Enterprise equal insurance processing and password application intelligent evaluation system based on big data

Abstract

The invention relates to the technical field of enterprise level protection, in particular to an enterprise level protection processing and password application intelligent evaluation system based on big data, which comprises a dynamic level protection requirement adaptation module, a level protection requirement adaptation module, a level protection requirement adaptation module, a level protection requirement adaptation module, a level protection requirement adaptation module, a level protection requirement adaptation module, a level protection requirement adaptation module and a level protection requirement adaptation module, and the level protection requirement adaptation module is used for carrying out feature extraction on collected multi-dimensional data, constructing multi-dimensional feature vectors and establishing a level protection compliance evaluation model; based on the multi-dimensional feature vector and the evaluation model, constructing a dynamic adaptation model, and automatically evaluating the current grade protection compliance according to real-time data; the password security evaluation and optimization module is used for establishing an intelligent evaluation algorithm of password use intensity based on big data analysis and evaluating password intensity; and the encrypted traffic dynamic analysis and anomaly detection module is used for generating an abnormal traffic feature template by using an unsupervised learning algorithm and automatically identifying potential malicious behaviors. According to the method, the security monitoring capability of the encrypted traffic is improved, powerful technical support is provided for coping with novel attacks, and damage of potential hidden threats to an enterprise information system is effectively prevented.

Description

Technical Field

[0001] The present invention relates to the field of enterprise grade protection technology, and in particular to an enterprise grade protection processing and cryptographic application intelligent evaluation system based on big data. Background Art

[0002] With the rapid development of information technology and the advancement of digital transformation, the security issues of enterprise information systems have become increasingly prominent. Especially in the face of increasingly complex and diverse network security threats, enterprises have an increasingly urgent need for information security. The country has implemented a multi-level protection system (MLP) for information security, requiring enterprises to take corresponding security protection measures based on the security risk level of their information systems. However, the existing MLPS assessment system usually relies on manual inspection and static compliance assessment, and lacks the ability of real-time dynamic monitoring and automated processing. This leads to a large compliance blind spot when enterprises implement MLPS. Especially in the face of complex network environments and rapidly changing security threats, traditional assessment methods are difficult to provide effective support.

[0003] In addition, the security of cryptographic applications is also an important part of enterprise information security. With the widespread application of encryption technology, the security of various cryptographic algorithms and protocols has become a core issue in data protection. When using encryption technology, many companies fail to conduct timely and systematic checks on the security assessment of cryptographic algorithms, the use of encryption protocols, and the optimization of cryptographic strength, resulting in potential cryptographic security vulnerabilities in the actual operation of the system, which in turn affects the security of the entire information system.

[0004] At the same time, with the increase in encrypted traffic, traditional network monitoring methods are difficult to effectively identify and analyze potential threats in encrypted data streams. Although deep packet inspection (DPI) technology can analyze encrypted traffic, it still has limitations in dynamic detection and anomaly identification. Especially when faced with complex and hidden malicious traffic, traditional methods are difficult to quickly identify and respond to.

[0005] Therefore, existing technologies urgently need to be improved to meet the following needs: First, based on big data technology, real-time collection and analysis of multi-dimensional data of enterprise information systems can be carried out to dynamically adjust the level protection compliance assessment and generate real-time rectification suggestions; second, in-depth security assessment of cryptographic applications, including password strength analysis and security assessment of encryption protocols; third, in encrypted traffic, hidden threats and malicious behaviors can be effectively identified and prevented. Summary of the invention

[0006] The present invention provides an enterprise security protection processing and cryptographic application intelligent evaluation system based on big data.

[0007] An enterprise security protection processing and cryptographic application intelligent evaluation system based on big data, including:

[0008] Dynamic level protection demand adaptation module: Based on the real-time collection of multi-dimensional data from the enterprise information system, including network topology data, user behavior feature data, and terminal security status data, feature extraction is performed on the collected multi-dimensional data, including key node traffic fluctuation features, abnormal access mode features, and device security scores, to construct a multi-dimensional feature vector. In combination with the requirements of the national information security level protection standard, a level protection compliance evaluation model is established. Based on the multi-dimensional feature vector and the evaluation model, a dynamic adaptation model is constructed to automatically evaluate the current level protection compliance based on real-time data. The multi-dimensional feature data collected in real time is input into the dynamic adaptation model to analyze whether the current status of the enterprise information system meets the level protection requirements. If insufficient compliance in a certain dimension is detected, dynamic rectification suggestions are automatically generated.

