Network space information security control method and system

Abstract

The invention discloses a network space information security control method and system, and relates to the technical field of network information security, the penetration test intensity is constrained according to hazard scores in a preset test period, if the network security degree is lower than expectation, vulnerability detection and repair are performed, otherwise, key data are backed up or transferred; an abnormal event is monitored and recognized in real time, an alarm instruction is sent out if abnormity exists, if the alarm is not responded and an abnormal node exceeds the expectation, the intervention degree is generated according to corresponding abnormal alarm data, and a second-level alarm mechanism is started for the abnormal event when the intervention degree exceeds the expectation; classifying the abnormal events and constructing a response strategy library, if alarm instructions are continuously received, switching alarm channels to ensure instruction receiving, evaluating the abnormal events by using a hazard evaluation model, and matching and executing corresponding response strategies; when it is determined that response is needed, a targeted processing strategy is rapidly output, and rapid targeted response is achieved when a network system is controlled.

Description

Technical Field

[0001] The present invention relates to the field of network information security technology, and in particular to a network space information security control method and system. Background Art

[0002] With the rapid development of information technology, cyberspace has become the main platform for the exchange and storage of various types of information, and is widely used in various fields such as government, finance, medical care, and education. However, with the popularity and increasing complexity of network applications, network security threats are becoming increasingly diverse and complex. Security incidents such as data leakage, network attacks, and malware propagation occur frequently, posing serious challenges to the stable operation of information systems and data security. Therefore, how to effectively monitor network activities, identify and evaluate abnormal events in real time, and take corresponding security control measures in a timely manner has become a key issue in current network security management.

[0003] In the Chinese invention patent with application publication number CN113382405A, a method for controlling cyberspace information security is disclosed. By automatically and continuously monitoring information network links, geographic and time domain feature security control is implemented, the secure and reliable instant response verification protocol for privacy protection is intelligently matched, the validity of the secure and reliable instant response verification protocol for privacy protection is instantly authenticated, and unique dynamic features and secure and reliable instant authentication of communication network links are used to achieve point-to-point instant secure and reliable communication that allows privacy protection. Infinite element feature encryption technology is superimposed to support secure and reliable instant verification of blockchains for a large number of users, solving problems such as uncertainty and inconsistency of cyberspace information network links, tamperable records, difficulty in tracing the responding parties, and small number of blockchain users.

[0004] Existing network security protection methods have many deficiencies in real-time monitoring and risk assessment. They often rely on static rules and preset thresholds, and are difficult to dynamically adapt to changing security threats. In addition, traditional security response mechanisms lack intelligence and automation, and cannot flexibly adjust response strategies according to the degree of risk, resulting in unsatisfactory response speed and effect when facing complex and changing security incidents. At the same time, the existing system lacks effective integration and coordination in penetration testing, alarm mechanisms, and response strategy optimization, making it difficult to achieve comprehensive, in-depth, and continuous control of network security risks. The intelligence level and response capabilities of network security management are poor, and the security and stable operation of information systems are difficult to guarantee.

[0005] To this end, the present invention provides a cyberspace information security control method and system. Summary of the invention

[0006] 1. Technical issues to be resolved

[0007] In view of the deficiencies in the prior art, the present invention provides a cyberspace information security control method and system, which constrains the penetration test intensity according to the hazard score within a preset test cycle. If the network security level is lower than expected, vulnerability detection and repair are performed, otherwise key data is backed up or transferred; abnormal events are monitored and identified in real time, and an alarm instruction is issued if an abnormality exists. If the alarm is not responded to and the abnormal nodes exceed expectations, the intervention degree is generated from the corresponding abnormal alarm data, and a secondary alarm mechanism is enabled for the abnormal event when the intervention degree exceeds expectations; abnormal events are classified and a response strategy library is constructed. If alarm instructions are received continuously, the alarm channel is switched to ensure instruction reception, and a hazard assessment model is used to evaluate abnormal events and match and execute corresponding response strategies; targeted processing strategies are quickly output to achieve rapid and targeted responses when controlling the network system; thereby solving the technical problems recorded in the background technology.

