully received data packets, the storage capacity and the storage bandwidth of the target data area, which are marked as Wz, Wa, C and Kc respectively; the log security data collection unit is used to collect the number of log abnormal logins, security event recovery time and data abnormality recovery progress of the target data area, which are marked as N, t q and r q; The data transmission unit is used to transmit the collected data to the data preprocessing module.

[0016] Preferably, the network traffic collected by the network security data collection unit is the total amount of data transmitted by the nodes during the data transmission process, the network bandwidth is the amount of data that can be sent or received by the data center per unit time, the end-to-end delay is the total delay for users to obtain services, and the transmission packet loss rate is the proportion of data packets lost in the data transmission process; the total amount of transmitted data packets and the number of successfully received data packets collected by the system performance data collection unit are collected through network monitoring tools, such as Wireshark and tcpdump, the storage capacity is the amount of binary information that the memory can accommodate, and the storage bandwidth is the amount of information accessed per unit time; the log security data collection unit collects log abnormal login times, which are the number of login attempts beyond the normal range, the security event recovery time, which is the time required from the detection of the security event to the complete restoration of the system or application to normal operation, and the data abnormal recovery progress, which is the progress from starting the data recovery operation to the complete recovery of the data in the event of data loss, damage or abnormality.

[0017] Preferably, the network security data preprocessed by the data preprocessing module includes average network traffic, average network bandwidth and average delay, which are marked as Nl, Nd and Nt respectively; the system performance data preprocessed includes transmission packet loss rate, average storage capacity and average storage bandwidth, which are marked as Wd, Wc and Wo respectively; the log security data preprocessed includes average security event recovery time, average abnormal recovery progress and log abnormality rate, which are marked as Dn, De and Dh respectively.

[0018] Preferably, the data preprocessing module calculates the average network traffic, average network bandwidth and average delay respectively through the network traffic, network bandwidth and end-to-end delay of the i-th sub-data area, which is specifically expressed as: , , , the network traffic, network bandwidth, average network traffic and average network bandwidth of the ith sub-data area are used to calculate the standard deviation of network traffic and the standard deviation of network bandwidth, which are specifically expressed as follows: , The data preprocessing module calculates the transmission packet loss rate of each sub-data area through the total transmission data of the i-th sub-data area and the number of successfully received data packets, which is specifically expressed as: , the average storage capacity and average storage bandwidth are calculated by the storage capacity and storage bandwidth of the i-th sub-data area, respectively, which are specifically expressed as: , The data preprocessing module calculates the average security incident recovery time and the average data anomaly recovery progress through the security incident recovery time and the data anomaly recovery progress of the i-th sub-data area, which is specifically expressed as: , , the log anomaly rate is calculated by the number of abnormal log logins in the i-th sub-data area, which is specifically expressed as: .

[0019] Preferably, the data analysis module includes a preprocessing data receiving unit, a network security analysis unit, a system performance analysis unit, a log security analysis unit and a data transmission unit. The preprocessing data receiving unit is used to receive data transmitted by the data preprocessing module; the network security analysis unit is used to establish a network security analysis model, and import the network security data into the network security analysis unit, and calculate the network security evaluation coefficient of each sub-data area, which is specifically expressed as: , where N i Represents the network security assessment coefficient of the ith sub-data area, Nm i represents the standard deviation of network traffic in the ith sub-data area, Nl represents the average network traffic, and L i Nc represents the network traffic of the ith sub-data area. i represents the standard deviation of the network bandwidth of the ith sub-data area, Nd represents the average network bandwidth, Di represents the network bandwidth of the ith sub-data area, Nt represents the average delay, and Nt i represents the delay of the i-th sub-data area, π and e are natural constants.

[0020] Preferably, the system performance analysis unit is used to establish a system performance analysis model, and import the system performance data into the system performance analysis unit to calculate the system performance evaluation coefficient of each sub-data area, which is specifically expressed as: , where W i represents the system performance evaluation coefficient of the ith sub-data area, Wc represents the average storage capacity, Wo represents the average storage bandwidth, and Wd i Indicates the transmission packet loss rate of the i-th sub-data area.