[0009] Password security assessment and optimization module: Analyze the cryptographic algorithms and protocols used in enterprise information systems, including security assessment of symmetric encryption, asymmetric encryption and hash algorithms; establish an intelligent assessment algorithm for password usage strength based on big data analysis to assess password strength;

[0010] Dynamic analysis and anomaly detection module for encrypted traffic: Based on deep packet inspection (DPI) technology, it deconstructs the encrypted data stream transmitted in the enterprise network, extracts the distribution characteristics of encryption protocols, and marks encryption protocol risks; for hidden threats in encrypted data, it uses unsupervised learning algorithms to generate abnormal traffic feature templates to automatically identify potential malicious behaviors, including malicious code propagation or abuse of encrypted channels.

[0011] Optionally, the network topology data includes node connection relationships, traffic load distribution, and key node reachability;

[0012] The user behavior characteristic data includes login frequency, operation mode, and access records;

[0013] The terminal security status data includes device patch status, firewall rule updates, and malware detection results;

[0014] The construction of the multidimensional feature vector includes extracting features from the collected multidimensional data:

[0015] Extract key node traffic fluctuation characteristics: Identify abnormal change patterns of key node traffic through time series analysis;

[0016] Extract abnormal access pattern features: Use clustering algorithms to identify abnormal patterns in user access behavior;

[0017] Extract device security score: Calculate the device security level score based on the patch status and protection rules of the terminal device;

[0018] Based on the result of feature extraction, construct a multidimensional feature vector V = {v 1 ,v 2 ,...,v n}, where v n represents the nth eigenvector.

[0019] Optionally, the evaluation indicators of the level protection compliance evaluation model include network traffic fluctuation compliance indicator, user access abnormality compliance indicator, and equipment security compliance indicator.

[0020] Optionally, the network traffic fluctuation compliance indicator is R 1 :Measures the abnormal fluctuation of traffic at key nodes, reflecting whether the traffic is stable. Excessive fluctuation may indicate a safety hazard. Calculation method: Among them, V 1 is the real-time key node traffic fluctuation characteristics, R normal The normal fluctuation range of historical traffic. If the current traffic fluctuation is too different from the normal historical fluctuation, the compliance score is low;

[0021] The user access abnormality compliance index is R 2 : Measures abnormal patterns in user access behavior, including login frequency and geographic location anomalies. If abnormal behavior exists, it may lead to unauthorized access or malicious attacks. Calculation method: Among them, V 2 is the real-time user behavior abnormality, R norm The distribution range of historical normal user behavior (such as normal login frequency). If the current behavior is significantly different from the normal pattern, the compliance score is low.

[0022] The equipment safety compliance index is R 3 :Measures the security of the device, taking into account patch status and firewall rules. If the device has serious vulnerabilities or unupdated security patches, the compliance score is low. Calculation method: Among them, V 3 For equipment safety score, R max It is the maximum value of the device security score (e.g. 100 points). If the device security score is lower, the compliance score will be lowered accordingly.

[0023] Optionally, the dynamic adaptation model is used to compare the standardized multidimensional feature vector with the evaluation index to calculate the compliance score S of the dynamic adaptation model. compliance , expressed as:

[0024] S compliance =w 1 ·f(V 1 ,R 1 )+w 2 ·f(V2 , R 2 ) + w 3 ·f(V 3 , R 3 ), where f(V u , R u )

[0025] is an evaluation function, representing the difference between the multi-dimensional feature vector and the evaluation index, using the absolute difference measurement method: f(V u , R u ) = 1 - |V u - R u |;

[0026] Compliance assessment and rectification suggestions:

[0027] If S compliance ≥ Threshold (e.g., 0.8), it means meeting the requirements of classified protection;

[0028] If S compliance < Threshold, rectification suggestions will be generated according to the evaluation results, such as adjusting the traffic of key nodes, optimizing user behavior monitoring, enhancing device security, etc.

[0029] Optionally, the intelligent evaluation algorithm in the password security assessment and optimization module performs evaluation by combining the following factors:

[0030] Password length score L pwd : Calculate the score according to the actual length of the password. The larger the value, the stronger it is: When the length exceeds the recommended minimum length, the score is 1;

[0031] Password complexity score C pwd : Calculate the score according to the types of characters included in the password (such as uppercase letters, lowercase letters, numbers, special characters):

[0032] Password update frequency score F pwd : Calculate the score based on the usage period of the password. The higher the password update frequency, the higher the score:

[0033] Optionally, the intelligent evaluation algorithm comprehensively calculates the password strength S pwd : S pwd = w 4 ·L pwd + w 5 ·C pwd + w 6 ·F pwd , where w 4 , w5 ,w 6 is the weight coefficient, satisfying w 4 +w 5 +w 6 =1;

[0034] The password strength evaluation result S pwd Compared with the recommended standard, if S pwd If the value is less than the preset threshold value (0.8) of the recommendation standard, an optimization suggestion is generated.