[0008] (II) Technical solution

[0009] To achieve the above objectives, the present invention is implemented through the following technical solutions:

[0010] A cyberspace information security control method includes: monitoring network activities in real time and collecting abnormal events and their impact data; obtaining hazard scores after hazard assessment and summarizing to generate a risk coefficient Ro; if the risk coefficient Ro exceeds a risk threshold, determining the access rights of each user and implementing role-based access control;

[0011] During the preset test cycle, the penetration test intensity is constrained according to the hazard score, the penetration test data is collected to generate a test set, and a penetration coefficient is constructed to evaluate the network security level. If the penetration coefficient exceeds the threshold, vulnerability detection and repair are carried out, otherwise key data is backed up or transferred;

[0012] Real-time monitoring and identification of abnormal events. If an abnormality exists, an alarm command is issued. If the alarm is not responded to and the abnormal nodes exceed expectations, the intervention degree Iop is generated from the corresponding abnormal alarm data. When the intervention degree Iop exceeds expectations, the secondary alarm mechanism is activated for abnormal events.

[0013] Classify abnormal events and build a response strategy library. If alarm instructions are received continuously, switch the alarm channel to ensure instruction reception. Use the hazard assessment model to evaluate abnormal events and match and execute corresponding response strategies.

[0014] The response feedback data is collected to construct the response coefficient. If the response coefficient is lower than the response threshold, an optimization instruction is issued. The response strategy is optimized through principal component analysis and genetic algorithm, the strategy library is updated and the data backup process is constrained.

[0015] Furthermore, in the security control stage, network activities are monitored in real time, and after collecting and annotating abnormal events and corresponding impact data, descriptions are added to the corresponding event impacts; using abnormal event data as input, a hazard assessment is performed using the trained hazard assessment model to obtain the corresponding hazard score; after summarizing the hazard scores and occurrence time nodes of abnormal events in the current monitoring cycle, they are summarized as abnormal status data.

[0016] Further, a penetration test is performed within a preset test period, corresponding test data is obtained, and the obtained test data is aggregated to generate a penetration test data set;

[0017] The test intensity Qop of the penetration test is constrained according to the hazard score. The constraint method is as follows:

[0018]

[0019] Among them, p is the number of abnormal events, Yf ij is the difference in hazard scores between the ith and jth abnormal events, Yf a It is the average value of the difference, and the weight coefficient is: 0≤F1≤1, 0≤F2≤1, and F1+F2=1.

[0020] Furthermore, taking the penetration test data in the penetration test data set as input, the trained penetration security evaluation model is used to evaluate the penetration security and output the penetration coefficient, and the corresponding processing method is selected according to the relationship between the penetration coefficient and the corresponding threshold; if the obtained penetration coefficient exceeds the corresponding penetration threshold, the current network system is tested for vulnerabilities, and the corresponding vulnerability data is obtained, and the corresponding patching plan is matched for the vulnerability obtained for detection; if the obtained penetration coefficient does not exceed the corresponding penetration threshold, the selected data is backed up or transferred.

[0021] Furthermore, the network system is monitored in real time and the corresponding monitoring data is obtained, which is summarized as abnormal event data; the abnormal event data is used as data to identify the abnormal event using the trained abnormal event recognition model, and if an abnormal event exists, an alarm instruction is issued to the outside;

[0022] If the receiving end does not respond after receiving the alarm command, the time node that did not respond will be regarded as an abnormal node. If the number of abnormal nodes in this stage exceeds expectations, the time information of each abnormal node, the frequency of abnormal events and the location area where they occur are obtained, and the abnormal alarm data set is generated after aggregation.

[0023] Furthermore, the intervention degree Iop is generated from the abnormal alarm data set. If the obtained intervention degree Iop exceeds the preset intervention threshold, a secondary alarm instruction is issued to the outside. The method of generating the intervention degree Iop is as follows:

[0024]

[0025] Wherein: t is the time variable, t0≤t≤t1; t0 and t1 are the start and end time of the time interval, X=(x, y), is the location where the abnormal event occurs, x∈Ω, Ω is the spatial investigation area; f(t,x) is the frequency function of the abnormal event; e(t,x) is the severity function of the abnormal event; p(x)≥0 is the regional importance function; w(x) is the spatial weighting function, α, β, γ are the weight coefficients.

[0026] Furthermore, after collecting event data of several abnormal events in the current stage as input, the abnormal events are classified by a pre-trained classification algorithm to obtain several event classes; several response strategies corresponding to the event classes are summarized, and after review, a corresponding response strategy library is generated.

[0027] Furthermore, if the first-level alarm command is received continuously or the second-level alarm command is received, the event reporting channel is switched, and after the network system detects an abnormal event, the trained hazard assessment model is used to evaluate the abnormality of the abnormal event and obtain the corresponding hazard score;

[0028] If the obtained hazard score exceeds expectations, a pre-trained recommendation algorithm is used to match the corresponding response strategy for the abnormal event from the response strategy library, and the response strategy is executed to respond to the current abnormal event.