[0021] Preferably, the log security analysis unit is used to establish a log security analysis model, and import the log security data into the log security analysis unit to calculate the log security assessment coefficient of each sub-data area, which is specifically expressed as: , where D i Denotes the log security assessment coefficient of the ith sub-data area, Dh irepresents the log anomaly rate of the i-th sub-data area, De represents the average anomaly recovery progress, Dn represents the average safety time recovery time, μ1 and μ2 are the quadratic term coefficient and the linear term coefficient of the average safety time recovery time, and μ1>0, μ2>0; the data transmission unit is used to transmit the analyzed data to the comprehensive security assessment module of the data center.

[0022] Preferably, the data center comprehensive security assessment module calculates the audit security assessment index of each sub-data area based on the network security assessment coefficient, the system performance assessment coefficient and the log security assessment coefficient. The specific formula is: , where Y i represents the audit security assessment index of the ith sub-data area, N i represents the network security evaluation coefficient of the ith sub-data area, W i represents the system performance evaluation coefficient of the ith sub-time zone, D i represents the log security assessment coefficient of the i-th sub-time zone, λ1, λ2 and λ3 are the proportional coefficients corresponding to different assessment coefficients, and λ1>0, λ2>0, λ3>0; the audit security assessment index of the target data zone is calculated by the audit security assessment index of each sub-data zone, and the specific calculation formula is: .

[0023] Preferably, the data center security level determination module extracts the maximum and minimum audit security assessment indexes of each sub-data area according to the audit security assessment index transmitted by the data center comprehensive security assessment module, and records them as Y max and Y min ; Calculate the security difference η of the target data area. The specific calculation formula is: , and Y min Set to the lower limit of level 3, Y min ×(1+η / 2) is set as the secondary lower limit, Y max Set as the first level lower limit; if Y≥Y max , indicating that the audit security assessment index of the target data area is greater than or equal to the first-level lower limit, then the target data area is at security level I. min ×(1+η / 2)≤Y<Y max , indicating that the audit security assessment index of the target data area is greater than or equal to the lower limit of the second level and less than the lower limit of the first level. At this time, the target data area is at security level II. If Y min ≤Y<Y min × (1+η / 2), indicating that the audit security assessment index of the target data area is greater than or equal to the lower limit of level 3 and less than the lower limit of level 2. At this time, the target data area is at security level III. If Y<Y min, then this target data area is in a dangerous state.

[0024] Technical effects and advantages of the present invention:

[0025] 1. The present invention divides the data center into sub-data areas at equal time through the data area division module, and each sub-data area operates independently, ensuring that the data can be processed efficiently; various data of the data center are collected through cloud computing, and multi-dimensional data collection is performed more comprehensively and in real time according to network security, system operation and log security, ensuring the comprehensiveness and accuracy of the data source, and laying a solid foundation for subsequent data analysis; the data analysis module conducts in-depth analysis of each sub-data area of ​​network security, system operation and log security, and calculates evaluation coefficients according to a specific mathematical model, including network security evaluation coefficient, system performance evaluation coefficient and log security evaluation coefficient, and the modular design enhances the flexibility and scalability of the system;

[0026] 2. The rated audit security assessment index of the target data area and the audit security assessment index of each sub-data area are calculated through the comprehensive security assessment module of the data center, which comprehensively reflects the security status of the data center and provides a scientific basis for judging the overall operating status. The audit security assessment index is compared with the lower limit of each security level through the data center security level determination module to judge the security level of the target data center, and corresponding warning signals are made according to different security levels, which improves the accuracy of system security warnings and the intelligence of system processing and analysis. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 It is a schematic diagram of the overall structure of the present invention.

[0028] Figure 2 It is a schematic diagram of the structure of the data analysis module of the present invention.

[0029] Figure 3 It is a flow chart of the system operation of the present invention. DETAILED DESCRIPTION

[0030] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0031] As attached Figure 1 The cloud computing-based data center security audit system shown includes:

[0032] The data area division module determines the data center as the target data area, divides the target data area into various sub-data areas by equal time division, and marks them as 1, 2, ..., n in sequence.

[0033] In this embodiment, it should be specifically explained that the data area division module reads the data and the timestamp information corresponding to the data from the database, sets the time interval for each sub-data area according to actual needs, and the time interval is a fixed time. The timestamp at the beginning of the data is marked as the start time. According to the set time interval, the timestamp is divided into different time periods, and all timestamp information is traversed. Each time period corresponds to a sub-data area, and the data points whose timestamps fall in the same time period are classified into the corresponding sub-data area. Each divided sub-data area is marked and marked as 1, 2, ..., n in sequence.

