Security risk assessment method and system for informatization platform

Abstract

The invention belongs to the technical field of risk assessment, and more specifically relates to a security risk assessment method and system for an informatization platform. Collecting security feature factors of the to-be-evaluated informatization platform in a preset time length to form a first security feature factor data set; after the security feature factors in the security feature factor data set are clustered, tags are given to the security feature factors in each cluster, and a first training set is obtained; under the condition that the number of the training sets I is insufficient, acquiring data from other informatization platforms to obtain a training set II; and correcting the labels in the training set II through correction factors, combining the corrected labels with the training set I to obtain a training set, training the prediction neural network, and performing safety risk assessment. The problem of insufficient security feature factor data volume generated in the operation of an informatization platform is solved, and the evaluation accuracy is improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of risk assessment, and more specifically, relates to a security risk assessment method and system for an information platform. Background Art

[0002] In order to achieve unified management and deployment of data, resources, and processes, all industries are building information platforms. With the popularization of digital government affairs, information platforms for government affairs informatization that benefit the people have also been built one after another. However, during the operation of the information platform, security issues need special attention. Therefore, it is particularly important to conduct security risk assessments of the information platform based on the various data generated during the operation of the information platform, and to carry out risk prevention and control based on the assessment results. Summary of the invention

[0003] The present invention provides a method and system for assessing security risks of an information platform.

[0004] The security risk assessment method of the information platform includes: S1: Collect several characteristic factors related to the attack situation, threat situation, asset situation, violation situation and system work order response processing of the information platform to be evaluated within a preset time length, select security characteristic factors related to security from the characteristic factors, remove invalid data, convert the format, perform standardization, obtain the variance of each security characteristic factor, select the security characteristic factors whose variance exceeds the variance threshold, and form the security characteristic factor data set 1; S2: After clustering the security feature factors in the security feature factor data set, labels are assigned to the security feature factors in each cluster to obtain a training set 1; determine whether the number of samples in the training set 1 exceeds the sample number threshold. If so, use the training set 1 as the training set and execute S5; if not, execute S3; S3: Collect several characteristic factors related to attack situation, threat situation, asset situation, violation situation and system work order response processing of other information platforms within a preset time length, select security characteristic factors related to security from the characteristic factors, remove invalid data, convert the format, perform standardization, obtain the variance of each security characteristic factor, select the security characteristic factors whose variance exceeds the variance threshold, and form the security characteristic factor data set 2; S4: After clustering the security feature factors in the security feature factor data set 2, labels are assigned to the security feature factors in each cluster to obtain the training set 2; the labels in the training set 2 are corrected by correction factors and then merged with the training set 1 to obtain the training set. S5: Use the training set to train the prediction neural network to obtain a trained prediction neural network; S6: The newly obtained security feature factors of the evaluation information platform are processed using the trained prediction neural network to obtain the security risk assessment results.

[0005] Security characteristic factors include confidentiality, number of vulnerabilities, number of alarms, whether there is security protection, open port monitoring, whether there is a responsible person, whether there is security equipment, whether the storage address is clear, number of security incidents within the statistical period, number of vulnerabilities within the statistical period, number of attacks, number of threats, number of dangers, and number of violations.

[0006] Attacks include DDos attacks, backdoor attacks, vulnerability attacks, network scanning and eavesdropping, phishing, SQL injection, information tampering, information leakage, and information theft; Threats include viruses, vulnerabilities, worms, Trojans, botnets, malicious codes, and network information sniffing; Violations include exceeding access frequency limits, exceeding access traffic limits, outbound file transmission, illegal external connections, illegal access, and illegal file downloads.

[0007] The correction factor is determined based on the business overlap, characteristic factor overlap, and visit volume difference ratio of different information platforms.

[0008] The proportion of security feature factors from a certain information platform in training set 2 is positively correlated with its correction factor.