[0035] Optionally, the deep packet inspection deconstructs the encrypted data stream transmitted in the enterprise network, analyzes the protocol header of each data packet, and identifies the encryption protocol type P type (e.g. HTTPS, TLS, IPSec) and their versions;

[0036] The collected encryption protocol type data P type Summarize and calculate its distribution characteristics and define the encryption protocol distribution matrix D protocol :

[0037] in, Indicates the sth encryption protocol; Indicates the frequency of use of the protocol in traffic, analyzes the distribution characteristics of encryption protocols, that is, the usage ratio, determines whether there is a high proportion of traditional outdated protocols or an abnormally low proportion of a certain protocol, and marks the anomaly.

[0038] Optionally, the dynamic analysis and anomaly detection module of the encrypted traffic generates an abnormal traffic feature template using an unsupervised learning algorithm to automatically identify potential malicious behaviors, specifically including:

[0039] Monitor the encrypted data stream transmitted in the enterprise network in real time and extract traffic features, including session features and data features;

[0040] The collected traffic feature points are normalized and expressed as a feature vector set X = {x 1 ,x 2 ,…,x d}, where each x d Represents a traffic feature;

[0041] The unsupervised learning algorithm based on density clustering algorithm clusters the feature data or detects anomalies, mines potential abnormal traffic patterns, and identifies abnormal traffic behaviors by detecting sparse points in density distribution.

[0042] Optionally, the unsupervised learning algorithm of the density-based clustering algorithm specifically includes:

[0043] Define the radius parameter ∈ and the minimum number of points MinPts, and perform density clustering on the feature vector set X. For each traffic feature point x d , calculate the number of its neighborhood points N(x d ): N(x d ) = {x j ∈ X | x d - x j ≤ ∈}:

[0044] If |N(x i )| < MinPts, mark it as an abnormal point;

[0045] If |N(x i )| ≥ MinPts, mark it as a normal point;

[0046] Generate an abnormal traffic feature template: Aggregate and analyze the identified abnormal points x d to extract the traffic feature template T threat of the hidden threat. The template content includes:

[0047] Abnormal packet pattern: Abnormal packet length distribution or frequency;

[0048] Abnormal session feature: A large number of sessions in a short time, abnormal IP address range;

[0049] Protocol abuse pattern: Abnormal TLS handshake behavior, high proportion of encrypted traffic;

[0050] The template is expressed as: T threat = {(L packet , F session )}, where L packet is the abnormal packet length range, and F session is the abnormal session frequency.

[0051] The beneficial effects of the present invention:

[0052] In the present invention, by collecting multi-dimensional data (including network topology data, user behavior feature data, and terminal security status data) in the enterprise information system in real time, and combining with the national information security level protection standard, a dynamic adaptation model is constructed, realizing the automation and precision of the enterprise level protection compliance assessment. Through the real-time monitoring and analysis of the traffic fluctuations of key nodes, abnormal user access behaviors, and device security conditions, the assessment of the security status of the enterprise information system can be dynamically adjusted. Different from the traditional static level protection compliance assessment method, the dynamic adaptation model of the present invention can automatically adjust the assessment criteria according to real-time data, timely discover and respond to the problems of insufficient level protection compliance, and generate specific rectification suggestions.

[0053] The present invention, through the security assessment of cryptographic algorithms (including symmetric encryption, asymmetric encryption and hash algorithms) and their protocols used in enterprise information systems, combines big data technology, and introduces an intelligent assessment based on password usage strength. It not only assesses the length, complexity and update frequency of passwords, but also optimizes password strength in real time through big data analysis. In encryption protocols and password usage scenarios, it can identify potential password vulnerabilities and automatically generate optimization suggestions, detect outdated or insecure encryption protocols, avoid abuse of traditional outdated protocols, and further improve the security of data transmission.

