Information security level protection evaluation system and method

Abstract

The present application provides an information security level protection evaluation system and method. First, different types of system logs in the information system to be tested are obtained; the time dependency between each system log when the information system to be tested is performing data protection is extracted from all system logs; the element association graph between each log event is determined based on the semantic features of each log event in each system log and the association features of each log event in the forward propagation process of the long short-term memory network; the evaluation constraint value of each system log in the level protection evaluation process is determined through the element association graph and the time dependency between each system log; the evaluation model of the level protection of the information system to be tested is constructed by combining the evaluation constraint value of each system log in the level protection evaluation process with the long short-term memory network. The solution of the present application can realize adaptive evaluation of the security level of the information system under dynamic changes in system configuration.

Description

Technical Field

[0001] The present application relates to the field of security assessment technology, and more specifically, to an information security level protection assessment system and method. Background Art

[0002] Security assessment uses a variety of security assessment tools to comprehensively evaluate the security of information systems in order to identify their security vulnerabilities, weaknesses and potential threats. Common security assessment techniques include vulnerability scanning, penetration testing, and risk assessment. Vulnerability scanning uses automated tools to detect known security vulnerabilities, while penetration testing simulates hacker attacks to discover system security risks from a practical perspective. Risk assessment helps organizations identify and quantify the risks of security threats and take effective preventive measures. Security assessment not only improves system security, but also ensures compliance and prevents security incidents such as data leakage and information tampering. The comprehensive use of these security assessment technologies can achieve all-round protection of information systems and reduce the incidence of security incidents.

[0003] The construction of the existing information security level protection evaluation model relies on a variety of technical means. Through efficient technical means, security risks in the information system are discovered, and then combined with risk assessment technology, potential threats, vulnerabilities and possible impacts of the information system are identified. Then, the security protection level of the information system is determined through quantitative risk assessment. However, most of the existing information systems use automated system configuration management. Especially in microservice architectures, containerized environments and cloud computing platforms, system configurations change frequently, resulting in the inability to accurately evaluate the actual security status of the information system during security evaluation. Therefore, how to achieve adaptive evaluation of the security level of the information system under dynamic changes in system configuration has become a difficult problem faced by the industry. Summary of the Invention

[0004] The present application provides an information security level protection evaluation system and method, which can realize adaptive evaluation of the information system security level under dynamic changes in system configuration.

[0005] In a first aspect, the present application provides a method for constructing an information security level protection evaluation model, which is used for constructing an evaluation model for an information security level protection evaluation system. The method comprises the following steps:

[0006] Obtain different types of system logs in the information system under test;

[0007] Extracting the time dependency between the various system logs of the information system under test when performing data protection from all system logs based on a pre-trained long short-term memory network;

[0008] Determine an element association graph between each log event when the information system under test performs data protection according to the semantic features of each log event in each system log and the association features of each log event in the forward propagation process of the long short-term memory network;

[0009] Determine the evaluation constraint value of each system log in the level protection evaluation process through the time dependency relationship between the various system logs and the element association diagram;

[0010] The long short-term memory network is used in combination with the evaluation constraint value of each system log in the level protection evaluation process to construct an evaluation model for the level protection of the information system to be tested.

[0011] In some embodiments, extracting the time dependency between the system logs of the information system under test when performing data protection based on the pre-trained long short-term memory network from all system logs specifically includes:

[0012] Determine the time window sequence of each system log when the information system under test performs data protection by using the time difference between all adjacent log events in each system log;

[0013] The time dependency between the system logs when the information system to be tested performs data protection is determined based on the pre-trained long short-term memory network and the time window sequence of all system logs.

[0014] In some embodiments, determining an element association graph between each log event when the information system under test performs data protection based on the semantic features of each log event in each system log and the association features of each log event in the forward propagation process of the long short-term memory network specifically includes:

[0015] Determine the semantic characteristics of each log event in each system log;

[0016] Determine a log event graph of the information system under test when performing data protection according to all semantic features;

[0017] The element association graph between each log event when the information system under test performs data protection is determined through the log event graph and the association characteristics of each log event in the forward propagation process of the long short-term memory network.