[0009] Security risk assessment system for information platform, Security feature factor data set 1 construction module: collect several feature factors related to attack situation, threat situation, asset situation, violation situation and system work order response processing of the information platform to be evaluated within a preset time length, select security-related security feature factors from the feature factors, remove invalid data, convert the format, perform standardization, obtain the variance of each security feature factor, select the security feature factors whose variance exceeds the variance threshold, and form the security feature factor data set 1; Training set 1 construction module: After clustering the security feature factors in the security feature factor data set, labels are assigned to the security feature factors in each cluster to obtain training set 1; it is determined whether the number of samples in training set 1 exceeds the sample number threshold. If so, training set 1 is used as the training set and input into the training module. If not, the content in the security feature factor data set 2 construction module is executed; Security feature factor data set 2 construction module: collect several feature factors related to attack situation, threat situation, asset situation, violation situation and system work order response processing of other information platforms within a preset time length, select security feature factors related to security from the feature factors, remove invalid data, convert the format, perform standardization, obtain the variance of each security feature factor, select the security feature factors whose variance exceeds the variance threshold, and form the security feature factor data set 2; Training set construction module: After clustering the security feature factors in the security feature factor data set 2, labels are assigned to the security feature factors in each cluster to obtain training set 2; the labels in training set 2 are corrected by correction factors and then merged with training set 1 to obtain training set. Training module: Use the training set to train the prediction neural network to obtain the trained prediction neural network; Evaluation module: The newly acquired security feature factors of the evaluation information platform are processed using the trained predictive neural network to obtain the security risk assessment results.

[0010] Beneficial effects of the present invention: 1. By designing correction factors based on the business overlap, characteristic factor overlap, and access volume difference ratio between other informatization platforms and the informatization platform to be evaluated, the amount of data in the training set can be expanded, solving the problem of insufficient data on security characteristic factors generated during the operation of the informatization platform, improving the training accuracy of the prediction model, and improving the accuracy of the evaluation; 2. In the process of constructing the characteristic factor data set, the variance of each safety characteristic factor is obtained through characteristic factor screening, invalid data removal, format conversion, and standardization. The safety characteristic factors with variance exceeding the variance threshold are selected to screen out the characteristic factors that have a greater impact on the safety performance evaluation and improve the evaluation accuracy. DETAILED DESCRIPTION

[0011] The technical solution of the present application is described in detail below in conjunction with specific embodiments.

[0012] The security risk assessment method of the information platform includes: S1: Collect several characteristic factors related to the attack situation, threat situation, asset situation, violation situation and system work order response processing of the information platform to be evaluated within a preset time length, select security characteristic factors related to security from the characteristic factors, remove invalid data, convert the format, and perform standardization to obtain the variance of each security characteristic factor, select the security characteristic factors whose variance exceeds the variance threshold, and form the security characteristic factor data set 1.

[0013] Security assessment is conducted based on security feature factors such as attack situation, threat situation, asset situation, violation situation, and system work order response processing, including: 1. Attack Situation The number of attacks from outside the network during the statistical period, including but not limited to DDos attacks, backdoor attacks, vulnerability attacks, network scanning and eavesdropping, phishing, SQL injection, information tampering, information leakage, information theft, etc.

[0014] 2. Threat Situation The number of threats from threat intelligence during the statistical period, including but not limited to viruses, vulnerabilities, worms, Trojans, botnets, malicious codes, network information sniffing, etc.

[0015] 3. Asset situation Vulnerability and configuration weakness data from assets during the statistical period, including but not limited to relevant risk indexes, and the impact or degree of damage caused to the assets.

[0016] 4. Violations Frequency statistics of internal violations during the statistical period, including but not limited to exceeding the access frequency limit, exceeding the access traffic limit, outbound file sending, illegal external connections, illegal access, illegal file downloads, etc.

[0017] 5. Work order response processing Responses to security issue tickets during the statistical period, including but not limited to the number of tickets, the number of processed tickets, the processing time, etc.

[0018] The characteristic factors of the information platform include value, security, health and other types of characteristic factors. Here, for the security model, 16 security characteristic factors of the information platform are selected from 68 characteristic factors, as shown in Table 1 below: Table 1 Safety characteristic factors Safety characteristic factor English name Safety characteristic factor Chinese name confidentiality Confidentiality hole_high_cnt Number of Vulnerabilities - High hole_mid_cnt Number of Vulnerabilities - Medium warn_high_cnt Number of Alarms - High warn_low_cnt Number of Alarms - Medium isHierarchyProtection Whether the guarantee openPortMonitor Open port monitoring personInCharge Is there a responsible person? securityDevice Is there any safety equipment? storeLocation Is the storage address clear? l1m_security_num Number of security incidents in the past month l1m_flaw_num Number of vulnerabilities in the past month attack_num Number of attacks threat_num Number of threats danger_num Dangerous times violation_num Number of violations

[0019] Collect monthly or weekly data of the above safety characteristic factors. The data needs to be preprocessed before use, which mainly includes the following processing steps: 1. Factor feature transformation For the character data in the factors, in order to facilitate modeling and calculation, it is necessary to convert them through code mapping or directly convert them to numerical values.