[0034] The data acquisition module collects data from each sub-data area, including network security data, system performance data, and log security data, and transmits the collected data to the data preprocessing module.

[0035] In this embodiment, it should be specifically explained that the data acquisition module includes a network security data acquisition unit, a system performance data acquisition unit, a log security data acquisition unit and a data transmission unit. The network security data acquisition unit is used to collect the network traffic, network bandwidth and end-to-end delay of the target data area, which are marked as L, D and t respectively. d The system performance data collection unit is used to collect the total amount of transmitted data packets, the number of successfully received data packets, the storage capacity and the storage bandwidth of the target data area, which are marked as Wz, Wa, C and Kc respectively; the log security data collection unit is used to collect the number of log abnormal logins, security event recovery time and data abnormality recovery progress of the target data area, which are marked as N, t q and r q ; The data transmission unit is used to transmit the collected data to the data preprocessing module.

[0036] Furthermore, the network traffic collected by the network security data collection unit is the total amount of data transmitted by the node during the data transmission process, the network bandwidth is the amount of data that can be sent or received by the data center per unit time, the end-to-end delay is the total delay for users to obtain services, and the transmission packet loss rate is the proportion of data packets lost in the data transmission process; the total amount of transmitted data packets and the number of successfully received data packets collected by the system performance data collection unit are collected through network monitoring tools, such as Wireshark and tcpdump. The storage capacity is the amount of binary information that the memory can accommodate, and the storage bandwidth is the amount of information accessed per unit time. The log security data collection unit collects the number of abnormal login attempts, which is the number of login attempts that exceeds the normal range. The security event recovery time is the time required from the detection of the security event to the full restoration of normal operation of the system or application. The data abnormal recovery progress is the progress from starting the data recovery operation to the complete recovery of the data in the event of data loss, damage or abnormality.

[0037] The data preprocessing module preprocesses the data collected by the data acquisition module and transmits the preprocessed data to the data analysis module.

[0038] In this embodiment, it should be specifically explained that the network security data after preprocessing by the data preprocessing module includes the average network traffic, the average network bandwidth and the average delay, which are marked as Nl, Nd and Nt respectively; the system performance data after preprocessing includes the transmission packet loss rate, the average storage capacity and the average storage bandwidth, which are marked as Wd, Wc and Wo respectively; the log security data after preprocessing includes the average security event recovery time, the average abnormal recovery progress and the log abnormality rate, which are marked as Dn, De and Dh respectively.

[0039] Furthermore, the data preprocessing module calculates the average network traffic, average network bandwidth and average delay respectively through the network traffic, network bandwidth and end-to-end delay of the i-th sub-data area, which are specifically expressed as: , , , the network traffic, network bandwidth, average network traffic and average network bandwidth of the ith sub-data area are used to calculate the standard deviation of network traffic and the standard deviation of network bandwidth, which are specifically expressed as follows: , The data preprocessing module calculates the transmission packet loss rate of each sub-data area through the total transmission data of the i-th sub-data area and the number of successfully received data packets, which is specifically expressed as: , the average storage capacity and average storage bandwidth are calculated by the storage capacity and storage bandwidth of the i-th sub-data area, respectively, which are specifically expressed as: , The data preprocessing module calculates the average security incident recovery time and average data anomaly recovery progress through the security incident recovery time and data anomaly recovery progress of the i-th sub-data area, which is specifically expressed as: , , the log anomaly rate is calculated by the number of abnormal log logins in the i-th sub-data area, which is specifically expressed as: .

[0040] The data analysis module analyzes the preprocessed data, calculates the network security assessment coefficient, system performance assessment coefficient and log security assessment coefficient of the target data area, and transmits them to the comprehensive security assessment module of the data center.