[0054] The present invention uses deep packet inspection (DPI) technology and unsupervised learning algorithms to dynamically analyze encrypted data streams transmitted in enterprise networks, thereby realizing automatic identification of potential hidden threats in encrypted traffic, extracting encryption protocol distribution characteristics, and analyzing the usage ratio of encryption protocols, thereby identifying abnormal situations such as protocol abuse and version mismatch, and preventing the spread of malicious code in encrypted traffic or abuse of encrypted channels. Through density-based clustering algorithms and traffic behavior analysis, abnormal traffic feature templates can be automatically generated to identify and prevent potential malicious behaviors at an early stage, which not only improves the security monitoring capabilities of encrypted traffic, but also provides strong technical support for responding to new attacks, effectively preventing potential hidden threats from infringing on enterprise information systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings in the following description are only for the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0056] Figure 1 A schematic diagram of functional modules of an evaluation system according to an embodiment of the present invention;

[0057] Figure 2 A schematic diagram of password strength calculation according to an embodiment of the present invention. DETAILED DESCRIPTION

[0058] The present invention is described in detail below in conjunction with the accompanying drawings and specific embodiments. At the same time, it is explained here that in order to make the embodiments more detailed, the following embodiments are the best and preferred embodiments, and those skilled in the art may also adopt other alternatives to implement some known technologies; and the accompanying drawings are only for more specific description of the embodiments, and are not intended to specifically limit the present invention.

[0059] like Figure 1-Figure 2 As shown, a big data-based enterprise security processing and cryptographic application intelligent evaluation system includes:

[0060] Dynamic level protection demand adaptation module: Based on the real-time collection of multi-dimensional data from the enterprise information system, including network topology data, user behavior feature data, and terminal security status data, feature extraction is performed on the collected multi-dimensional data, including key node traffic fluctuation features, abnormal access mode features, and device security scores, to construct a multi-dimensional feature vector. In combination with the requirements of the national information security level protection standard, a level protection compliance evaluation model is established. Based on the multi-dimensional feature vector and the evaluation model, a dynamic adaptation model is constructed to automatically evaluate the current level protection compliance based on real-time data. The multi-dimensional feature data collected in real time is input into the dynamic adaptation model to analyze whether the current status of the enterprise information system meets the level protection requirements. If insufficient compliance in a certain dimension is detected, dynamic rectification suggestions are automatically generated.

[0061] Password security assessment and optimization module: Analyze the cryptographic algorithms and protocols used in enterprise information systems, including security assessment of symmetric encryption, asymmetric encryption and hash algorithms; establish an intelligent assessment algorithm for password usage strength based on big data analysis to assess password strength;

[0062] Dynamic analysis and anomaly detection module for encrypted traffic: Based on deep packet inspection (DPI) technology, it deconstructs the encrypted data stream transmitted in the enterprise network, extracts the distribution characteristics of encryption protocols, and marks encryption protocol risks; for hidden threats in encrypted data, it uses unsupervised learning algorithms to generate abnormal traffic feature templates to automatically identify potential malicious behaviors, including malicious code propagation or abuse of encrypted channels.

[0063] Network topology data includes node connection relationships, traffic load distribution, and key node reachability;

[0064] User behavior characteristic data includes login frequency, operation mode, and access records;

[0065] Endpoint security status data includes device patch status, firewall rule updates, and malware detection results;

[0066] Use data cleaning to ensure the timeliness, consistency and completeness of collected data.

[0067] Network topology data collection:

[0068] Collection content: node connection relationship, traffic load distribution, and key node reachability.

[0069] Collection method:

[0070] Traffic monitoring tools: Use network traffic analysis tools to collect network data packets.

[0071] Topology information: Use network management protocols to collect device connection status and topology.

[0072] Key node monitoring: Regularly send Ping or Traceroute commands to check node reachability and analyze response time.

[0073] User behavior feature data collection:

[0074] Collection content: login frequency, operation mode, access records.

[0075] Collection method:

[0076] Behavior log analysis: Use enterprise application logs (operating system logs) to extract user login and operation behaviors.

[0077] Real-time monitoring tools: Deploy behavior monitoring tools (such as Splunk and Graylog) to collect user operation events in real time.

[0078] Abnormal event capture: Use the rule engine to detect specific behavior patterns (such as frequent login failures).

[0079] Terminal security status data collection:

[0080] Content collected: device patch status, firewall rule updates, and malware detection results.

[0081] Collection method:

[0082] Endpoint management tools: Use endpoint security management platforms to collect device patch and security configuration status.

[0083] Firewall log analysis: Collect log data from firewall devices and check rule updates and policy changes.

[0084] Malware Detection: Logs detected malware events using antivirus software.

[0085] Constructing a multidimensional feature vector includes extracting features from the collected multidimensional data:

[0086] Extract key node traffic fluctuation characteristics: Identify abnormal change patterns of key node traffic through time series analysis;

[0087] Extract abnormal access pattern features: Use clustering algorithms to identify abnormal patterns in user access behavior;

[0088] Extract device security score: Calculate the device security level score based on the patch status and protection rules of the terminal device;

[0089] Based on the result of feature extraction, construct a multidimensional feature vector V = {v 1 ,v 2 ,...,v n}, where v n represents the nth eigenvector.