[0020] Convert the null values ​​in the factor column to zero value data. If the alarm quantity-high school data is NULL, convert it to 0.

[0021] 2. Invalid column processing There are cases where there is no data in the process of feature factor data statistics. For these invalid factor columns, they need to be removed before modeling. For example, if there is no data in the attack number column, this column should be removed.

[0022] 3. Eigenvalue processing The degree of discreteness of factor eigenvalues ​​determines the effectiveness of factor re-clustering. Factor columns without discrete properties are meaningless for classification and need to be removed before modeling. For example, if the column "Whether to Clearly Store Addresses" is all "No" and the number of field enumeration types is 1, and it does not have discrete properties, then the column will be removed.

[0023] 4. Feature filtering Considering the characteristic variance selection of factors, selecting factors with relatively good discreteness for modeling can help avoid the high model error caused by high-dimensional clustering and increase the effectiveness of modeling. Specifically, the variance of each factor of the standardized or normalized data can be calculated, the differences between the variances can be observed, and the factors with larger variances can be selected first. Or, by setting the parameter of the number of selected factors, the first N with larger variances can be selected. For example, if the variance of the alarm number-medium is lower than that of the alarm number-low and alarm number-high, it will be discarded in the final factor selection.

[0024] 5. Data Standardization In the analysis of data, there are inconsistencies in the mathematical scales of the system's characteristic factors, and standardization steps are needed to process the characteristic factors and eliminate the differences between the characteristic factors. Standardization is to uniformly map the characteristic factors to the interval [0,1].

[0025] For example, the data normalization method is used to standardize the data, that is, to uniformly map the characteristic factors to the interval [0,1], and distinguish between indicators with positive and negative effects.

[0026] IsHierarchyProtectiony (whether it is Hierarchy Protection) will reduce the risk, so it is negatively affected and mapped to the interval [-1,0]. If the value is 0, it means no, then -1 is mapped, and if the value is 1, it means yes, then 0 is mapped.

[0027] The normalization idea can be realized through the following formula: New data = (original data - minimum value) / (maximum value - minimum value) S2: After clustering the security feature factors in the security feature factor data set, labels are assigned to the security feature factors in each cluster to obtain training set 1; it is determined whether the number of samples in training set 1 exceeds the sample number threshold. If so, training set 1 is used as the training set and S5 is executed. If not, S3 is executed.

[0028] Clustering is to cluster the analysis objects, which is to regard the standardized objects as "individuals". The correlation coefficient between objects describes the similarity between "individuals".

[0029] (1) Object table conversion processing All analysis objects are standardized to compare the relationships between them.

[0030] (2) Object clustering The correlation coefficient between objects is used as the similarity measure between objects in the model, and the objects are clustered using existing clustering methods (such as K-Means algorithm) to divide the objects into N categories as needed.

[0031] (3) Object screening According to the clustering results, one object is selected from each class as the representative of this type of variable, and the integrated objects are used as the screening results.

[0032] The representative of each class is assigned a benchmark label of this class, and the remaining objects are adjusted based on the benchmark label according to the correlation coefficient, which can be defined using the Euclidean distance.

[0033] For example, the labels of objects other than the representative in each class can be calculated according to the following formula: T j =T0+α j ·ρ j ; Where T j is the label of the jth object in each class except the representative, T0 is the benchmark label, α j is the weight of the jth object, ρ j is the correlation coefficient between the jth object and the representative, and the Spearman rank correlation coefficient can be used, which takes values ​​from -1 to 1.

