Information security protection system and method

Abstract

The present invention discloses an information security protection system and method, which relates to the field of information security protection technology. The system includes a behavior modeling module for collecting and standardizing terminal operation behaviors and constructing a dynamic behavior chain model; a risk assessment module for performing real-time risk analysis based on the behavior chain and outputting classification results; an access control module for dynamically adjusting access authentication and permission configuration according to risk levels to intercept abnormal access; and an abnormality repair module for automatically formulating repair decisions and executing repair operations to restore device security when abnormal patterns or high-risk states are detected. The present invention dynamically adjusts the authentication method and permission configuration strategy for access requests according to risk levels, can flexibly control resource access boundaries under different security states, and achieves better results in terms of security, accuracy, and timeliness.

Description

Technical Field

[0001] The present invention relates to the technical field of information security protection, and in particular to an information security protection system and method. Background Art

[0002] With the rapid development of information technology and the widespread adoption of terminal devices, security threats in network environments are becoming increasingly complex and diverse. Traditional static protection systems are gradually failing to meet the protection needs of dynamic threat environments. Currently, terminal security protection technologies mainly focus on signature-based detection, policy configuration, and access control. While these technologies can protect against known threats to a certain extent, they have significant limitations in response speed and protection accuracy for complex attack modes such as variant attacks, chained penetration, and zero-day vulnerability exploitation. Furthermore, the ability to detect and rapidly address abnormal behavior within terminals in real time has become a critical factor affecting the overall effectiveness of security protection. A more efficient and dynamic terminal behavior perception and adaptive protection technology system is urgently needed.

[0003] However, existing information security protection systems generally have several shortcomings. First, traditional methods mostly rely on static feature matching and lack dynamic modeling and in-depth understanding of the evolution of the terminal device operation behavior chain, resulting in difficulty in timely identifying threat trends when facing complex attack chains. Second, risk assessment mechanisms mostly use fixed thresholds or single scoring models, which are unable to dynamically adjust sensitivity according to environmental changes, resulting in insufficient adaptability and accuracy of risk perception. Third, access control systems generally use static policy configurations and lack the ability to dynamically adjust access rights and authentication mechanisms based on real-time risks, posing a potential risk of abuse of rights. In addition, existing exception handling usually relies on manual intervention or static recovery scripts, lacking a complete mechanism for intelligently making repair decisions and executing self-healing for different threat scenarios. Summary of the Invention

[0004] In view of the above-mentioned problems, the present invention is proposed.

[0005] Therefore, the technical problem solved by the present invention is: the existing information security protection methods have slow response and low intelligence in access control and exception repair processes, as well as the problem of how to achieve information security protection that integrates terminal behavior perception, dynamic risk perception, dynamic authority control and intelligent exception repair.

[0006] To solve the above technical problems, the present invention provides the following technical solutions: an information security protection system, including a behavior modeling module, which is used to collect the operation behavior, data interaction behavior and permission call behavior of terminal devices during operation, standardize and extract features of the collected data, and construct a dynamically evolving behavior chain model to describe the behavior sequence and resource access relationship of the terminal devices.

[0007] The risk assessment module is used to perform real-time security risk analysis based on the dynamic behavior chain model, dynamically assess the current security risk level of the terminal device according to node characteristics, link characteristics and environmental parameters, and output a graded risk assessment result.

[0008] The access control module is used to dynamically perform identity authentication and permission configuration adjustment of access requests according to the risk level, optimize the access rights within the terminal under different risk states, and perform real-time interception and blocking of abnormal access behaviors.

[0009] The abnormality repair module is used to automatically make repair decisions and execute repair actions when abnormal behavior patterns are detected or the risk level exceeds the preset threshold, thereby restoring the terminal device to a safe and stable state.

[0010] As a preferred solution of the information security protection system described in the present invention, the behavior modeling module is used to collect the operation behavior, data interaction behavior and permission call behavior of the terminal device in real time, and extract the standardized feature set by uniformly structuring the multimodal behavior data to form a time-series behavior unit sequence.

[0011] Based on the chronological order, resource access association and logical call relationship, a directed connection is established between the behavior units to construct a dynamically evolving behavior chain diagram to describe the operating status and resource usage path of the terminal device.