[0018] In some embodiments, determining the evaluation constraint value of each system log in the level protection assessment process through the time dependency relationship between the system logs and the element association diagram specifically includes:

[0019] Determine the element distance of each system log in the level protection assessment process through the element association diagram;

[0020] Perform linear fitting on all element distances to obtain the fitting curve of element distance;

[0021] The evaluation constraint value of each system log in the level protection evaluation process is determined based on the fitting curve of the element distance and the time dependency relationship between each system log.

[0022] In some embodiments, using the long short-term memory network in combination with the evaluation constraint value of each system log in the level protection evaluation process to construct the evaluation model of the information system level protection to be tested specifically includes:

[0023] Performing anomaly detection on all system logs through the long short-term memory network to obtain anomaly evaluation parameters of the information system under test when performing data protection;

[0024] Determine the evaluation weight of each system log in the level protection evaluation process according to the abnormal evaluation parameter and the evaluation constraint value of each system log in the level protection evaluation process;

[0025] An evaluation model for the level protection of the information system to be tested is constructed using all evaluation weights.

[0026] In some embodiments, the information system to be tested is a system for automatic system configuration management.

[0027] In some embodiments, the types of system logs include operation logs, event logs, audit logs, and security logs.

[0028] In a second aspect, the present application provides an information security level protection evaluation system, the system including an evaluation model construction unit, the evaluation model construction unit including:

[0029] The acquisition module is used to obtain different types of system logs in the information system under test;

[0030] A processing module, configured to extract, from all system logs, a time dependency relationship between the system logs when the information system under test is performing data protection based on a pre-trained long short-term memory network;

[0031] The processing module is further configured to determine an element association graph between each log event when the information system under test performs data protection based on the semantic features of each log event in each system log and the association features of each log event in the forward propagation process of the long short-term memory network;

[0032] The processing module is further configured to determine an evaluation constraint value of each system log in the level protection evaluation process through the time dependency relationship between the system logs and the element association diagram;

[0033] An execution module is used to construct an evaluation model for the level protection of the information system to be tested by using the long short-term memory network in combination with the evaluation constraint value of each system log in the level protection evaluation process.

[0034] In a third aspect, the present application provides a computer device comprising a memory and a processor, wherein the memory stores code, and the processor is configured to obtain the code and execute the above-mentioned method for constructing an information security level protection assessment model.

[0035] In a fourth aspect, the present application provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the above-mentioned information security level protection evaluation model construction method.

[0036] The technical solutions provided by the embodiments disclosed in this application have the following beneficial effects:

[0037] In the information security level protection evaluation system and method provided by the present application, first, different types of system logs in the information system to be tested are obtained; based on the pre-trained long short-term memory network, the time dependency relationship between each system log when the information system to be tested performs data protection is extracted from all system logs; according to the semantic features of each log event in each system log and the association features of each log event in the forward propagation process of the long short-term memory network, the element association graph between each log event when the information system to be tested performs data protection is determined; the evaluation constraint value of each system log in the level protection evaluation process is determined through the time dependency relationship between the system logs and the element association graph; the long short-term memory network is used in combination with the evaluation constraint value of each system log in the level protection evaluation process to construct an evaluation model for the level protection of the information system to be tested.