[0090] Through time series analysis, we can identify the fluctuation characteristics of traffic at key nodes in the network, and then find abnormal traffic patterns. We can extract them through the following steps:

[0091] Time series modeling: Assume that the key node traffic collected at time point t is F t , it is necessary to model the traffic flow in time series and use the autoregressive integrated moving average model to predict the changes in node traffic flow:

[0092]

[0093] Among them, F t is the flow value at time point t, is the parameter of the autoregressive term, which indicates the dependence of the traffic on its own historical value, ∈ t is the white noise error term, which indicates the flow prediction error, p and q are the orders of the model, which indicate the orders of the autoregressive term and the moving average term respectively;

[0094] Abnormal fluctuation detection: After the time series model is established, the prediction error can be calculated to identify abnormal fluctuations in traffic. A threshold δ is set. If the prediction error is greater than the threshold, it is considered an abnormal fluctuation. The calculation is: It is the predicted value of the flow at time point t by the autoregressive integrated moving average model. If the error > δ, the flow fluctuation at that time point is considered abnormal.

[0095] For anomaly detection of user behavior patterns, the KMeans clustering algorithm is used to identify abnormal behavior patterns:

[0096] Suppose there is a set of user behavior data, each user behavior is represented by multiple features, denoted as {u 1 ,u 2 ,…,u l}, where each behavior sample is a multidimensional vector. The KMeans algorithm is used to divide user behaviors into k clusters. The objective function of the KMeans clustering algorithm is: Among them, J is the objective function, which represents the sum of squares from the points within the cluster to the cluster center, and C l is the lth cluster, containing behavioral data points, x j It is cluster C l The jth data point in l is the center (mean) of the lth cluster. After clustering is completed, abnormal behavior is identified based on the distance from the cluster center. If the distance from a behavior point to its cluster center is greater than the set threshold γ, the behavior is considered abnormal. The abnormal behavior detection formula is: distance = ‖x j -μl ‖, if the distance > γ, the user behavior is considered abnormal.

[0097] The extraction equipment safety scores are as follows:

[0098] Patch coverage: The patch coverage of a device measures the ratio of installed patches to patches that need to be installed. installed is the number of installed patches, P total is the total number of patches to be installed, then the patch coverage rate R patch for:

[0099] Firewall rule update frequency: The update frequency of firewall rules also reflects the security of the device. updates The firewall rule update frequency R is the number of times the firewall rule is updated per unit time. fw Calculated as: Where T is the time window and the frequency R fw The higher the value, the more frequent the firewall management and the stronger the security;

[0100] Device Security Score device Calculated by the following weighted formula: S device =α·R patch +β·R fw , α, β are weight coefficients, indicating the importance of each indicator. When α+β=1, a comprehensive device security score is obtained, which usually ranges from 0 to 1. The higher the score, the safer the device.

[0101] The evaluation indicators of the level protection compliance evaluation model include network traffic fluctuation compliance index, user access abnormality compliance index, and equipment security compliance index.

[0102] The network traffic fluctuation compliance index is R 1 :Measures the abnormal fluctuation of traffic at key nodes, reflecting whether the traffic is stable. Excessive fluctuation may indicate a safety hazard. Calculation method: Among them, V 1 is the real-time key node traffic fluctuation characteristics, R normal The normal fluctuation range of historical traffic. If the current traffic fluctuation is too different from the normal historical fluctuation, the compliance score is low;

[0103] The user access anomaly compliance index is R 2 : Measures abnormal patterns in user access behavior, including login frequency and geographic location anomalies. If abnormal behavior exists, it may lead to unauthorized access or malicious attacks. Calculation method: Among them, V 2 is the real-time user behavior abnormality, R normThe distribution range of historical normal user behavior (such as normal login frequency). If the current behavior is significantly different from the normal pattern, the compliance score is low.

[0104] The equipment safety compliance index is R 3 :Measures the security of the device, taking into account patch status and firewall rules. If the device has serious vulnerabilities or unupdated security patches, the compliance score is low. Calculation method: Among them, V 3 For equipment safety score, R max It is the maximum value of the device security score (e.g. 100 points). If the device security score is lower, the compliance score will be lowered accordingly.