[0012] As a preferred solution of the information security protection system described in the present invention, the behavior modeling module includes a multimodal data perception sub-module for collecting system call logs, file system access records, network traffic data and application API call trajectories.

[0013] The behavioral semantic modeling submodule is used to parse features such as operation categories, resource object types, and call parameters, and map heterogeneous behaviors into standardized action sets.

[0014] The dynamic link management submodule is used to build a dynamic directed behavior chain graph based on operation timing and resource dependencies, and supports the aggregation of high-frequency related behaviors within a specified time window.

[0015] As a preferred solution of the information security protection system described in the present invention, the risk assessment module is used to receive the dynamic behavior chain diagram output by the behavior modeling module and perform a comprehensive risk analysis on each node and link in the chain.

[0016] The risk assessment module calculates the local node risk score and the overall link risk accumulation value based on the node operation category, resource sensitivity level, call frequency, and number of node connections. According to the current operating environment status of the terminal, the risk assessment module dynamically adjusts the feature weight configuration and divides the terminal behavior status into T1, T2, T3 and T4 through preset threshold standards for subsequent access control reference.

[0017] As a preferred solution of the information security protection system described in the present invention, the risk assessment module includes a risk calculation submodule for calculating local and overall risk scores based on node and link characteristics.

[0018] The dynamic weight adjustment submodule is used to adjust the feature importance weight in real time according to the terminal device environment parameters.

[0019] The risk level determination submodule is used to determine and output the security risk level label corresponding to the current terminal behavior based on the comprehensive risk score and multi-level threshold standards.

[0020] As a preferred solution of the information security protection system described in the present invention, the access control module is used to receive risk level information output by the risk assessment module, and dynamically adjust the authentication method and permission allocation strategy of the internal access request of the terminal device according to the risk level.

[0021] The access control module performs subject identity authentication, resource access rights verification, and operation legitimacy determination on each access request, dynamically controlling the scope of access rights at different risk levels.

[0022] When abnormal access characteristics are detected, the access control module triggers immediate access interruption.

[0023] As a preferred solution of the information security protection system described in the present invention, the access control module includes a dynamic authentication submodule for dynamically performing identity authentication and credential refresh of the access subject according to changes in risk levels.

[0024] The permission allocation submodule is used to dynamically adjust the minimum necessary permission set based on the relationship between the access subject and the requested resource.

[0025] The abnormal access blocking submodule is used to identify unauthorized access, unauthorized access and high-risk abnormal behavior, and immediately interrupt the corresponding access request after the judgment, and record the abnormal event.

[0026] As a preferred solution of the information security protection system described in the present invention, the abnormal repair module is used to automatically trigger the repair decision process when it detects that the terminal device has an abnormal behavior pattern or the current risk level exceeds the warning threshold.

[0027] The abnormal repair module formulates corresponding repair strategies based on the abnormal behavior type, the scope of affected resources and the abnormal behavior chain pattern, performs corresponding self-healing processing, generates execution logs during the repair process, and synchronizes the security status to the monitoring system.

[0028] As a preferred solution of the information security protection system described in the present invention, the anomaly repair module includes an anomaly detection submodule for detecting abnormal behavior types through a behavior chain abnormal pattern recognition mechanism.

[0029] The repair decision submodule is used to generate repair instruction sets such as permission adjustment, resource isolation, and process rollback based on the type of abnormal behavior and the scope of impact.

[0030] The self-healing execution submodule is used to execute specific operations in the repair instruction set, record the results of the repair actions during the execution process, and complete the recovery of the terminal security status.

[0031] Another object of the present invention is to provide an information security protection method, which can introduce a dynamic link management mechanism in the behavior modeling process, support real-time construction and incremental update of the behavior chain structure based on the time sequence and resource dependency between behavior units, and perform link aggregation processing for high-frequency operation sequences that occur intensively in a short period of time, thereby solving the problems in existing information security protection technologies such as strong static behavior modeling, large update delays, and inability to capture intensive abnormal operation chains in a timely manner.

[0032] As a preferred solution of the information security protection method described in the present invention, it includes: a behavior modeling module to collect multimodal behavior data of terminal devices, which is processed by a multimodal data perception sub-module to generate structured behavior records, a behavior semantic modeling sub-module to standardize the encoding of behavior units, and a dynamic behavior chain diagram is constructed through a dynamic link management sub-module.