[0029] Furthermore, after responding to the current abnormal event, the corresponding response feedback data is collected and obtained, and the response feedback data is used as input. The trained feedback evaluation model is used to evaluate the response feedback and output the response coefficient; if the obtained response coefficient is lower than the response threshold, an optimization instruction is issued to the outside.

[0030] Furthermore, after receiving the optimization instruction, principal component analysis is performed on the abnormal event data, response feedback data and response strategy data to obtain the key factors affecting the feedback response; the pre-trained genetic algorithm optimizes the response strategy based on the key factors. If the current abnormal event is still ongoing or reoccurs, the response strategy is re-matched to the corresponding abnormal event and the optimized response strategy is executed.

[0031] Furthermore, when no abnormal event is identified, the key data is backed up, and the frequency of data backup is constrained. After the backup interval that meets the constraint conditions, the key data is backed up at the selected time node. The constraint method is as follows:

[0032]

[0033] Where: F(t,x) is the data backup frequency at time t and location x; Iop(t,x) is the intervention degree at time t and location x; Ro(t,x) is the response coefficient at time t and location x, Δ and is the weight coefficient.

[0034] A cyberspace information security control system includes a risk identification unit, which monitors network activities in real time and collects abnormal events and their impact data, obtains hazard scores after performing hazard assessment and summarizes them to generate a risk coefficient Ro, and if the risk coefficient Ro exceeds a risk threshold, determines the access rights of each user and implements role-based access control;

[0035] The network testing unit constrains the penetration test intensity according to the hazard score within the preset test cycle, collects penetration test data to generate a test set, and constructs a penetration coefficient to evaluate the network security level. If the penetration coefficient exceeds the threshold, vulnerability detection and repair are carried out, otherwise key data is backed up or transferred;

[0036] The security alarm unit monitors and identifies abnormal events in real time. If an abnormality exists, an alarm command is issued. If the alarm is not responded to and the abnormal nodes exceed expectations, the intervention degree Iop is generated from the corresponding abnormal alarm data. When the intervention degree Iop exceeds expectations, the secondary alarm mechanism is activated for abnormal events.

[0037] The security response unit classifies abnormal events and builds a response strategy library. If alarm instructions are received continuously, the alarm channel is switched to ensure instruction reception. The hazard assessment model is used to evaluate abnormal events and match and execute corresponding response strategies.

[0038] The strategy optimization unit collects response feedback data to construct a response coefficient. If the response coefficient is lower than the response threshold, an optimization instruction is issued. The response strategy is optimized through principal component analysis and genetic algorithm, the strategy library is updated, and the data backup process is constrained.

[0039] (III) Beneficial effects

[0040] The present invention provides a cyberspace information security control method and system, which have the following beneficial effects:

[0041] 1. Comprehensively evaluate the harmfulness of each abnormal event. When an abnormal event occurs in the network system, the risk and harmfulness of each abnormal event can be evaluated to determine the corresponding response priority and response level; the risk coefficient Ro is generated by the collected abnormal status data, and the security risks faced by the network system can be preliminarily evaluated, and the corresponding processing strategy can be matched according to the risk level.

[0042] 2. Match the degree of penetration testing with the risk level of abnormal events to avoid the penetration test failing to achieve the expected results; if the expected results cannot be achieved at present, the current penetration test can be adjusted in time; different security control strategies can be matched according to the security level of the network system to make security control more targeted and achieve better security control effects.

[0043] 3. On the basis of the security control of the network system, continue to detect and identify the abnormal events faced by the network system and enable the alarm mechanism, so that further processing can be carried out in time when facing abnormal events again; generate the intervention degree Iop from the corresponding abnormal status data, and use the intervention degree Iop to comprehensively evaluate the management process of abnormal events to determine the security risks faced by the current network system.

[0044] 4. By classifying each abnormal event and adopting corresponding response strategies, the efficiency of handling abnormal events can be improved after they occur; by conducting hazard and risk assessment, it can be quickly determined whether a response is needed. When it is determined that a response is needed, a targeted processing strategy can be quickly output to achieve a rapid and targeted response when controlling the network system.

[0045] 5. Construct a response coefficient through the collected response feedback data. Based on the response coefficient, the reliability and effectiveness of the current response can be evaluated, so that timely adjustments and optimizations can be made when the expected results are not achieved. Iteratively optimize and improve the given response strategy, execute the optimized response strategy, improve the pertinence and adaptability of the response strategy, and make the handling of abnormal network events more targeted.