[0105] For multidimensional feature vector V 1 ,V 2 ,V 3 And the evaluation index R 1 ,R 2 ,R 3 ,R 4 Normalize them so that their values ​​are in the range [0,1]: Among them, V min and V max are the minimum and maximum values ​​of the feature vector V or the index R, respectively. The dynamic adaptation model is used to compare the standardized multidimensional feature vector with the evaluation index and calculate the compliance score S of the dynamic adaptation model. compliance , expressed as:

[0106] S compliance =w 1 ·f(V 1 ,R 1 )+w 2 ·f(V 2 ,R 2 )+w 3 ·f(V 3 ,R 3 ), where f(V u ,R u )

[0107] is an evaluation function, which represents the difference between the multidimensional feature vector and the evaluation index, and uses the absolute difference measurement method: f(V u ,R u )=1-|V u -R u |;

[0108] Compliance assessment and rectification suggestions:

[0109] If S compliance ≥Threshold (e.g. 0.8), it means that the level protection requirements are met;

[0110] If S compliance <Threshold, rectification suggestions are generated based on the evaluation results, such as adjusting the traffic of key nodes, optimizing user behavior monitoring, enhancing device security, etc.

[0111] The intelligent evaluation algorithm in the password security evaluation and optimization module conducts evaluations by combining the following factors:

[0112] Password length score L pwd : Calculate the score based on the actual length of the password. The larger the value, the stronger it indicates: When the length exceeds the recommended minimum length, the score is 1;

[0113] Password complexity score C pwd : Calculate the score based on the types of characters included in the password (such as uppercase letters, lowercase letters, numbers, special characters):

[0114] Password update frequency score F pwd : Calculate the score based on the usage period of the password. The higher the password update frequency, the higher the score:

[0115] The intelligent evaluation algorithm comprehensively calculates the password strength S based on the password length score, password complexity score, and password update frequency score pwd : S pwd = w 4 ·L pwd + w 5 ·C pwd + w 6 ·F pwd where w 4 , w 5 , w 6 are weight coefficients, satisfying w 4 + w 5 + w 6 = 1;

[0116] Compare the password strength evaluation result S pwd with the recommended standard. If S pwd is less than the preset threshold (0.8) of the recommended standard, then optimization suggestions are generated, including:

[0117] Increase the password length or complexity;

[0118] Shorten the password update period;

[0119] Replace insecure password algorithms or protocols.

[0120] Deep packet inspection deconstructs the encrypted data stream transmitted in the enterprise network, analyzes the protocol header of each data packet, and identifies the encryption protocol type P type (e.g. HTTPS, TLS, IPSec) and their versions;

[0121] The collected encryption protocol type data P type Summarize and calculate its distribution characteristics and define the encryption protocol distribution matrix D protocol :

[0122] in, Indicates the sth encryption protocol;

[0123] Indicates the frequency of use of the protocol in traffic. Analyzes the distribution characteristics of encryption protocols, that is, the usage ratio, to determine whether there is a high ratio of traditional outdated protocols or an abnormally low ratio of a certain protocol, and marks the anomaly. For example:

[0124] Outdated protocols are too high: If the proportion of outdated protocols (such as TLS1.0) exceeds 5%, it is marked as abnormal.

[0125] Imbalanced protocol ratio: If the usage ratio of a certain protocol deviates from the historical baseline or industry benchmark.

[0126] The dynamic analysis and anomaly detection module of encrypted traffic uses unsupervised learning algorithms to generate abnormal traffic feature templates and automatically identify potential malicious behaviors, including:

[0127] Monitor the encrypted data stream transmitted in the enterprise network in real time and extract traffic features, including session features and data features, including:

[0128] Session characteristics: source IP, destination IP, port number, session duration;

[0129] Data characteristics: packet length distribution, packet transmission frequency, and packet size fluctuation;

[0130] The collected traffic feature points are normalized and expressed as a feature vector set X = {x 1 ,x 2 ,…,x d}, where each x d Represents a traffic feature;

[0131] The unsupervised learning algorithm based on density clustering algorithm clusters the feature data or detects anomalies, mines potential abnormal traffic patterns, and identifies abnormal traffic behaviors by detecting sparse points in density distribution.