[0033] In the risk assessment module, the risk calculation submodule calculates local and overall risk scores based on the behavior chain characteristics, the dynamic weight adjustment submodule adjusts the feature weights based on environmental parameters, and the risk level determination submodule outputs the risk level.

[0034] In the access control module, the dynamic authentication submodule performs access request identity authentication, the permission allocation submodule configures the minimum permission set, and the abnormal access blocking submodule interrupts unauthorized or abnormal access behavior.

[0035] In the anomaly repair module, the anomaly detection submodule identifies abnormal behavior patterns, the repair decision submodule formulates repair actions, and the self-healing execution submodule executes the repair process to restore the device to a safe state.

[0036] A computer device includes a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement a step of an information security protection method.

[0037] A computer-readable storage medium stores a computer program, which implements the steps of an information security protection method when executed by a processor.

[0038] Beneficial effects of the present invention: The information security protection system provided by the present invention dynamically constructs a real-time updated behavior chain model, effectively improving the continuity and accuracy of the terminal behavior sequence modeling, and performs multi-feature comprehensive analysis and risk dynamic weighted calculation on each node and link based on the behavior chain model. It can flexibly adjust the risk sensitivity according to environmental changes, and realize real-time and accurate graded assessment of the security status of the terminal device. The authentication method and permission configuration strategy of the access request are dynamically adjusted according to the risk level, and the resource access boundary can be flexibly controlled under different security states, effectively reducing the security risks of abnormal access and permission abuse. The present invention achieves better results in terms of security, accuracy and timeliness. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0040] Figure 1 A framework diagram of an information security protection system provided for the first embodiment of the present invention.

[0041] Figure 2 A framework diagram of a behavior modeling module and its submodules of an information security protection system provided in the first embodiment of the present invention.

[0042] Figure 3 A framework diagram of a risk assessment module and its submodules of an information security protection system provided in the first embodiment of the present invention.

[0043] Figure 4 A framework diagram of an access control module and its submodules of an information security protection system provided in the first embodiment of the present invention.

[0044] Figure 5 A framework diagram of an anomaly repair module and its submodules of an information security protection system provided in the first embodiment of the present invention. DETAILED DESCRIPTION

[0045] To make the above-mentioned objects, features, and advantages of the present invention more clearly understood, the following detailed description of the specific embodiments of the present invention is given in conjunction with the accompanying drawings. It is obvious that the described embodiments are only part of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in this field without creative work should fall within the scope of protection of the present invention.

[0046] Example 1, with reference to Figure 1-Figure 5 , as an embodiment of the present invention, provides an information security protection system, comprising:

[0047] S1: Behavior modeling module 100.

[0048] Furthermore, the behavior modeling module 100 is used to collect the operation behavior, data interaction behavior and permission calling behavior of the terminal device in real time, and extract the standardized feature set by uniformly structuring the multimodal behavior data to form a time-series behavior unit sequence.

[0049] Based on the chronological order, resource access association and logical call relationship, a directed connection is established between the behavior units to construct a dynamically evolving behavior chain diagram to describe the operating status and resource usage path of the terminal device.

[0050] It should be noted that the multimodal data perception submodule 101 is used to collect system call logs, file system access records, network traffic data and application API call traces.

[0051] The behavior semantic modeling submodule 102 is used to analyze characteristics such as operation categories, resource object types, and call parameters, and map heterogeneous behaviors into standardized action sets.

[0052] The dynamic link management submodule 103 is used to construct a dynamic directed behavior chain graph based on operation timing and resource dependency, and supports aggregation processing of high-frequency related behaviors within a specified time window.

[0053] It should also be noted that the multimodal data perception submodule 101 realizes real-time collection of system call logs, file access events, network traffic data and application layer API call traces by deploying system call interceptors, file system monitors and network data probes.

[0054] The collected data is processed by time synchronization and uniformly sorted in ascending order according to timestamps to form a multi-source unified behavioral data sequence.

[0055] The behavior semantic modeling submodule 102 performs standardized analysis on multi-source behavior data, parses each original operation record into a behavior unit, and extracts features such as operation category file reading, permission change, object attribute file path, port number, context parameter calling source process, etc.