[0046] 6. Make the backup frequency and backup time nodes adapt to the current backup scenario to achieve better backup results. When controlling network security, reduce the risk of loss and leakage of key data and ensure data security. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 This is a schematic diagram of the process of the cyberspace information security control method of the present invention;

[0048] Figure 2 It is a schematic diagram of the structure of the cyberspace information security control system of the present invention. DETAILED DESCRIPTION

[0049] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0050] See also Figure 1 The present invention provides a cyberspace information security control method, comprising:

[0051] Step 1: Monitor network activities in real time and collect data on abnormal events and their impact. After conducting a hazard assessment, obtain the hazard score and summarize it to generate a risk factor Ro. If the risk factor Ro exceeds the risk threshold, determine the access rights of each user and implement role-based access control.

[0052] The step 1 includes the following contents:

[0053] Step 101: monitor network activities in real time during the security control phase, such as data exchange and access, collect and annotate abnormal events and corresponding impact data within a preset monitoring period, and add a description of the corresponding event impact;

[0054] The machine learning algorithm is trained with the labeled sample data to obtain a trained hazard assessment model; the abnormal event data is used as input, and the trained hazard assessment model is used to perform hazard assessment to obtain a corresponding hazard score;

[0055] When using it to maintain network security, after collecting and marking the historical data of abnormal events, a comprehensive evaluation of the harmfulness of each abnormal event can be conducted. When an abnormal event occurs in the network system, the risk and harmfulness of each abnormal event can be evaluated to determine the corresponding response priority and response degree;

[0056] Step 102: After summarizing the hazard scores and occurrence time nodes of abnormal events in the current monitoring period, the data are summarized as abnormal state data. Under dimensionless conditions, the risk coefficient Ro is generated from the abnormal state data in the following manner:

[0057]

[0058] Where: H(t) is the hazard score at time point t, [T0, T1] is the monitoring period, α is the weight coefficient, ranging from 0 to 1, Δt i The time interval between the ith abnormal event and the i+1th event, N is the total number of abnormal events detected during the monitoring period;

[0059] Pre-set risk thresholds based on historical data and expected impact of abnormal events;

[0060] If the risk factor Ro exceeds the risk threshold, it means that the network security risk in the current stage is relatively large and timely intervention is needed to improve the response capability to sudden abnormal events. After determining the access rights of each user, role-based access control is implemented according to the access rights to provide hierarchical network access rights;

[0061] When using, combine the contents in steps 101 and 102:

[0062] As a further content, after several abnormal events occur continuously in the current stage, it means that the security risk in the current stage is relatively large. At this time, the risk coefficient Ro is generated by the collected abnormal status data, and a preliminary evaluation of the security risks faced by the network system can be made, and the corresponding processing strategy can be matched according to the degree of risk; as a preliminary response method, in order to reduce human risks, the data access content is controlled to reduce the risk of data leakage.

[0063] Step 2: Constrain the penetration test intensity according to the hazard score within the preset test cycle, collect penetration test data to generate a test set, and construct a penetration coefficient to evaluate the network security level. If the penetration coefficient exceeds the threshold, vulnerability detection and repair are performed, otherwise key data is backed up or transferred;

[0064] The step 2 includes the following contents:

[0065] Step 201: Perform a penetration test within a preset test period, and constrain the test intensity Qop of the penetration test according to the hazard score. The constraint method is as follows:

[0066]

[0067] Among them, p is the number of abnormal events, Yf ij is the difference in hazard scores between the ith and jth abnormal events, Yf a It is the average value of the difference, and the weight coefficient is: 0≤F1≤1, 0≤F2≤1, and F1+F2=1.

[0068] Obtain relevant test data, such as identified vulnerability information, vulnerability exploitation attempt results, network traffic data, credential and authentication data, privilege escalation and lateral movement data, and post-penetration persistence mechanism information, and aggregate the obtained test data to generate a penetration test data set;

[0069] When using it, when abnormal events occur continuously, in order to control the security of the network system, the degree of penetration test should be matched with the risk level of abnormal events to avoid the penetration test failing to achieve the expected effect; and when the expected effect cannot be achieved at present, the current penetration test can be adjusted in time;

[0070] Step 202: training a convolutional neural network with the labeled sample data to obtain a trained penetration security assessment model;

[0071] Taking the penetration test data in the penetration test data set as input, the trained penetration security evaluation model is used to evaluate the penetration security and output the penetration coefficient, and the current security level of the network system is evaluated by the penetration coefficient; according to the relationship between the penetration coefficient and the corresponding threshold, the corresponding processing method is selected;