[0034] S3: Collect several characteristic factors related to attack situation, threat situation, asset situation, violation situation and system work order response processing from other information platforms within a preset time length, select security characteristic factors related to security from the characteristic factors, remove invalid data, convert the format, and perform standardization to obtain the variance of each security characteristic factor, select the security characteristic factors whose variance exceeds the variance threshold, and form the security characteristic factor data set 2.

[0035] During the operation of the information platform, the number of available security feature factors may be relatively small during the data collection cycle. It may not be possible to form a training set that can meet the required number for training the predictive neural network. In order to solve this problem, security feature factors from other information platforms are introduced.

[0036] In order to avoid the introduction of invalid or unusable data in subsequent operations, other information platforms should be selected with at least some overlap in business with the information platform to be evaluated. For example, if the information platform to be evaluated is a government information platform, which contains the latest policy or work notification business module, then when selecting other information platforms, you can focus on selecting information platforms that also contain this business module.

[0037] After selecting other information platforms, a number of characteristic factors are collected, and security characteristic factors are screened, etc., until the security characteristic factors whose variance exceeds the variance threshold are selected to form the security characteristic factor data set 2. The specific operation is the same as in step S1.

[0038] However, since different information platforms have different business contents, their potential security risks will also vary. In order to eliminate or reduce the impact of such differences as much as possible, the concept of correction factor is introduced.

[0039] S4: After clustering the security feature factors in the security feature factor data set 2, labels are assigned to the security feature factors in each cluster to obtain the training set 2; the labels in the training set 2 are corrected by correction factors and then merged with the training set 1 to obtain the training set.

[0040] After clustering the security feature factors in the security feature factor data set 2, labels are assigned to the security feature factors in each cluster to obtain the operation of training set 2, which is the same as step S2 and will not be repeated here.

[0041] Different information platforms will have different security characteristic factors such as attack situation, threat situation, asset situation, violation situation, system work order response processing, etc. due to differences in their business. As a result, security risks will also vary due to such differences. The correction factors are set based on such differences.

[0042] The correction factor can be calculated based on the business overlap, characteristic factor overlap, and visit volume difference ratio of different information platforms.

[0043] Business overlap has been introduced above. Business overlap refers to the number of businesses that overlap between other informatization platforms and the informatization platform to be evaluated, as a percentage of the total number of businesses on the informatization platform to be evaluated. For example, if other informatization platforms have 2 overlapping businesses with the informatization platform to be evaluated, and the total number of businesses on the informatization platform to be evaluated is 10, then the business overlap = 2 / 10 = 20%. The higher the business overlap, the higher the correlation between the two informatization platforms.

[0044] The overlap of characteristic factors refers to the overlap of 16 security characteristic factors selected in S1. If all other information platforms are included, the overlap of characteristic factors is 100%. If only 10 of them are included, the overlap of characteristic factors = 10 / 16 = 62.5%.

[0045] The visit volume difference ratio refers to the ratio of the difference between the visit volume of other information platforms and the visit volume of the information platform to be evaluated to the visit volume of the information platform to be evaluated. For example, in a certain period of time, the visit volume of other information platforms is 2000, and the visit volume of the information platform to be evaluated is 2500, then the visit volume difference ratio = (2000-2500) / 2500 = -20%. If the visit volume of other information platforms is higher than that of the information platform to be evaluated, this value is positive.

[0046] Correction factor Q of the i-th information platform i The calculation can refer to the following formula: Q i =a·M i +b·N i +c·E i Among them, a, b, and c are the correction coefficients of the corresponding factors, which can be pre-set according to the importance of business overlap, characteristic factor overlap, and visit volume difference ratio on different information platforms. i is the business overlap between the i-th information platform and the information platform to be evaluated, N i is the overlap of characteristic factors between the i-th information platform and the information platform to be evaluated, E i is the difference ratio of the visits between the i-th information platform and the information platform to be evaluated.

[0047] When performing the above operations, the correction factors of other collected information platforms can be calculated in advance, and they can be sorted in descending order according to the values ​​of the correction factors. Starting from the first position, the information platforms corresponding to the appropriate number of correction factors can be selected for use. The number of other information platforms introduced can be limited by setting the correction factor threshold. The number of samples in the training set can also be set to determine the number of other information platforms introduced according to the number of samples that each information platform can provide.