[0056] Each behavior unit is mapped to a unified action set and assigned a standard action code.

[0057] The dynamic link management submodule 103 dynamically establishes a behavior chain diagram of the terminal device based on the time relationship, resource dependency relationship and logic call relationship of the standardized behavior units.

[0058] Each standardized behavior unit is regarded as a node. Based on the causal relationship, directed edges are established between nodes, such as a process that continuously accesses resources. They are expressed as follows:

[0059]

[0060] Define a dynamic adjacency function:

[0061]

[0062] in, Behavior Unit and The time difference, The similarity difference between resource objects is determined based on the difference in object file types combined with the preset fixed values ​​for different file differences. To call context similarity, are the weight coefficients of time difference, similarity difference and context similarity respectively, is the maximum acceptable behavioral adjacency threshold, is the dynamic behavior chain diagram at the current moment, For the moment The node set of For the moment The set of directed edges of To add a new standardized behavior unit node, For existing nodes.

[0063] when Only when it is connected in the behavior chain and .

[0064] S2: Risk assessment module 200.

[0065] Furthermore, the risk assessment module 200 is used to receive the dynamic behavior chain diagram output by the behavior modeling module 100 and perform a comprehensive risk analysis on each node and link in the chain.

[0066] The risk assessment module 200 calculates the local node risk score and the overall link risk accumulation value based on the node operation category, resource sensitivity level, call frequency, and node connection quantity characteristics. According to the current operating environment status of the terminal, the risk assessment module 200 dynamically adjusts the feature weight configuration and divides the terminal behavior status into T1, T2, T3 and T4 through the preset threshold standard for subsequent access control reference.

[0067] It should be noted that the risk assessment module 200 includes a risk calculation submodule 201 for calculating local and overall risk scores based on node and link features.

[0068] The dynamic weight adjustment submodule 202 is used to adjust the feature importance weight in real time according to the terminal device environment parameters.

[0069] The risk level determination submodule 203 is used to determine and output a security risk level label corresponding to the current terminal behavior based on the comprehensive risk score and the multi-level threshold standard.

[0070] It should also be noted that the risk calculation submodule 201 is a dynamic behavior chain diagram Taking the node as input, local risk assessment and link risk accumulation analysis are performed on each node in the chain and its adjacent links.

[0071] Specifically, for each standardized behavior unit node , extract the following local feature indicators: Operation category risk factor , resource sensitivity risk factor , calling frequency factor , node connection quantity factor .

[0072] In order to accurately characterize the interaction effect between local features and the asymmetric risk growth trend, the node local risk score The following fractional adaptive nested model is used for calculation:

[0073]

[0074] in, is the feature weighting parameter, is the resource risk nonlinear modulation index, is the frequency normalization factor.

[0075] Based on the calculation of the node local risk score, in order to further quantify the potential risk transmission impact of the node in the overall propagation of the behavior chain, the node link cumulative risk score is defined , expressed as:

[0076]

[0077] in, For nodes The neighbor set of Representation node To neighboring nodes The number of link hops or logical distance, is the link risk attenuation factor. Through the accumulation mechanism, it can effectively simulate the propagation characteristics of the risk energy in the attack path that decreases with distance, avoiding the mis-amplification of the risk of long-distance transmission.

[0078] The node's comprehensive risk score The local risk score and the link cumulative risk score are combined and calculated using an asymmetric normalized fusion model:

[0079]

[0080] in, is the fusion weight of local and link risk, is the local-link cross-modulation factor. When both the node's own high risk and the link's cumulative high risk occur simultaneously, the risk perception sensitivity is automatically enhanced.

[0081] Since the importance weights of various features of terminal devices need to change dynamically under different operating environments such as CPU load, memory usage, and network activity, the dynamic weight adjustment submodule 202 adjusts the feature weight parameters in real time according to the environmental status.

[0082] Assume the current time of the terminal device The comprehensive indicators of environmental pressure are:

[0083]

[0084] in, They are the normalized values ​​of CPU usage, memory usage and number of network connections, is the weighting coefficient of environmental indicators.