[0038] It can be seen that in this application, the evaluation constraint value of each system log in the level protection evaluation process can be determined by the time dependency relationship between the various system logs and the element association diagram; wherein, first, the time dependency relationship between different types of log events is extracted from all system logs, and the time dependency relationship represents the sequential parameters of the temporal correlation of different log events in each system log in the information system. The time dependency relationship can be used to identify the characteristics of abnormal system configuration changes, thereby providing dynamic support for adaptive security assessment; secondly, the semantic features of each log event in each system log are combined with the association features of each log event in the long short-term memory network during the forward propagation process to construct an element association diagram that describes the mutual transmission of information elements between different log events when the information system to be tested is performing data protection. The element association diagram can reflect the relationship between log events in the information system and system configuration. The dynamically updated association relationship between the configurations is established, so that the security level assessment can timely reflect the dynamic changes of the system configuration; then, the evaluation constraint value of each system log in the level protection assessment process is quantified through the time dependency relationship between the element association graph and each system log, wherein the evaluation constraint value represents the constraint value of the system log when performing risk assessment on the information system to be tested during the level protection assessment process, and the accuracy of the security assessment of the information system to be tested when the system configuration changes can be improved by evaluating the constraint value; finally, the long short-term memory network is used in combination with the evaluation constraint value of each system log in the level protection assessment process to construct an evaluation model for the level protection of the information system to be tested, and the security level protection level of the information system to be tested is evaluated through the evaluation model; in summary, the solution of the present application can realize adaptive evaluation of the security level of the information system under dynamic changes in the system configuration. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 This is an exemplary flow chart of a method for constructing an information security level protection evaluation model according to some embodiments of the present application;

[0040] Figure 2 is a schematic diagram of a process for determining an element association diagram according to some embodiments of the present application;

[0041] Figure 3 is a schematic diagram of a process for determining an evaluation constraint value according to some embodiments of the present application;

[0042] Figure 4 is a schematic diagram of the structure of the evaluation model construction unit according to some embodiments of the present application;

[0043] Figure 5 It is a structural diagram of a computer device for implementing a method for constructing an evaluation model for information security level protection according to some embodiments of the present application. DETAILED DESCRIPTION

[0044] In order to better understand the technical solution of the present application, the technical solution of the present application will be described in detail below with reference to the accompanying drawings and specific implementation methods.

[0045] refer to Figure 1 , which is an exemplary flow chart of a method for constructing an information security level protection evaluation model according to some embodiments of the present application. The information security level protection evaluation model construction method 100 mainly includes the following steps:

[0046] In step 101, different types of system logs in the information system to be tested are obtained.

[0047] It should be noted that the types of system logs described in this application include operation logs, event logs, audit logs and security logs. Among them, the operation logs record all operation behaviors in the information system to be tested, such as user login, system setting changes, program execution, etc., the event logs record events that occur in the information system to be tested, such as startup, shutdown, errors, warnings, etc., the audit logs record security-related operations of the information system to be tested, especially access rights, file operations, user activities, etc., and the security logs record security events of the information system to be tested, such as intrusion detection, malicious activities, authorization failures, etc. In addition, there are multiple system logs of the same type in the information system to be tested.

[0048] In specific implementation, different types of system logs in the information system to be tested can be obtained from the database of the information system to be tested, and the information system to be tested is a system for automatic system configuration management.

[0049] In step 102, the time dependency between the system logs when the information system under test is performing data protection is extracted from all system logs based on the pre-trained long short-term memory network.

[0050] In some embodiments, extracting the time dependency between the system logs of the information system under test when performing data protection based on a pre-trained long short-term memory network from all system logs can be achieved by the following steps:

[0051] Determine the time window sequence of each system log when the information system under test performs data protection by using the time difference between all adjacent log events in each system log;

[0052] The time dependency between the system logs when the information system to be tested performs data protection is determined based on the pre-trained long short-term memory network and the time window sequence of all system logs.

[0053] It should be noted that the pre-trained long short-term memory network in this application refers to a long short-term memory neural network pre-trained on a large-scale data set. This neural network has been trained for a long time on a large amount of system log data to learn the correlation between various log events in the system log and the abnormality of the system log.

[0054] It should be noted that the log events mentioned in this application refer to key information recorded in the information system regarding specific activities, operations or status changes.

[0055] In a specific implementation, first, a system log is selected as the selected system log, and the timestamps of all adjacent log events in the selected system log are subtracted and the absolute values ​​are taken. All the values ​​obtained by taking the absolute values ​​are used as the time differences of all adjacent log events in the selected system log. Furthermore, a density-based clustering algorithm (DBSCAN) is used to cluster the time differences of all adjacent log events in the selected system log, thereby obtaining multiple clusters. Then, the largest cluster is selected from all clusters, and all the time differences in the largest cluster are sorted in ascending order. The sorted sequence is used as the time window sequence of the selected system log, and the time window sequences of the remaining system logs are further determined. Secondly, the time window sequence of each system log is input into a pre-trained long short-term memory network, and the output results of the long short-term memory network are used as time dependency vectors. Then, cosine similarity is calculated for every two time dependency vectors, thereby obtaining multiple cosine similarities. The maximum cosine similarity is further selected from all the cosine similarities, and the maximum cosine similarity is used as the time dependency relationship between the system logs when the information system under test is performing data protection. In other embodiments, other methods can also be used for implementation, which will not be repeated here.