[0041] In this embodiment, it should be specifically explained that the data analysis module includes a preprocessing data receiving unit, a network security analysis unit, a system performance analysis unit, a log security analysis unit and a data transmission unit. The preprocessing data receiving unit is used to receive the data transmitted by the data preprocessing module; the network security analysis unit is used to establish a network security analysis model, and import the network security data into the network security analysis unit, and calculate the network security evaluation coefficient of each sub-data area, which is specifically expressed as: , where N i Represents the network security assessment coefficient of the ith sub-data area, Nm i represents the standard deviation of network traffic in the ith sub-data area, Nl represents the average network traffic, and L i Nc represents the network traffic of the ith sub-data area. i represents the standard deviation of the network bandwidth of the ith sub-data area, Nd represents the average network bandwidth, Di represents the network bandwidth of the ith sub-data area, Nt represents the average delay, and Nt i represents the delay of the ith sub-data area, π and e are natural constants; the system performance analysis unit is used to establish a system performance analysis model, and import the system performance data into the system performance analysis unit to calculate the system performance evaluation coefficient of each sub-data area, which is specifically expressed as: , where W i represents the system performance evaluation coefficient of the ith sub-data area, Wc represents the average storage capacity, Wo represents the average storage bandwidth, and Wd i represents the transmission packet loss rate of the ith sub-data area; the log security analysis unit is used to establish a log security analysis model, import the log security data into the log security analysis unit, and calculate the log security assessment coefficient of each sub-data area, which is specifically expressed as: , where D i Denotes the log security assessment coefficient of the ith sub-data area, Dhi represents the log anomaly rate of the i-th sub-data area, De represents the average anomaly recovery progress, Dn represents the average safety time recovery time, μ1 and μ2 are the quadratic term coefficient and the linear term coefficient of the average safety time recovery time, and μ1>0, μ2>0; the data transmission unit is used to transmit the analyzed data to the comprehensive security assessment module of the data center.

[0042] The data center comprehensive security assessment module calculates the audit security assessment index of the target data area based on the network security assessment coefficient, system performance assessment coefficient and log security assessment coefficient.

[0043] In this embodiment, it should be specifically explained that the data center comprehensive security assessment module calculates the audit security assessment index of each sub-data area based on the network security assessment coefficient, the system performance assessment coefficient and the log security assessment coefficient. The specific formula is: , where Y i represents the audit security assessment index of the ith sub-data area, N i represents the network security evaluation coefficient of the ith sub-data area, W i represents the system performance evaluation coefficient of the ith sub-time zone, D i represents the log security assessment coefficient of the i-th sub-time zone, λ1, λ2 and λ3 are the proportional coefficients corresponding to different assessment coefficients, and λ1>0, λ2>0, λ3>0; the audit security assessment index of the target data zone is calculated by the audit security assessment index of each sub-data zone, and the specific calculation formula is: .

[0044] The data center security level determination module is used to determine the security level of the target data area and transmit the security level of the target data area to the human-computer interaction module.

[0045] In this embodiment, it should be specifically explained that the data center security level determination module extracts the maximum and minimum audit security assessment indexes of each sub-data area according to the audit security assessment index transmitted by the data center comprehensive security assessment module, and records them as Y max and Y min ; Calculate the security difference η of the target data area. The specific calculation formula is: , and Y min Set to the lower limit of level 3, Y min ×(1+η / 2) is set as the secondary lower limit, Y max Set as the first level lower limit; if Y≥Y max , indicating that the audit security assessment index of the target data area is greater than or equal to the first-level lower limit, then the target data area is at security level I. min ×(1+η / 2)≤Y<Ymax , indicating that the audit security assessment index of the target data area is greater than or equal to the lower limit of the second level and less than the lower limit of the first level. At this time, the target data area is at security level II. If Y min ≤Y<Y min × (1+η / 2), indicating that the audit security assessment index of the target data area is greater than or equal to the lower limit of level 3 and less than the lower limit of level 2. At this time, the target data area is at security level III. If Y<Y min , then this target data area is in a dangerous state.

[0046] The human-computer interaction module sends a control signal to the target data area based on the received security level.

[0047] In this embodiment, it should be specifically explained that the human-computer interaction module is used to receive security levels, send signals for different security levels, and report and summarize the security status of the data center. The security levels include security level I, security level II, security level III and dangerous status. When the data center is at security level I, it means that the data center is in a safe state and the system is working normally; when the data center is at security level II and security level III, the data is backed up in time; when the data center is in a dangerous state, an early warning signal is immediately sent to the management terminal, and the data is urgently backed up.