[0085] The formula for dynamic adjustment of feature weights is:

[0086]

[0087] in, The initial feature weights include is the characteristic environmental sensitivity parameter. The characteristic weight can be adaptively fine-tuned based on the actual operating pressure of the terminal, improving the adaptability of the risk assessment system to changes in the dynamic state of the equipment.

[0088] S3: Access control module 300.

[0089] Furthermore, the access control module 300 is configured to receive the risk level information output by the risk assessment module 200 and dynamically adjust the authentication method and permission allocation strategy for the internal access request of the terminal device according to the risk level.

[0090] The access control module 300 performs subject identity authentication, resource access rights verification, and operation legitimacy determination on each access request, dynamically controlling the scope of access rights under different risk levels.

[0091] Upon detecting abnormal access characteristics, the access control module 300 triggers an immediate access interruption.

[0092] It should be noted that the access control module 300 includes a dynamic authentication submodule 301 for dynamically performing identity authentication and credential refresh of the access subject according to changes in risk levels.

[0093] The permission allocation submodule 302 is used to dynamically adjust the minimum necessary permission set based on the relationship between the access subject and the requested resource.

[0094] The abnormal access blocking submodule 303 is used to identify unauthorized access, unauthorized access and high-risk abnormal behavior, and immediately interrupt the corresponding access request after the determination, and record the abnormal event.

[0095] It should also be noted that the dynamic authentication submodule 301 performs dynamic authentication strength, which is expressed as:

[0096]

[0097] in, is the credibility score of the subject’s recent behavior, Indicates the access subject. Indicates the risk level, is the mapping function of risk level to authentication requirement, The value indicating the risk level, is the activation function, is a weighting coefficient specific to the access control module 300 . A measure of behavioral deviation. are the credibility coefficient and the certification requirement coefficient respectively.

[0098] The access request that passes the verification is marked as valid access and passed to the permission allocation submodule 302. In a low-risk state, the submodule grants the minimum necessary permission based on a preset permission template.

[0099] In medium- and high-risk situations, the sub-module dynamically shrinks the permission boundaries, restricting access to sensitive resources or reducing access frequency.

[0100] In a critical risk state, the submodule rejects all non-whitelist access requests.

[0101] Permission allocation decisions are updated based on real-time status, and access control logs are recorded after the policy takes effect.

[0102] The abnormal access blocking submodule 303 identifies unauthenticated requests, requests with inconsistent permissions, and access requests with obvious abnormal behavior characteristics, and interrupts the system call, network communication, or resource access link in real time. Blocked events are synchronized to the abnormality repair module 400 and the upper-level security management platform, and the blocking log is recorded for subsequent audit and analysis.

[0103] S4: Abnormality repair module 400.

[0104] Furthermore, the abnormality repair module 400 is used to automatically trigger a repair decision process when it detects that the terminal device has an abnormal behavior pattern or the current risk level exceeds the warning threshold.

[0105] The abnormality repair module 400 formulates corresponding repair strategies based on the abnormal behavior type, the scope of affected resources and the abnormal behavior chain pattern, performs corresponding self-healing processing, generates execution logs during the repair process, and synchronizes the security status to the monitoring system.

[0106] It should be noted that the anomaly repair module 400 includes an anomaly detection submodule 401 for detecting abnormal behavior types through a behavior chain abnormal pattern recognition mechanism.

[0107] The repair decision submodule 402 is used to generate a repair instruction set such as permission adjustment, resource isolation, process rollback, etc. based on the abnormal behavior type and impact scope.

[0108] The self-healing execution submodule 403 is used to execute specific operations in the repair instruction set and record the repair action results during the execution process to complete the recovery of the terminal security status.

[0109] It should also be noted that when the anomaly detection submodule 401 detects abnormal permissions such as permission tampering, excessive permission expansion, or unauthorized access on the terminal device, the repair decision submodule 402 formulates the following hierarchical repair strategies based on the type of anomaly and the scope of permissions of the affected account:

[0110] If an abnormality in the permissions of the general user level is detected, the repair decision submodule 402 formulates a repair instruction to freeze the current subject session and roll back to the historical security permission template.

[0111] If an abnormality is detected in a high-authority account such as an administrator account, the repair decision submodule 402 not only formulates a permission rollback instruction, but also formulates a repair instruction that triggers a multi-factor authentication process to verify whether the account has been illegally hijacked.