[0048] The number of data included in training set 2 is determined based on the difference between the total number of data in the required training set and the number of data in training set 1.

[0049] At the same time, the proportion of security feature factors from this information platform in training set 2 can also be determined based on the value of the correction factor. For example, the larger the correction factor, the larger its proportion can be set. That is, the proportion of security feature factors from a certain information platform in training set 2 is positively correlated with its correction factor.

[0050] P i =X i Q i , Where P i is the proportion of samples from the i-th information platform in the training set 2, X i is the adjustment coefficient, Q i is the correction factor of the i-th information platform.

[0051] You can also use the above method to construct a test set, which will not be described here.

[0052] S5: Use the training set to train the prediction neural network to obtain a trained prediction neural network.

[0053] The prediction neural network can select the BP neural network and other neural networks with prediction functions that are currently widely used.

[0054] S6: The newly obtained security characteristic factors of the information platform to be evaluated are processed using the trained predictive neural network to obtain the security risk assessment results.

[0055] By setting thresholds, the risk probability output by the trained prediction neural network is divided into several intervals, such as no risk (such as 0-50%), low risk (such as 50-70%), medium risk (such as 70-85%), and high risk (such as greater than 85%). After the prediction neural network is processed, the output probability is 63%, which falls into the low-risk interval. The above interval settings are just examples. The specific threshold and interval settings can be set according to the specific situation of the information platform to be evaluated.

[0056] When one of the information platforms to be monitored is used as the object to be evaluated, the above method can be used to achieve this. All the information platforms to be monitored can also be used as the objects to be evaluated. It is only necessary to first select one from all the information platforms as the basic object to be evaluated as the information platform to be evaluated in the above scheme. The selection principle can be based on the comprehensiveness and quantity of the business modules covered by the information platform, such as selecting the one with the largest number of business modules or the one with the widest business coverage. The method of the present invention has very wide applicability.

[0057] Security risk assessment system for information platform, Security feature factor data set 1 construction module: collect several feature factors related to attack situation, threat situation, asset situation, violation situation and system work order response processing of the information platform to be evaluated within a preset time length, select security-related security feature factors from the feature factors, remove invalid data, convert the format, perform standardization, obtain the variance of each security feature factor, select the security feature factors whose variance exceeds the variance threshold, and form the security feature factor data set 1; Training set 1 construction module: After clustering the security feature factors in the security feature factor data set, labels are assigned to the security feature factors in each cluster to obtain training set 1; it is determined whether the number of samples in training set 1 exceeds the sample number threshold. If so, training set 1 is used as the training set and input into the training module. If not, the content in the security feature factor data set 2 construction module is executed; Security feature factor data set 2 construction module: collect several feature factors related to attack situation, threat situation, asset situation, violation situation and system work order response processing of other information platforms within a preset time length, select security feature factors related to security from the feature factors, remove invalid data, convert the format, perform standardization, obtain the variance of each security feature factor, select the security feature factors whose variance exceeds the variance threshold, and form the security feature factor data set 2; Training set construction module: After clustering the security feature factors in the security feature factor data set 2, labels are assigned to the security feature factors in each cluster to obtain training set 2; the labels in training set 2 are corrected by correction factors and then merged with training set 1 to obtain training set. Training module: Use the training set to train the prediction neural network to obtain the trained prediction neural network; Evaluation module: The newly acquired security feature factors of the evaluation information platform are processed using the trained predictive neural network to obtain the security risk assessment results.

Claims

1. A security risk assessment method for an information platform, characterized in that: include: S1: Collect several characteristic factors related to the attack situation, threat situation, asset situation, violation situation and system work order response processing of the information platform to be evaluated within a preset time length, select security characteristic factors related to security from the characteristic factors, remove invalid data, convert the format, perform standardization, obtain the variance of each security characteristic factor, select the security characteristic factors whose variance exceeds the variance threshold, and form the security characteristic factor data set 1; S2: After clustering the security feature factors in the security feature factor data set, labels are assigned to the security feature factors in each cluster to obtain a training set 1; determine whether the number of samples in the training set 1 exceeds the sample number threshold. If so, use the training set 1 as the training set and execute S5; if not, execute S3; S3: Collect several characteristic factors related to attack situation, threat situation, asset situation, violation situation and system work order response processing of other information platforms within a preset time length, select security characteristic factors related to security from the characteristic factors, remove invalid data, convert the format, perform standardization, obtain the variance of each security characteristic factor, select the security characteristic factors whose variance exceeds the variance threshold, and form the security characteristic factor data set 2; S4: After clustering the security feature factors in the security feature factor data set 2, labels are assigned to the security feature factors in each cluster to obtain the training set 2; the labels in the training set 2 are corrected by correction factors and then merged with the training set 1 to obtain the training set. S5: Use the training set to train the prediction neural network to obtain a trained prediction neural network; S6: After processing the newly obtained security characteristic factors of the information platform to be evaluated using the trained predictive neural network, a security risk assessment result is obtained.