[0048] The present invention divides the data center into sub-data areas at equal time through a data area division module, and each sub-data area is operated separately, thereby ensuring that the data can be processed efficiently; various data of the data center are collected through cloud computing, and multi-dimensional data collection is performed more comprehensively and in real time according to network security, system operation and log security, thereby ensuring the comprehensiveness and accuracy of the data source and laying a solid foundation for subsequent data analysis; the data analysis module conducts in-depth analysis of each sub-data area of ​​network security, system operation and log security, and calculates evaluation coefficients according to a specific mathematical model, including network security evaluation coefficients, system performance evaluation coefficients and log security evaluation coefficients, and the modular design enhances the flexibility and scalability of the system; the rated audit security evaluation index of the target data area and the audit security evaluation index of each sub-data area are calculated respectively through the comprehensive security evaluation module of the data center, thereby comprehensively reflecting the security status of the data center and providing a scientific basis for judging the overall operating status; the audit security evaluation index is compared with the lower limit value of each security level through the data center security level determination module, the security level of the target data center is judged, and corresponding early warning signals are made according to different security levels, thereby improving the accuracy of system security early warning and the intelligence of system processing and analysis.

[0049] like Figure 3 This embodiment provides an operation process of a data center security audit system based on cloud computing, including the following steps:

[0050] S1: The data center is determined as the target data area, and the target data area is divided into various sub-data areas by equal time division, and marked as 1, 2, ..., n in sequence;

[0051] S2: Collect data from each sub-data area, including network security data, system performance data, and log security data;

[0052] S3: pre-process the data collected by the data collection module to obtain average network traffic, average network bandwidth, average latency, network traffic standard deviation, network bandwidth standard deviation, transmission packet loss rate, average storage capacity, average storage bandwidth, average security incident recovery time, average abnormal recovery progress and log abnormality rate;

[0053] S4: Analyze the preprocessed data and calculate the network security evaluation coefficient, system performance evaluation coefficient and log security evaluation coefficient of the target data area respectively;

[0054] S5: Calculate the audit security assessment index of the target data area based on the network security assessment coefficient, the system performance assessment coefficient, and the log security assessment coefficient;

[0055] S6: Determine the security level of the target data area;

[0056] S7: Based on the received security level, a control signal is issued to the target data area.

[0057] Secondly: In the drawings of the embodiments disclosed in the present invention, only the structures related to the embodiments disclosed in the present invention are involved, and other structures can refer to the general design. In the absence of conflict, the same embodiment and different embodiments of the present invention can be combined with each other;

[0058] Finally: The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A data center security audit system based on cloud computing, characterized in that: include: The system operation database includes all data texts of the data center security audit system and collects the information texts output by each module in real time. The system central processor is used to centrally control the information text instructions output during the entire control process. The management terminal is a device for receiving information output from the data center security audit system. Data area division module: The data center is determined as the target data area, and the target data area is divided into sub-data areas by equal time division, and marked as 1, 2, ..., n in sequence; Data collection module: collects data from each sub-data area, including network security data, system performance data, and log security data, and transmits the collected data to the data preprocessing module; Data preprocessing module: preprocesses the data collected by the data acquisition module and transmits the preprocessed data to the data analysis module; Data analysis module: Analyzes the pre-processed data, calculates the network security assessment coefficient, system performance assessment coefficient and log security assessment coefficient of the target data area, and transmits them to the comprehensive security assessment module of the data center; Data center comprehensive security assessment module: Calculates the audit security assessment index of the target data area based on the network security assessment coefficient, system performance assessment coefficient, and log security assessment coefficient; Data center security level determination module: used to determine the security level of the target data area and transmit the security level of the target data area to the human-computer interaction module; Human-computer interaction module: Based on the received security level, it sends a control signal to the target data area.

2. The data center security audit system based on cloud computing according to claim 1 is characterized in that: The data collection module includes a network security data collection unit, a system performance data collection unit, a log security data collection unit and a data transmission unit. The network security data collection unit is used to collect the network traffic, network bandwidth and end-to-end delay of the target data area, which are marked as L, D and t respectively. d ; The system performance data collection unit is used to collect the total transmission data, the number of successfully received data packets, the storage capacity and the storage bandwidth of the target data area, which are marked as Wz, Wa, C and Kc respectively; the log security data collection unit is used to collect the total number of logs, the number of abnormal log logins, the security event recovery time and the data abnormality recovery progress of the target data area, which are marked as Z, N, t q and r q ; The data transmission unit is used to transmit the collected data to the data preprocessing module.