[0112] Subsequently, the self-healing execution submodule 403 executes operations such as session freezing, permission rollback, and multi-factor authentication triggering according to the repair instruction set, and records a complete repair log during the execution process for subsequent audit tracing.

[0113] When the anomaly detection submodule 401 detects that the terminal device has illegally accessed sensitive files, frequently accessed restricted devices, or tampered with key system resources, the repair decision submodule 402 formulates a corresponding repair strategy based on the resource sensitivity level:

[0114] If the abnormal access involves a common-level resource, the repair decision submodule 402 formulates a repair instruction to interrupt the access request and adjust the subject resource access whitelist.

[0115] If the abnormal access involves encryption key storage or system configuration files, the repair decision submodule 402 formulates repair instructions for resource isolation, locking sensitive directories, suspending related services, and marking the abnormal subject as a high-risk object.

[0116] The self-healing execution submodule 403 then performs actions such as access interruption, resource isolation, and service suspension, and updates the system resource protection strategy in real time, while synchronizing the exception handling records to the central security monitoring system.

[0117] When the anomaly detection submodule 401 detects abnormalities such as abnormal process startup, process behavior drift, or malicious code injection on the terminal device, the repair decision submodule 402 formulates a treatment plan based on the degree of the anomaly and the scope of impact:

[0118] For occasional abnormal calls, the repair decision submodule 402 formulates repair instructions that limit resource usage and reduce priority.

[0119] When memory injection or malicious remote control behavior is detected, the repair decision submodule 402 formulates repair instructions to immediately terminate the abnormal process, isolate related resources, and trigger a system integrity check.

[0120] The self-healing execution submodule 403 completes specific operations such as process termination, resource isolation, and system scanning according to the repair instructions, and generates a detailed execution log after the operation is completed to record the entire exception handling process.

[0121] When the anomaly detection submodule 401 detects abnormal network behavior of the terminal device, such as abnormal port monitoring, traffic surge, or frequent connections to blacklisted IP addresses, the repair decision submodule 402 formulates the following strategy based on the anomaly type:

[0122] For occasional abnormal connections, formulate repair instructions to block the source of abnormal connections and record the behavior.

[0123] For controlled communication characteristic C2 behavior, formulate repair instructions to cut off external terminal connections, isolate it to the intranet security zone, and strengthen firewall policy updates.

[0124] In the process of handling all types of exceptions, the self-healing execution submodule 403 follows the following general process:

[0125] According to the instruction set generated by the repair decision submodule 402, the instructions are executed one by one in the order of priority.

[0126] The repair status is updated after each instruction is executed, and safety integrity verification is performed.

[0127] For exceptions that cannot be automatically repaired or have secondary risks, the self-healing execution submodule 403 automatically escalates the event to the manual audit processing process to ensure closed-loop management of the entire exception processing process.

[0128] Generate detailed logs throughout the process, recording detection time, repair actions, repair results, and subsequent verification status.

[0129] After receiving the instruction, the self-healing execution submodule 403 executes connection blocking, isolation actions, adjusts firewall rules, and pushes abnormal event information to the security operation center SOC for further correlation analysis.

[0130] Example 2 is the second embodiment of the present invention, which is different from the previous embodiment in that:

[0131] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the existing technology, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a number of instructions for enabling a computer device, such as a personal computer, server, or network device, to execute all or part of the steps of the various embodiments of the method of the present invention. The aforementioned storage medium includes various media that can store program code, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0132] The logic and / or steps represented in the flowcharts or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing the logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device, such as a computer-based system, a system including a processor, or other system that can fetch instructions from and execute instructions on an instruction execution system, apparatus, or device. For purposes of this specification, a "computer-readable medium" can be any device that can contain, store, communicate, propagate, or transport a program for use by, or in conjunction with, an instruction execution system, apparatus, or device.

[0133] A non-exhaustive list of more specific examples of computer-readable media includes the following: an electronic device with one or more wired electrical connections, a portable computer diskette, a magnetic device, a random access memory RAM, a read-only memory ROM, an erasable and programmable read-only memory EPROM or flash memory, an optical fiber device, and a portable compact disc read-only memory CDROM. In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering, or processing in another suitable manner as necessary, and then stored in a computer memory.