[0056] It should be noted that the time dependency relationship described in this application represents a sequential parameter of temporal correlation between different log events in each system log in the information system.

[0057] In step 103, an element association graph between each log event when the information system under test performs data protection is determined based on the semantic features of each log event in each system log and the association features of each log event in the forward propagation process of the long short-term memory network.

[0058] In some embodiments, reference Figure 2 As shown in FIG, this figure is a schematic diagram of a process for determining an element association graph in some embodiments of the present application. In this embodiment, the element association graph between each log event of the information system under test when performing data protection is determined based on the semantic features of each log event in each system log and the association features of each log event in the forward propagation process of the long short-term memory network can be implemented by the following steps:

[0059] First, in step 1031, the semantic features of each log event in each system log are determined;

[0060] Next, in step 1032, a log event graph of the information system under test when performing data protection is determined based on all semantic features;

[0061] Then, in step 1033, an element association graph between each log event when the information system under test performs data protection is determined through the log event graph and the association characteristics of each log event in the forward propagation process of the long short-term memory network.

[0062] It should be noted that the semantic features described in this application represent the key features of the log event in semantic representation, and the semantic features can reveal the deep meaning of the log event background; the association features represent the features that are mutually associated in behavioral patterns between log events.

[0063] In addition, it should be noted that the log event graph described in this application represents a graph structure of the mutual correlation between different log events when the information system under test performs data protection, wherein each node corresponds to a log event.

[0064] In the specific implementation, first, for each system log, a word segmentation tool (such as jieba) is used to segment each log event in the system log, and the data after word segmentation are input into the BERT model, so that the output of the BERT model is used as the semantic feature of each log event in the system log. Among them, BERT is a powerful pre-trained language model that can effectively capture the contextual semantic information of the system log; secondly, the semantic features of each log event in all system logs are converted into vectors, and the cosine similarity between each two vectors is further calculated. Based on graph theory, each log event is regarded as a node, and the cosine similarity between the vectors of the semantic features of the log events is used as an edge to construct a graph structure. , and the obtained graph is used as the log event graph of the information system under test when performing data protection; then, the semantic features of each log event are added to the unit state of the input gate of the long short-term memory network during the forward propagation process, and the results obtained by the short-term memory network after the forward propagation are used as the correlation features of each log event, and then, for each node in the log event graph, the edges connecting the log events corresponding to the nodes are multiplied by the correlation features of the log events corresponding to the nodes, and then the log event graph after the edges are updated is obtained, and the log event graph after the edges are updated is used as the element association graph between the various log events when the information system under test performs data protection. In other embodiments, other methods can also be used for implementation, which is not limited here.

[0065] It should be noted that the element association diagram described in this application represents a graph structure that describes the mutual transmission of information elements between different log events when the information system under test performs data protection.

[0066] In step 104, the evaluation constraint value of each system log in the level protection evaluation process is determined through the time dependency relationship between the various system logs and the element association diagram.

[0067] In some embodiments, reference Figure 3 As shown, this figure is a schematic diagram of the process of determining the evaluation constraint value in some embodiments of the present application. In this embodiment, the evaluation constraint value of each system log in the level protection assessment process is determined by the time dependency relationship between the various system logs and the element association diagram. The following steps can be used to achieve this:

[0068] First, in step 1041, the element distance of each system log in the level protection assessment process is determined through the element association diagram;

[0069] Next, in step 1042, linear fitting is performed on all element distances to obtain a fitting curve of element distances;

[0070] Then, in step 1043, the evaluation constraint value of each system log in the level protection evaluation process is determined based on the fitting curve of the element distance and the time dependency relationship between each system log.