[0132] The unsupervised learning algorithms of density-based clustering algorithms specifically include:

[0133] Define the radius parameter ∈ and the minimum number of points MinPts, and perform density clustering on the feature vector set X. For each traffic feature point x d , calculate the number of its neighborhood points N(x d ): N(x d ) = {x j ∈ X | x d - x j ≤ ∈}:

[0134] If |N(x i )| < MinPts, mark it as an outlier;

[0135] If |N(x i )| ≥ MinPts, mark it as a normal point;

[0136] Generate an abnormal traffic feature template: Aggregate and analyze the identified outliers x d to extract the traffic feature template T threat of the hidden threat. The template content includes:

[0137] Abnormal packet pattern: Abnormal packet length distribution or frequency;

[0138] Abnormal session characteristics: A large number of sessions in a short period of time, abnormal IP address range;

[0139] Protocol abuse pattern: Abnormal TLS handshake behavior, high proportion of encrypted traffic;

[0140] The template is represented as: T threat = {(L packet , F session )}, where L packet is the abnormal packet length range, and F session is the abnormal session frequency;

[0141] Automatically identify potential malicious behaviors. Using the generated abnormal traffic feature template Tthreat, match and detect real-time traffic, and automatically identify potential malicious behaviors, including:

[0142] Malicious code propagation: Detect a significant increase in the session frequency of abnormal traffic or an abnormal distribution of packet sizes.

[0143] Encrypted channel abuse: Identify illegal content transmitted through encrypted protocols (such as hidden communication or data leakage).

[0144] The present invention covers any substitution, modification, equivalent method and scheme made on the essence and scope of the present invention. In order to make the public have a thorough understanding of the present invention, specific details are described in detail in the following preferred embodiments of the present invention, but those skilled in the art can fully understand the present invention without the description of these details. In addition, in order to avoid unnecessary confusion about the essence of the present invention, well-known methods, processes, procedures, components and circuits are not described in detail.

[0145] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. An enterprise security protection processing and cryptographic application intelligent evaluation system based on big data, characterized in that: include: Dynamic level protection demand adaptation module: Based on the real-time collection of multi-dimensional data from the enterprise information system, including network topology data, user behavior feature data, and terminal security status data, feature extraction is performed on the collected multi-dimensional data, including key node traffic fluctuation features, abnormal access mode features, and device security scores, to construct a multi-dimensional feature vector. In combination with the requirements of the national information security level protection standard, a level protection compliance evaluation model is established. Based on the multi-dimensional feature vector and the evaluation model, a dynamic adaptation model is constructed to automatically evaluate the current level protection compliance based on real-time data. The multi-dimensional feature data collected in real time is input into the dynamic adaptation model to analyze whether the current status of the enterprise information system meets the level protection requirements. If insufficient compliance in a certain dimension is detected, dynamic rectification suggestions are automatically generated. Cryptographic security assessment and optimization module: Analyze the cryptographic algorithms and protocols used in enterprise information systems, including security assessment of symmetric encryption, asymmetric encryption and hash algorithms; Establish an intelligent evaluation algorithm for password usage strength based on big data analysis to evaluate password strength; Dynamic analysis and anomaly detection module for encrypted traffic: Based on deep packet inspection technology, it deconstructs the encrypted data stream transmitted in the enterprise network, extracts the distribution characteristics of encryption protocols, and marks encryption protocol risks; for hidden threats in encrypted data, it uses unsupervised learning algorithms to generate abnormal traffic feature templates to automatically identify potential malicious behaviors.

2. According to the big data-based enterprise security processing and cryptographic application intelligent evaluation system of claim 1, it is characterized by: The network topology data includes node connection relationships, traffic load distribution, and key node reachability; The user behavior characteristic data includes login frequency, operation mode, and access records; The terminal security status data includes device patch status, firewall rule updates, and malware detection results; The construction of the multidimensional feature vector includes extracting features from the collected multidimensional data: Extract key node traffic fluctuation characteristics: Identify abnormal change patterns of key node traffic through time series analysis; Extract abnormal access pattern features: Use clustering algorithms to identify abnormal patterns in user access behavior; Extract device security score: Calculate the device security level score based on the patch status and protection rules of the terminal device; Based on the result of feature extraction, construct a multidimensional feature vector V = {v1, v2, ..., v n }, where v n represents the nth eigenvector.

3. According to the big data-based enterprise security processing and cryptographic application intelligent evaluation system of claim 2, it is characterized by: The evaluation indicators of the level protection compliance evaluation model include network traffic fluctuation compliance indicator, user access abnormality compliance indicator, and equipment security compliance indicator.

4. According to the big data-based enterprise security processing and cryptographic application intelligent evaluation system of claim 3, it is characterized by: The network traffic fluctuation compliance index is R1: It measures the abnormal fluctuation of traffic at key nodes and reflects whether the traffic is stable. The calculation method is: Among them, V1 is the real-time key node traffic fluctuation characteristics, R normal is the normal fluctuation range of historical traffic; The user access anomaly compliance indicator is R2: It measures the abnormal patterns in user access behavior, including login frequency and geographic location anomalies. If abnormal behavior exists, it will lead to unauthorized access or malicious attacks. The calculation method is: Among them, V2 is the real-time user behavior abnormality, R norm The distribution range of historical normal user behavior; The device security compliance indicator is R3: measures the security of the device, taking into account patch status and firewall rules, and is calculated as follows: Among them, V3 is the device security score, R max The maximum value of the device security score.