[0134] It should be understood that various parts of the present invention can be implemented using hardware, software, firmware, or a combination thereof. In the above-described embodiments, multiple steps or methods can be implemented using software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented using hardware, as in another embodiment, it can be implemented using any one or a combination of the following technologies known in the art: a discrete logic circuit having logic gate circuits for implementing logic functions on data signals, an application-specific integrated circuit having suitable combinational logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0135] Example 3 is the third embodiment of the present invention. This embodiment provides a method for an information security protection system, including a behavior modeling module 100 that collects multimodal behavior data of a terminal device, which is processed by a multimodal data perception sub-module 101 to generate structured behavior records, a behavior semantic modeling sub-module 102 that standardizes the encoding of behavior units, and a dynamic behavior chain diagram that is constructed by a dynamic link management sub-module 103.

[0136] In the risk assessment module 200 , the risk calculation submodule 201 calculates local and overall risk scores based on behavior chain features, the dynamic weight adjustment submodule 202 adjusts feature weights based on environmental parameters, and the risk level determination submodule 203 outputs the risk level.

[0137] In the access control module 300 , the dynamic authentication submodule 301 performs access request identity authentication, the permission allocation submodule 302 configures a minimum permission set, and the abnormal access blocking submodule 303 interrupts unauthorized or abnormal access behavior.

[0138] In the abnormal repair module 400, the abnormality detection submodule 401 identifies abnormal behavior patterns, the repair decision submodule 402 formulates repair actions, and the self-healing execution submodule 403 executes the repair process to restore the device to a safe state.

[0139] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. An information security protection system, characterized in that: include: A behavior modeling module (100) is used to collect the operation behavior, data interaction behavior and permission calling behavior of the terminal device during operation, perform standardization processing and feature extraction on the collected data, and construct a dynamically evolving behavior chain model to describe the behavior sequence and resource access relationship of the terminal device; A risk assessment module (200) is used to perform real-time security risk analysis based on the dynamic behavior chain model, dynamically assess the current security risk level of the terminal device according to node characteristics, link characteristics and environmental parameters, and output a graded risk assessment result; An access control module (300) is used to dynamically perform identity authentication and permission configuration adjustment of access requests according to the security risk level, optimize the control of access rights within the terminal under different risk states, and perform real-time interception and blocking of abnormal access behaviors; An abnormality repair module (400) is used to automatically formulate a repair decision and execute a repair action when an abnormal behavior pattern is detected or the risk level exceeds a preset threshold, so as to restore the terminal device to a safe and stable state; The behavior modeling module (100) includes a multimodal data perception submodule (101) which realizes real-time collection of system call logs, file access events, network traffic data and application layer API call traces by deploying a system call interceptor, a file system monitor and a network data probe; The collected data is processed by time synchronization and sorted in ascending order according to timestamps to form a multi-source unified behavioral data sequence; The behavior semantic modeling submodule (102) performs standardized parsing on multi-source behavior data, parses each original operation record into a behavior unit, and extracts operation category file reading, permission change, object attribute file path, port number, and context parameter calling source process features; Each behavior unit is mapped to a unified action set and assigned a standard action code; The dynamic link management submodule (103) dynamically establishes a behavior chain diagram of the terminal device based on the time relationship, resource dependency relationship and logic call relationship of the standardized behavior units; Each standardized behavior unit is regarded as a node. Based on the causal relationship, directed edges are established between nodes, such as a process that continuously accesses resources. They are expressed as follows: Define a dynamic adjacency function: in, Behavior Unit and The time difference, The similarity difference between resource objects is determined based on the difference in object file types combined with the preset fixed values ​​for different file differences. To call context similarity, are the weight coefficients of time difference, similarity difference and context similarity respectively, is the dynamic behavior chain diagram at the current moment, For the moment The node set of For the moment The set of directed edges of To add a new standardized behavior unit node, For existing nodes; when Only when it is connected in the behavior chain and , is the maximum acceptable behavioral adjacency threshold.

2. The information security protection system according to claim 1, wherein: The behavior modeling module (100) is used to collect the operation behavior, data interaction behavior and permission calling behavior of the terminal device in real time, and extract a standardized feature set by uniformly structuring the multimodal behavior data to form a time-series behavior unit sequence; Based on the chronological order, resource access association and logical call relationship, a directed connection is established between the behavior units to construct a dynamically evolving behavior chain diagram to describe the operating status and resource usage path of the terminal device.