[0071] In the specific implementation, first, a node is selected from the element association graph as the selected node, and the shortest distance between the selected node and other nodes in the element association graph is calculated, wherein the distance is measured by the total length of the edges between the interconnected nodes in the element association graph, and the shortest distance between the selected node and other nodes in the element association graph is used as the local element distance of the log event corresponding to the selected node, and the local element distances of the log events corresponding to the remaining nodes in the element association graph are continued to be determined. For each system log, the local element distances of the log events belonging to the same system log are summed, and the summed value is used as the element distance of the system log in the level protection evaluation process, thereby obtaining the element distance of all system logs in the level protection evaluation process; secondly, the least squares method in the existing technology is used. A linear fit is performed on all element distances using the support vector machine algorithm, and the curve obtained by fitting is used as the fitting curve of the element distance, wherein each value on the fitting curve is used as the element distance fitting value, and each element distance fitting value corresponds to an element distance; then, a system log is selected as the selected system log, and the element distance of the selected system log in the level protection evaluation process is subtracted from the element distance fitting value on the fitting curve corresponding to the element distance, and the value obtained by subtraction is multiplied by the time dependency between the system logs, and the multiplied value is used as the evaluation constraint value of the selected system log in the level protection evaluation process, and the evaluation constraint values ​​of the remaining system logs in the level protection evaluation process are continued to be determined. Other methods can also be used to implement this in other embodiments, which will not be repeated here.

[0072] It should be noted that the evaluation constraint value described in this application represents the constraint value of the system log when conducting risk assessment on the information system under test during the level protection evaluation process.

[0073] In step 105, the long short-term memory network is used in combination with the evaluation constraint value of each system log in the level protection evaluation process to construct an evaluation model for the level protection of the information system to be tested.

[0074] In some embodiments, the following steps may be used to construct the evaluation model for the level protection of the information system to be tested by using the long short-term memory network in combination with the evaluation constraint value of each system log during the level protection evaluation process:

[0075] Performing anomaly detection on all system logs through the long short-term memory network to obtain anomaly evaluation parameters of the information system under test when performing data protection;

[0076] Determine the evaluation weight of each system log in the level protection evaluation process according to the abnormal evaluation parameter and the evaluation constraint value of each system log in the level protection evaluation process;

[0077] An evaluation model for the level protection of the information system to be tested is constructed using all evaluation weights.

[0078] In the specific implementation, first, a log parsing tool (such as Log Parsers) is used to extract key fields from each system log to obtain the key fields of each system log, wherein the key fields include timestamp, event type, log level, user ID, IP address, operation type, etc. The key fields of each system log are input into the long short-term memory network, and the output results of the long short-term memory network are used as the anomaly score of each system log. The average of all anomaly scores is further calculated, and the obtained average is used as the anomaly evaluation parameter of the information system to be tested when performing data protection; secondly, the evaluation constraint value of each system log in the level protection evaluation process is multiplied by the anomaly evaluation parameter, and the multiplied value is used as the evaluation weight of each system log in the level protection evaluation process; then, a density-based clustering algorithm (DBSCAN) is used to cluster all the evaluation weights to obtain multiple clusters, and the set of all clusters is used as the evaluation model of the level protection of the information system to be tested. Other methods can also be used in other embodiments, which are not limited here.

[0079] It should be noted that in this application, the security level of the information system to be tested can be selected according to the "Computer Information System Security Protection Level Classification Criteria". For example: if the security level of the information system to be tested is selected as the fifth level in the "Computer Information System Security Protection Level Classification Criteria", then the sum of all evaluation weights in the largest cluster in the evaluation model of the information system level protection to be tested is used as the security evaluation value of the information system level protection to be tested. The larger the security evaluation value, the better the information system level protection to be tested, and the smaller the security evaluation value, the worse the information system level protection to be tested. If the security level of the information system to be tested is selected as the fourth level in the "Computer Information System Security Protection Level Classification Criteria", then the sum of all evaluation weights in the second largest cluster in the evaluation model of the information system level protection to be tested is used as the security evaluation value of the information system level protection to be tested, and so on. Therefore, the security evaluation of the information system to be tested can be performed according to the evaluation model of the information system level protection to be tested. In other embodiments, other methods can also be used to achieve this, which will not be repeated here.