[0072] When used, as a further content, a penetration coefficient is constructed from the test data based on the penetration test, and the current security of the network system can be further evaluated;

[0073] Step 203: If the obtained penetration coefficient exceeds the corresponding penetration threshold, the current network system is tested for vulnerabilities, corresponding vulnerability data is obtained, and corresponding patching solutions are matched for the detected vulnerabilities, so as to patch the known vulnerabilities and reduce the risk of being exploited; if the obtained penetration coefficient does not exceed the corresponding penetration threshold, the selected data is backed up or transferred to avoid the loss of key data when an abnormal event occurs;

[0074] When used, in combination with steps 201 and 203:

[0075] As a further content, as a control method for the security of the network system, different security control strategies are matched according to the security level of the network system to make the security control more targeted and thus achieve better security control effects.

[0076] Step 3: Real-time monitoring and identification of abnormal events. If an abnormality exists, an alarm command is issued. If the alarm is not responded to and the abnormal nodes exceed expectations, the intervention degree Iop is generated from the corresponding abnormal alarm data. When the intervention degree Iop exceeds expectations, the secondary alarm mechanism is activated for the abnormal event;

[0077] The step three includes the following contents:

[0078] Step 301: monitor the network system in real time and obtain corresponding monitoring data, such as network traffic data, equipment and hardware data, application and service data, user activity data and security event data, and summarize them as abnormal event data;

[0079] The machine learning algorithm is trained with the labeled sample data to obtain the trained abnormal event recognition model; the abnormal event data is used as data, and the trained abnormal event recognition model is used for recognition. If an abnormal event exists, an alarm instruction is issued to the outside;

[0080] As a further content, on the basis of the security control of the network system, the abnormal events faced by the network system are continuously detected and identified and the alarm mechanism is activated, so that further processing can be carried out in time when the abnormal events continue to occur;

[0081] Step 302: If the receiving end does not respond after receiving the alarm instruction, the time node that does not respond is regarded as an abnormal node. If the number of abnormal nodes in this stage exceeds expectations, the time information of each abnormal node, the frequency of abnormal events and the location area where they occur are obtained, and the abnormal alarm data set is generated after being summarized;

[0082] Step 303: Under dimensionless conditions, an intervention level Iop is generated from the abnormal alarm data set, and the current security level of the network system is deeply evaluated based on the intervention level, in the following manner:

[0083]

[0084] Where: t is a time variable, which indicates the specific time when the abnormal event occurs, t0≤t≤t1; t0 and t1 are the start and end time of the time interval, which define the time range of the investigation and are set according to actual needs; X=(x, y), which is a spatial coordinate vector, indicating the location where the abnormal event occurs; x∈Ω, Ω is the spatial investigation area, which indicates the geographical or network topological range where the abnormal event occurs, which is determined according to the actual network topology; f(t,x) is the frequency function of the abnormal event, which indicates the frequency of the abnormal event at time t and location x; e(t,x) is the severity function of the abnormal event. The number represents the severity of the abnormal event at time t and location x, e(t,x)≥0; p(x)≥0 is the regional importance function, reflecting the importance of the region at location x; w(x) is the spatial weighting function, reflecting the contribution weight of different location regions to the intervention degree, w(x)≥0; α is the weight coefficient of the frequency function, used to adjust the contribution of frequency to the intervention degree, α>0; β is the weight coefficient of the severity function, used to adjust the contribution of severity to the intervention degree, β>0; γ is the weight coefficient of regional importance, used to adjust the contribution of regional importance to the intervention degree, γ>0;

[0085] Pre-set intervention thresholds based on historical data and management expectations for abnormal events;

[0086] If the obtained intervention degree Iop exceeds the preset intervention threshold, it means that the frequency of abnormal events in the current stage is high and the impact of the hazard is also high. At this time, a secondary alarm instruction is issued to the outside to enable the multi-level alarm mechanism and multi-level alarms for abnormal events;

[0087] When using, combine the contents in steps 301 to 303:

[0088] As a further content, as an extension of the single-level alarm instruction, considering that the current abnormal event may not be responded to and safely controlled in time, the intervention level Iop is generated by the corresponding abnormal state data, and the intervention level Iop is used to comprehensively evaluate the management process of the abnormal event, determine the security risks faced by the current network system, and take further intervention methods when the security risk is too large;

[0089] Step 4: Classify abnormal events and build a response strategy library. If alarm instructions are received continuously, switch the alarm channel to ensure instruction reception, use the hazard assessment model to evaluate abnormal events and match and execute corresponding response strategies;

[0090] The step 4 includes the following contents:

[0091] Step 401: After collecting event data of several abnormal events in the current stage as input, the abnormal events are classified by a pre-trained classification algorithm to obtain several event classes; through online retrieval or offline formulation, several response strategies corresponding to the event classes are summarized, and after review, a corresponding response strategy library is generated;

[0092] When in use, by classifying each abnormal event and adopting corresponding response strategies, the efficiency of handling abnormal events can be improved after the abnormal events occur;

[0093] Step 402: Considering that the data end may not respond due to the failure to effectively pay attention to the alarm instruction, at this time, if the first-level alarm instruction or the second-level alarm instruction is received continuously, the event reporting channel is switched, for example, the current message reminder is modified to a message reminder with a sound alarm to prevent the user or the receiving end from failing to effectively receive the alarm instruction;

[0094] After the network system detects an abnormal event, it uses the trained hazard assessment model to evaluate the abnormality of the abnormal event and obtain the corresponding hazard score. If the obtained hazard score exceeds expectations, it issues a response instruction to the outside world.

[0095] After receiving the response instruction, the pre-trained recommendation algorithm is used to match the corresponding response strategy for the abnormal event from the response strategy library, and the response strategy is executed to respond to the current abnormal event;

[0096] When using, combine the contents in steps 401 and 402:

[0097] When an abnormal event occurs in the network system, by conducting a hazard and risk assessment, it can be quickly determined whether a response is needed. When it is determined that a response is needed, a targeted processing strategy can be quickly output to achieve a rapid and targeted response when controlling the network system.

[0098] Step 5: Collect response feedback data to construct a response coefficient. If the response coefficient is lower than the response threshold, an optimization instruction is issued, and the response strategy is optimized through principal component analysis and genetic algorithm, the strategy library is updated, and the data backup process is constrained;

[0099] The step five includes the following contents:

[0100] Step 501: After responding to the currently occurring abnormal event, collect and obtain corresponding response feedback data, including event resolution, detection timeliness, response promptness, recovery integrity, downtime, data loss and cost assessment, etc., and generate a response feedback data set after aggregation;

[0101] The convolutional neural network is trained with the labeled sample data to obtain the trained feedback evaluation model; the response feedback data is used as input, the trained feedback evaluation model is used to evaluate the response feedback and output the response coefficient, and the current response state is evaluated with the response coefficient;

[0102] Pre-set response thresholds based on historical data and management expectations for abnormal events;

[0103] If the response coefficient obtained is lower than the response threshold, it means that the current response intervention to the abnormal event has not achieved the expected effect and needs to be re-intervened. At this time, an optimization instruction is issued to the outside;

[0104] When in use, after responding to an abnormal event, a response coefficient is constructed through the collected response feedback data. The reliability and effectiveness of the current response can be evaluated based on the response coefficient, so that timely adjustments and optimizations can be made when the expected effect is not achieved.

[0105] Step 502: after receiving the optimization instruction, perform principal component analysis on the abnormal event data, response feedback data and response strategy data to obtain key factors affecting the feedback response; optimize the response strategy based on the key factors using a pre-trained genetic algorithm to obtain an optimized response strategy;

[0106] Add the optimized response strategy to the response strategy library. If the current abnormal event is still ongoing or reoccurs, re-match the response strategy for the corresponding abnormal event and execute the optimized response strategy.

[0107] As a further content, when the current response strategy fails to achieve the expected effect, the given response strategy is iteratively optimized and improved, and the optimized response strategy is implemented to improve the pertinence and adaptability of the response strategy, so that the handling of abnormal network events is more targeted;

[0108] Step 503: Back up the key data when no abnormal event is identified, and constrain the data backup frequency. After the backup interval that meets the constraint conditions, back up the key data at the selected time node. The constraint method is as follows:

[0109]

[0110] Where: F(t,x) is the data backup frequency at time t and location x, usually expressed as the number of backups per unit time; Iop(t,x) is the intervention degree at time t and location x, which quantifies the impact of network abnormal events on the overall network status; Ro(t,x) is the response coefficient at time t and location x, Δ and is the weight coefficient, and its value falls between 0 and 1;

[0111] When using, combine the contents in steps 501 to 503:

[0112] By performing periodic backup of key data and adapting the backup frequency and backup time nodes to the current backup scenario, the actual backup effect can be better. When controlling network security, the risk of loss and leakage of key data can be further reduced, thereby ensuring data security.