2. The security risk assessment method according to claim 1, characterized in that: Security characteristic factors include confidentiality, number of vulnerabilities, number of alarms, whether there is security protection, open port monitoring, whether there is a responsible person, whether there is security equipment, whether the storage address is clear, number of security incidents within the statistical period, number of vulnerabilities within the statistical period, number of attacks, number of threats, number of dangers, and number of violations.

3. The security risk assessment method according to claim 2, characterized in that: Attacks include DDos attacks, backdoor attacks, vulnerability attacks, network scanning and eavesdropping, phishing, SQL injection, information tampering, information leakage, and information theft; Threats include viruses, vulnerabilities, worms, Trojans, botnets, malicious codes, and network information sniffing; Violations include exceeding access frequency limits, exceeding access traffic limits, outbound file transmission, illegal external connections, illegal access, and illegal file downloads.

4. The security risk assessment method according to claim 1, characterized in that: The correction factor is determined based on the business overlap, characteristic factor overlap, and visit volume difference ratio of different information platforms.

5. The security risk assessment method according to claim 1, characterized in that: The proportion of security feature factors from a certain information platform in training set 2 is positively correlated with its correction factor.

6. The security risk assessment method according to claim 1, characterized in that: The correction factors of other information platforms collected are calculated in advance and sorted in descending order according to the values ​​of the correction factors.

7. The security risk assessment system of the information platform is characterized by: Security feature factor data set 1 construction module: collect several feature factors related to attack situation, threat situation, asset situation, violation situation and system work order response processing of the information platform to be evaluated within a preset time length, select security-related security feature factors from the feature factors, remove invalid data, convert the format, perform standardization, obtain the variance of each security feature factor, select the security feature factors whose variance exceeds the variance threshold, and form the security feature factor data set 1; Training set 1 construction module: After clustering the security feature factors in the security feature factor data set, labels are assigned to the security feature factors in each cluster to obtain training set 1; it is determined whether the number of samples in training set 1 exceeds the sample number threshold. If so, training set 1 is used as the training set and input into the training module. If not, the content in the security feature factor data set 2 construction module is executed; Security feature factor data set 2 construction module: collect several feature factors related to attack situation, threat situation, asset situation, violation situation and system work order response processing of other information platforms within a preset time length, select security feature factors related to security from the feature factors, remove invalid data, convert the format, perform standardization, obtain the variance of each security feature factor, select the security feature factors whose variance exceeds the variance threshold, and form the security feature factor data set 2; Training set construction module: After clustering the security feature factors in the security feature factor data set 2, labels are assigned to the security feature factors in each cluster to obtain training set 2; the labels in training set 2 are corrected by correction factors and then merged with training set 1 to obtain training set. Training module: Use the training set to train the prediction neural network to obtain the trained prediction neural network; Evaluation module: The newly acquired security feature factors of the evaluation information platform are processed using the trained predictive neural network to obtain the security risk assessment results.

8. The security risk assessment system according to claim 7, characterized in that: The security characteristic factors include confidentiality, number of vulnerabilities, number of alarms, whether there is security protection, open port monitoring, whether there is a responsible person, whether there is security equipment, whether the storage address is clear, number of security incidents within the statistical period, number of vulnerabilities within the statistical period, number of attacks, number of threats, number of dangers, and number of violations.

9. The security risk assessment system according to claim 7, characterized in that: The correction factor is determined based on the business overlap, characteristic factor overlap, and visit volume difference ratio of different information platforms.