[0080] In addition, it should be noted that the evaluation model described in this application represents a model for evaluating the security level protection level of the information system to be tested.

[0081] In addition, in another aspect of the present application, in some embodiments, the present application provides an information security level protection evaluation system, the system includes an evaluation model construction unit, reference Figure 4, which is a schematic diagram of the structure of an evaluation model construction unit according to some embodiments of the present application. The evaluation model construction unit 400 includes: an acquisition module 401, a processing module 402 and an execution module 403, which are described as follows:

[0082] Acquisition module 401, in this application, acquisition module 401 is mainly used to obtain different types of system logs in the information system under test;

[0083] Processing module 402, in this application, is used to extract the time dependency between the various system logs of the information system under test when performing data protection from all system logs based on a pre-trained long short-term memory network;

[0084] It should be noted that the processing module 402 in the present application is further used to determine an element association graph between each log event when the information system under test performs data protection based on the semantic features of each log event in each system log and the association features of each log event in the forward propagation process of the long short-term memory network;

[0085] In addition, the processing module 402 in this application is also used to determine the evaluation constraint value of each system log in the level protection evaluation process through the time dependency relationship between the various system logs and the element association diagram;

[0086] Execution module 403, in this application, execution module 403 is mainly used to use the long short-term memory network combined with the evaluation constraint value of each system log in the level protection evaluation process to construct an evaluation model for the level protection of the information system to be tested.

[0087] In addition, the present application also provides a computer device, which includes a memory and a processor, the memory stores code, and the processor is configured to obtain the code and execute the above-mentioned information security level protection evaluation model construction method.

[0088] In some embodiments, reference Figure 5 , which is a schematic diagram of the structure of a computer device for implementing the method for constructing an evaluation model for information security level protection according to some embodiments of the present application. The method for constructing an evaluation model for information security level protection in the above embodiment can be achieved by Figure 5 The computer device 500 shown in FIG. 5 is implemented as shown in FIG. 5 . The computer device 500 includes at least one processor 501 , a communication bus 502 , a memory 503 , and at least one communication interface 504 .

[0089] The processor 501 can be a general-purpose central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more devices for controlling the execution of the information security level protection evaluation model construction method in this application.

[0090] The communication bus 502 may be used to transmit information between the aforementioned components.

[0091] The memory 503 may be a read-only memory (ROM) or other static storage device that can store static information and instructions, a random access memory (RAM) or other dynamic storage device that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, an optical disc storage (including a compact disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk or other magnetic storage device, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 503 may be independent and connected to the processor 501 via the communication bus 502. The memory 503 may also be integrated with the processor 501.

[0092] The memory 503 is used to store program code for executing the solution of the present application, and is controlled by the processor 501. The processor 501 is used to execute the program code stored in the memory 503. The program code may include one or more software modules. The method described in the above method embodiment can be implemented by the processor 501 and one or more software modules in the program code in the memory 503.

[0093] The communication interface 504 uses any transceiver or other device for communicating with other devices or communication networks, such as Ethernet, radio access network (RAN), wireless local area network (WLAN), etc.

[0094] In a specific implementation, as an embodiment, a computer device may include multiple processors, each of which may be a single-core (single-CPU) processor or a multi-core (multi-CPU) processor. The processor herein may refer to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions).

[0095] The aforementioned computer device may be a general-purpose computer device or a dedicated computer device. In a specific implementation, the computer device may be a desktop computer, a portable computer, a network server, a personal digital assistant (PDA), a mobile phone, a tablet computer, a wireless terminal device, a communication device, or an embedded device. The embodiments of the present application do not limit the type of computer device.

[0096] In addition, the present application also provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the above-mentioned information security level protection evaluation model construction method.

[0097] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present application.