3. The data center security audit system based on cloud computing according to claim 1 is characterized in that: The network security data preprocessed by the data preprocessing module includes average network traffic, average network bandwidth, average delay, network traffic standard deviation and network bandwidth standard deviation, which are marked as Nl, Nd, Nt, Nm and Nc respectively, and the system performance data preprocessed includes transmission packet loss rate, average storage capacity and average storage bandwidth, which are marked as Wd, Wc and Wo respectively; The preprocessed log security data includes the average security incident recovery time, the average abnormal recovery progress, and the log abnormality rate, which are marked as Dt, Dr, and Dh respectively.

4. The data center security audit system based on cloud computing according to claim 1, characterized in that: The data analysis module includes a preprocessing data receiving unit, a network security analysis unit, a system performance analysis unit, a log security analysis unit and a data transmission unit. The preprocessing data receiving unit is used to receive the data transmitted by the data preprocessing module; the network security analysis unit is used to establish a network security analysis model, and import the network security data into the network security analysis unit, and calculate the network security evaluation coefficient of each sub-data area, which is specifically expressed as: , where N i Represents the network security assessment coefficient of the ith sub-data area, Nm i represents the standard deviation of network traffic in the ith sub-data area, Nl represents the average network traffic, and L i Nc represents the network traffic of the ith sub-data area. i represents the standard deviation of the network bandwidth of the ith sub-data area, Nd represents the average network bandwidth, Di represents the network bandwidth of the ith sub-data area, Nt represents the average delay, and Nt i represents the delay of the i-th sub-data area, π and e are natural constants.

5. The data center security audit system based on cloud computing according to claim 4 is characterized in that: The system performance analysis unit is used to establish a system performance analysis model, and import system performance data into the system performance analysis unit to calculate the system performance evaluation coefficient of each sub-data area, which is specifically expressed as: , where W i represents the system performance evaluation coefficient of the ith sub-data area, Wc represents the average storage capacity, Wo represents the average storage bandwidth, and Wd i Indicates the transmission packet loss rate of the i-th sub-data area.

6. The data center security audit system based on cloud computing according to claim 4, characterized in that: The log security analysis unit is used to establish a log security analysis model, import log security data into the log security analysis unit, and calculate the log security assessment coefficient of each sub-data area, which is specifically expressed as: , where Di represents the log security assessment coefficient of the i-th sub-data area, Dhi represents the log anomaly rate of the i-th sub-data area, De represents the average anomaly recovery progress, Dn represents the average safety time recovery time, μ1 and μ2 are the quadratic term coefficient and the linear term coefficient of the average safety time recovery time, and μ1>0, μ2>0; the data transmission unit is used to transmit the analyzed data to the comprehensive security assessment module of the data center.

7. The data center security audit system based on cloud computing according to claim 1, characterized in that: The data center comprehensive security assessment module calculates the audit security assessment index of each sub-data area based on the network security assessment coefficient, the system performance assessment coefficient and the log security assessment coefficient. The specific formula is: , where Y i represents the audit security assessment index of the ith sub-data area, N i represents the network security evaluation coefficient of the ith sub-data area, W i represents the system performance evaluation coefficient of the ith sub-time zone, D i represents the log security assessment coefficient of the i-th sub-time zone, λ1, λ2 and λ3 are the proportional coefficients corresponding to different assessment coefficients, and λ1>0, λ2>0, λ3>0; the audit security assessment index of the target data zone is calculated by the audit security assessment index of each sub-data zone, and the specific calculation formula is: .

8. The data center security audit system based on cloud computing according to claim 1, characterized in that: The data center security level determination module extracts the maximum and minimum values ​​of the audit security assessment index of each sub-data area according to the audit security assessment index transmitted by the data center comprehensive security assessment module, which are respectively recorded as Y max and Y min ; Calculate the security difference η of the target data area. The specific calculation formula is: , and Y min Set to the lower limit of level 3, Y min ×(1+η / 2) is set as the secondary lower limit, Y max Set as the first-level lower limit; if Y≥Y max , indicating that the audit security assessment index of the target data area is greater than or equal to the first-level lower limit, then the target data area is at security level I. min ×(1+η / 2)≤Y<Y max , indicating that the audit security assessment index of the target data area is greater than or equal to the lower limit of the second level and less than the lower limit of the first level. At this time, the target data area is at security level II. If Y min ≤Y<Y min × (1+η / 2), indicating that the audit security assessment index of the target data area is greater than or equal to the lower limit of level 3 and less than the lower limit of level 2. At this time, the target data area is at security level III. If Y<Y min , then this target data area is in a dangerous state.

Images