3. The information security protection system according to claim 2, wherein: The risk assessment module (200) is used to receive the dynamic behavior chain diagram output by the behavior modeling module (100) and perform a comprehensive risk analysis on each node and link in the chain; The risk assessment module (200) calculates the local node risk score and the overall link risk accumulation value based on the node operation category, resource sensitivity level, call frequency, and node connection quantity characteristics. According to the current operating environment status of the terminal, the risk assessment module (200) dynamically adjusts the feature weight configuration and divides the terminal behavior status into T1, T2, T3, and T4 through a preset threshold standard for reference in subsequent access control.

4. The information security protection system according to claim 3, wherein: The access control module (300) is used to receive the risk level information output by the risk assessment module (200), and dynamically adjust the authentication method and authority allocation strategy of the internal access request of the terminal device according to the risk level; The access control module (300) performs subject identity authentication, resource access right verification and operation legitimacy determination on each access request, and dynamically controls the scope of access rights under different risk levels; Upon detecting abnormal access characteristics, the access control module (300) triggers immediate access interruption.

5. The information security protection system according to claim 4, characterized in that: The abnormality repair module (400) is used to automatically trigger a repair decision process when detecting that a terminal device has an abnormal behavior pattern or the current risk level exceeds a warning threshold; The abnormality repair module (400) formulates corresponding repair strategies based on the abnormal behavior type, the scope of affected resources and the abnormal behavior chain mode, executes corresponding self-healing processing, generates execution logs during the repair process, and synchronizes the security status to the monitoring system.

6. The information security protection system according to claim 4, wherein: The risk assessment module (200) includes a risk calculation submodule (201) for calculating local and overall risk scores based on node and link characteristics; A dynamic weight adjustment submodule (202) is used to adjust the feature importance weight in real time according to terminal device environment parameters; The risk level determination submodule (203) is used to determine and output a security risk level label corresponding to the current terminal behavior based on the comprehensive risk score and the multi-level threshold standard.

7. The information security protection system according to claim 4, wherein: The access control module (300) includes a dynamic authentication submodule (301) for dynamically performing identity authentication and credential refresh of the access subject according to changes in risk levels; The permission allocation submodule (302) is used to dynamically adjust the minimum necessary permission set based on the relationship between the access subject and the requested resource; The abnormal access blocking submodule (303) is used to identify unauthorized access, unauthorized access and high-risk abnormal behavior, and immediately interrupt the corresponding access request after the determination, and record the abnormal event.

8. The information security protection system according to claim 4, wherein: The anomaly repair module (400) includes an anomaly detection submodule (401) for detecting abnormal behavior types through a behavior chain abnormal pattern recognition mechanism; A repair decision submodule (402) is used to generate a set of repair instructions for permission adjustment, resource isolation, and process rollback based on the abnormal behavior type and impact range; The self-healing execution submodule (403) is used to execute specific operations in the repair instruction set and record the results of the repair actions during the execution process to complete the recovery of the terminal security status.

9. A method using the information security protection system according to any one of claims 1 to 8, characterized in that: The system comprises a behavior modeling module (100) for collecting multimodal behavior data of a terminal device, a multimodal data perception submodule (101) for processing the data to generate a structured behavior record, a behavior semantic modeling submodule (102) for standardizing and encoding behavior units, and a dynamic link management submodule (103) for constructing a dynamic behavior chain diagram; In the risk assessment module (200), the risk calculation submodule (201) calculates local and overall risk scores based on the behavior chain characteristics, the dynamic weight adjustment submodule (202) adjusts the feature weights based on the environmental parameters, and the risk level determination submodule (203) outputs the risk level; In the access control module (300), the dynamic authentication submodule (301) performs access request identity authentication, the authority allocation submodule (302) configures the minimum authority set, and the abnormal access blocking submodule (303) interrupts unauthorized or abnormal access behavior; In the abnormal repair module (400), the abnormal detection submodule (401) identifies abnormal behavior patterns, the repair decision submodule (402) formulates repair actions, and the self-healing execution submodule (403) executes the repair process to restore the device to a safe state.

Images