[0098] Obviously, those skilled in the art may make various changes and modifications to this application without departing from the spirit and scope of this application. Thus, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalents, this application is intended to include these modifications and variations.

Claims

1. A method for constructing an information security level protection evaluation model, which is used for constructing an evaluation model for an information security level protection evaluation system, and is characterized in that: The method comprises the following steps: Obtain different types of system logs in the information system under test; Extracting the time dependency between the various system logs of the information system under test when performing data protection from all system logs based on a pre-trained long short-term memory network; Determine an element association graph between each log event when the information system under test performs data protection according to the semantic features of each log event in each system log and the association features of each log event in the forward propagation process of the long short-term memory network; Determine the evaluation constraint value of each system log in the level protection evaluation process through the time dependency relationship between the various system logs and the element association diagram; The long short-term memory network is used in combination with the evaluation constraint value of each system log in the level protection evaluation process to construct an evaluation model for the level protection of the information system to be tested; Among them, determining the element association graph between each log event when the information system under test performs data protection based on the semantic features of each log event in each system log and the association features of each log event in the forward propagation process of the long short-term memory network specifically includes: Determine the semantic characteristics of each log event in each system log; Determine a log event graph of the information system under test when performing data protection according to all semantic features; The element association graph between each log event when the information system under test performs data protection is determined through the log event graph and the association characteristics of each log event in the forward propagation process of the long short-term memory network.

2. The method according to claim 1, wherein The time dependency between the system logs of the information system under test when performing data protection is extracted from all system logs based on the pre-trained long short-term memory network, specifically including: Determine the time window sequence of each system log when the information system under test performs data protection by using the time difference between all adjacent log events in each system log; The time dependency between the system logs when the information system to be tested performs data protection is determined based on the pre-trained long short-term memory network and the time window sequence of all system logs.

3. The method according to claim 1, wherein Determining the evaluation constraint value of each system log in the level protection assessment process through the time dependency relationship between the system logs and the element association diagram specifically includes: Determine the element distance of each system log in the level protection assessment process through the element association diagram; Perform linear fitting on all element distances to obtain the fitting curve of element distance; The evaluation constraint value of each system log in the level protection evaluation process is determined based on the fitting curve of the element distance and the time dependency relationship between each system log.

4. The method according to claim 1, wherein The evaluation model for the level protection of the information system to be tested is constructed by using the long short-term memory network in combination with the evaluation constraint value of each system log in the level protection evaluation process, specifically including: Performing anomaly detection on all system logs through the long short-term memory network to obtain anomaly evaluation parameters of the information system under test when performing data protection; Determine the evaluation weight of each system log in the level protection evaluation process according to the abnormal evaluation parameter and the evaluation constraint value of each system log in the level protection evaluation process; An evaluation model for the level protection of the information system to be tested is constructed using all evaluation weights.

5. The method according to claim 1, wherein The information system to be tested is a system for automatic system configuration management.

6. The method according to claim 1, wherein The types of system logs include operation logs, event logs, audit logs and security logs.

7. An information security level protection evaluation system, comprising an evaluation model construction unit, wherein the evaluation model is constructed by the method according to any one of claims 1 to 6, characterized in that: The evaluation model building unit includes: The acquisition module is used to obtain different types of system logs in the information system under test; A processing module, configured to extract, from all system logs, a time dependency relationship between the system logs when the information system under test is performing data protection based on a pre-trained long short-term memory network; The processing module is further configured to determine an element association graph between each log event when the information system under test performs data protection based on the semantic features of each log event in each system log and the association features of each log event in the forward propagation process of the long short-term memory network; The processing module is further configured to determine an evaluation constraint value of each system log in the level protection evaluation process through the time dependency relationship between the system logs and the element association diagram; An execution module is used to construct an evaluation model for the level protection of the information system to be tested by using the long short-term memory network in combination with the evaluation constraint value of each system log in the level protection evaluation process.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the method for constructing an information security level protection evaluation model according to any one of claims 1 to 6 is implemented.

9. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method for constructing an information security level protection evaluation model according to any one of claims 1 to 6 is implemented.

Images