5. According to the big data-based enterprise security processing and cryptographic application intelligent evaluation system of claim 4, it is characterized by: The dynamic adaptation model is used to compare the multidimensional feature vector with the evaluation index and calculate the compliance score S of the dynamic adaptation model. compliance , expressed as: S compliance =w1·f(V1,R1)+w2·f(V2,R2)+w3·f(V3,R3), where f(V u ,R u ) is an evaluation function, which represents the difference between the multidimensional feature vector and the evaluation index, and uses the absolute difference measurement method: f(V u ,R u )=1-|V u -R u |; Compliance assessment and rectification suggestions: If S compliance ≥Threshold (e.g. 0.8), it means that the level protection requirements are met; If S compliance < is less than the Threshold, rectification suggestions are generated based on the evaluation results.

6. According to the big data-based enterprise security processing and cryptographic application intelligent evaluation system of claim 1, it is characterized by: The intelligent assessment algorithm in the password security assessment and optimization module combines the following factors for assessment: Password length score L pwd : The score is calculated based on the actual length of the password, with larger values ​​indicating stronger passwords: When the length exceeds the recommended minimum length, the score is 1; Password complexity score C pwd : Calculate the score based on the types of characters contained in the password: Password update frequency score F pwd : The score is calculated based on the password usage cycle. The higher the password update frequency, the higher the score:

7. According to the big data-based enterprise security processing and cryptographic application intelligent evaluation system of claim 6, it is characterized by: The intelligent evaluation algorithm calculates the password strength S by combining the password length score, password complexity score, and password update frequency score. pwd :S pwd =w4·L pwd +w5·C pwd +w6·F pwd , where w4, w5, w6 are weight coefficients, satisfying w4+w5+w6=1; The password strength evaluation result S pwd Compared with the recommended standard, if S pwd If the value is less than the preset threshold of the recommendation standard, an optimization suggestion is generated.

8. According to the big data-based enterprise security processing and cryptographic application intelligent evaluation system of claim 1, it is characterized by: The deep packet inspection deconstructs the encrypted data stream transmitted in the enterprise network, analyzes the protocol header of each data packet, and identifies the encryption protocol type P type and its versions; The collected encryption protocol type data P type Summarize and calculate its distribution characteristics and define the encryption protocol distribution matrix D protocol : in, Indicates the sth encryption protocol; Indicates the frequency of use of the protocol in traffic, analyzes the distribution characteristics of encryption protocols, determines whether there is a high proportion of traditional outdated protocols or an abnormally low proportion of a certain protocol, and marks the anomaly.

9. According to the big data-based enterprise security processing and cryptographic application intelligent evaluation system of claim 1, it is characterized by: The dynamic analysis and anomaly detection module of the encrypted traffic uses an unsupervised learning algorithm to generate an abnormal traffic feature template, and automatically identifies potential malicious behaviors, specifically including: Monitor the encrypted data stream transmitted in the enterprise network in real time and extract traffic features, including session features and data features; The collected traffic feature points are normalized and expressed as a feature vector set X = {x1, x2, ..., x d }, where each x d Represents a traffic feature; The unsupervised learning algorithm based on density clustering algorithm clusters the feature data or detects anomalies to mine potential abnormal traffic patterns.

10. The enterprise security protection processing and cryptographic application intelligent evaluation system based on big data according to claim 9 is characterized in that: The unsupervised learning algorithm of the density-based clustering algorithm specifically includes: Define the radius parameter ∈ and the minimum number of points MinPts, perform density clustering on the feature vector set X, and for each traffic feature point x d , calculate the number of its neighborhood points N(x d ): N(x d )={x j ∈X|x d -x j ≤∈}: If |N(x i )| < MinPts, then it is labeled as an outlier; If |N(x i )|≥MinPts, it is marked as a normal point; Generate abnormal traffic feature template: identify the abnormal point x d Aggregate analysis to extract traffic feature templates of hidden threats threat , the template content includes: Abnormal packet patterns: abnormal packet length distribution or frequency; Abnormal session characteristics: a large number of sessions in a short period of time, abnormal IP address range; Protocol abuse patterns: unusual TLS handshake behavior, high percentage of encrypted traffic; The template is represented by: T threat ={(L packet ,F session )}, where L packet is the abnormal packet length range, F session is the abnormal session frequency.

Images