[0113] See also Figure 2 The present invention provides a cyberspace information security control system, comprising:

[0114] The risk identification unit monitors network activities in real time and collects data on abnormal events and their impact. After conducting a hazard assessment, it obtains the hazard score and summarizes it to generate a risk factor Ro. If the risk factor Ro exceeds the risk threshold, it determines the access rights of each user and implements role-based access control.

[0115] The network testing unit constrains the penetration test intensity according to the hazard score within the preset test cycle, collects penetration test data to generate a test set, and constructs a penetration coefficient to evaluate the network security level. If the penetration coefficient exceeds the threshold, vulnerability detection and repair are carried out, otherwise key data is backed up or transferred;

[0116] The security alarm unit monitors and identifies abnormal events in real time. If an abnormality exists, an alarm command is issued. If the alarm is not responded to and the abnormal nodes exceed expectations, the intervention degree Iop is generated from the corresponding abnormal alarm data. When the intervention degree Iop exceeds expectations, the secondary alarm mechanism is activated for abnormal events.

[0117] The security response unit classifies abnormal events and builds a response strategy library. If alarm instructions are received continuously, the alarm channel is switched to ensure instruction reception. The hazard assessment model is used to evaluate abnormal events and match and execute corresponding response strategies.

[0118] The strategy optimization unit collects response feedback data to construct a response coefficient. If the response coefficient is lower than the response threshold, an optimization instruction is issued. The response strategy is optimized through principal component analysis and genetic algorithm, the strategy library is updated, and the data backup process is constrained.

[0119] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0120] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0121] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only some logical function divisions. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0122] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0123] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A cyberspace information security control method, characterized in that: include, Monitor network activities in real time and collect data on abnormal events and their impact. After conducting a hazard assessment, obtain the hazard score and summarize it to generate a risk factor Ro. If the risk factor Ro exceeds the risk threshold, determine the user's access rights and implement role-based access control. During the preset test cycle, the penetration test intensity is constrained according to the hazard score, the penetration test data is collected to generate a test set, and a penetration coefficient is constructed to evaluate the network security level. If the penetration coefficient exceeds the threshold, vulnerability detection and repair are carried out, otherwise key data is backed up or transferred; Real-time monitoring and identification of abnormal events. If an abnormality exists, an alarm command is issued. If the alarm is not responded to and the abnormal nodes exceed expectations, the intervention degree Iop is generated from the corresponding abnormal alarm data. When the intervention degree Iop exceeds expectations, the secondary alarm mechanism is activated for abnormal events. Classify abnormal events and build a response strategy library. If alarm instructions are received continuously, switch the alarm channel to ensure instruction reception. Use the hazard assessment model to evaluate abnormal events and match and execute corresponding response strategies. The response feedback data is collected to construct the response coefficient. If the response coefficient is lower than the response threshold, an optimization instruction is issued. The response strategy is optimized through principal component analysis and genetic algorithm, the strategy library is updated and the data backup process is constrained.

2. A cyberspace information security control method according to claim 1, characterized in that: During the security control phase, network activities are monitored in real time. After collecting and annotating abnormal events and corresponding impact data, descriptions are added to the corresponding event impacts. Using the abnormal event data as input, the trained hazard assessment model is used to perform hazard assessment and obtain the corresponding hazard score. After summarizing the hazard scores and occurrence time nodes of abnormal events in the current monitoring cycle, they are summarized as abnormal status data.

3. A cyberspace information security control method according to claim 2, characterized in that: Perform penetration testing within the preset test cycle, obtain the corresponding test data and summarize them to generate a penetration testing data set, and constrain the test intensity Qop of the penetration test according to the hazard score. The constraint method is as follows: Among them, p is the number of abnormal events, Yf ij is the difference in hazard scores between the ith and jth abnormal events, Yf a It is the average value of the difference, and the weight coefficient is: 0≤F1≤1, 0≤F2≤1, and F1+F2=1.

4. A cyberspace information security control method according to claim 3, characterized in that: Taking the penetration test data in the penetration test data set as input, the trained penetration security evaluation model is used to evaluate the penetration security and output the penetration coefficient, and the corresponding processing method is selected according to the relationship between the penetration coefficient and the corresponding threshold; If the obtained penetration coefficient exceeds the penetration threshold, the current network is tested for vulnerabilities, the corresponding vulnerability data is obtained, and the corresponding patching scheme is matched to the detected vulnerability. If the obtained penetration coefficient does not exceed the corresponding penetration threshold, the selected data is backed up or transferred.

5. A cyberspace information security control method according to claim 4, characterized in that: Real-time monitoring of the network system and acquisition of corresponding monitoring data are summarized as abnormal event data. The abnormal event data is used as data and the trained abnormal event recognition model is used for recognition. If an abnormal event occurs, an alarm instruction is issued to the outside. If the receiving end does not respond after receiving the alarm command, the time node that did not respond will be regarded as an abnormal node. If the number of abnormal nodes in this stage exceeds expectations, the time information of each abnormal node, the frequency of abnormal events and the location area where they occur are obtained, and the abnormal alarm data set is generated after aggregation.

6. A cyberspace information security control method according to claim 5, characterized in that: The intervention degree Iop is generated from the abnormal alarm data set. If the obtained intervention degree Iop exceeds the preset intervention threshold, a secondary alarm instruction is issued to the outside. The method of generating the intervention degree Iop is as follows: Where: t is the time variable, t0≤t≤t1; t0 and t1 are the start and end time of the time interval, X=(x, y), is the location where the abnormal event occurs, x∈Ω, Ω is the spatial investigation area; f(t,x) is the frequency function of the abnormal event; e(t,x) is the severity function of the abnormal event; p(x)≥0 is the regional importance function; w(x) is the spatial weighting function, α, β, γ are the weight coefficients.

7. A cyberspace information security control method according to claim 6, characterized in that: After collecting event data of several abnormal events in the current stage as input, the pre-trained classification algorithm is used to classify the abnormal events to obtain several event classes; several response strategies corresponding to the event classes are summarized, and after review, the corresponding response strategy library is summarized and generated.

8. A cyberspace information security control method according to claim 7, characterized in that: If the first-level alarm command or the second-level alarm command is received continuously, the event reporting channel is switched. After the network system detects an abnormal event, the trained hazard assessment model is used to evaluate the abnormality of the abnormal event and obtain the corresponding hazard score; If the obtained hazard score exceeds expectations, a pre-trained recommendation algorithm is used to match the corresponding response strategy for the abnormal event from the response strategy library, and the response strategy is executed to respond to the current abnormal event.

9. A cyberspace information security control method according to claim 8, characterized in that: After responding to the current abnormal event, the corresponding response feedback data is collected and obtained. The response feedback data is used as input, and the trained feedback evaluation model is used to evaluate the response feedback and output the response coefficient. If the obtained response coefficient is lower than the response threshold, an optimization instruction is issued to the outside.

10. A cyberspace information security control method according to claim 9, characterized in that: After receiving the optimization instruction, principal component analysis is performed on the abnormal event data, response feedback data and response strategy data to obtain the key factors affecting the feedback response; the pre-trained genetic algorithm optimizes the response strategy based on the key factors. If the current abnormal event is still ongoing or reoccurs, the response strategy is re-matched to the corresponding abnormal event and the optimized response strategy is executed.

11. A cyberspace information security control method according to claim 10, characterized in that: When no abnormal events are identified, key data is backed up and the frequency of data backup is constrained. After the backup interval that meets the constraints, key data is backed up at the selected time node. The constraints are as follows: Where: F(t,x) is the data backup frequency at time t and location x; Iop(t,x) is the intervention degree at time t and location x; Ro(t,x) is the response coefficient at time t and location x, Δ and is the weight coefficient.

12. A cyberspace information security control system, characterized in that: include, The risk identification unit monitors network activities in real time and collects data on abnormal events and their impact. After conducting a hazard assessment, it obtains the hazard score and summarizes it to generate a risk factor Ro. If the risk factor Ro exceeds the risk threshold, it determines the access rights of each user and implements role-based access control. The network testing unit constrains the penetration test intensity according to the hazard score within the preset test cycle, collects penetration test data to generate a test set, and constructs a penetration coefficient to evaluate the network security level. If the penetration coefficient exceeds the threshold, vulnerability detection and repair are carried out, otherwise key data is backed up or transferred; The security alarm unit monitors and identifies abnormal events in real time. If an abnormality exists, an alarm command is issued. If the alarm is not responded to and the abnormal nodes exceed expectations, the intervention degree Iop is generated from the corresponding abnormal alarm data. When the intervention degree Iop exceeds expectations, the secondary alarm mechanism is activated for abnormal events. The security response unit classifies abnormal events and builds a response strategy library. If alarm instructions are received continuously, the alarm channel is switched to ensure instruction reception. The hazard assessment model is used to evaluate abnormal events and match and execute corresponding response strategies. The strategy optimization unit collects response feedback data to construct a response coefficient. If the response coefficient is lower than the response threshold, an optimization instruction is issued. The response strategy is optimized through principal component analysis and genetic algorithm, the strategy library is updated, and the data backup process is constrained.

Images