Operation control platform of high-safety information system and use method of operation control platform

Abstract

The invention relates to the technical field of information security, in particular to an operation control platform of a high-security information system and a use method thereof. The technical problems are as follows: in a traditional information system, monitoring mainly depends on manually set threshold value monitoring and regular system inspection, but the monitoring mode has obvious hysteresis quality and can only find and process problems after the problems occur, and potential system threats are difficult to early warn in advance; according to the technical scheme, the operation control platform of the high-safety information system comprises a control core module, an intelligent monitoring and early warning module, a safety management module, a storage management module and a log record auditing module; compared with a traditional information system which has hysteresis quality and is difficult to warn potential system threats in advance, the system data is analyzed in real time by using the AI algorithm, and abnormal modes and potential threats can be recognized in advance, so that the system security problem is effectively warned and processed, and the security and response speed of the system are greatly improved.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and particularly to an operation control platform for a high-security information system and its usage method. Background Art

[0002] Today, with the rapid development of informatization, information systems have become the core components of enterprise and organizational operations; these systems carry a large amount of sensitive data and key business processes, so their security and stability are crucial; however, traditional information systems have many deficiencies in security assurance, especially in the prevention and response capabilities to system threats;

[0003] Traditional information systems mainly rely on manually set threshold monitoring and regular system inspections to maintain security; in this mode, system administrators set the thresholds of some key parameters based on experience and historical data, and when the system operating state exceeds these thresholds, an alarm will be triggered; at the same time, the system will also conduct a comprehensive inspection regularly to discover and repair potential security vulnerabilities; however, this monitoring method has obvious lag; since the thresholds are set according to historical data and experience, they may not be able to adapt to new threats and attack methods in a timely manner; in addition, regular system inspections can often only discover and handle problems after they occur, and it is difficult to predict potential system threats in advance. Summary of the Invention

[0004] In order to overcome the problems in traditional information systems that mainly rely on manually set threshold monitoring and regular system inspections, however, this monitoring method has obvious lag, and can often only discover and handle problems after they occur, and it is difficult to predict potential system threats in advance.

[0005] The technical solution of the present invention is as follows: An operation control platform for a high-security information system, including:

[0006] A control core module, which is used to control access to system resources, ensure that only authorized operations can be executed, execute software programs, process and analyze data, and ensure the correct execution of system logic;

[0007] An intelligent monitoring and early warning module, which is used to collect system operating status, network traffic, and user behavior data, and use AI algorithms to perform real-time analysis on the collected data to identify abnormal patterns and potential threats;

[0008] A security management module, which is used for user authentication and permission management, ensure that only authenticated users can access the system, and allocate corresponding permissions according to user roles;

[0009] A storage management module, which is used to securely store system data, key information of software programs, and regularly back up system data to ensure rapid recovery in case of data loss or damage;

[0010] The log recording and auditing module is used to record the log information of all system operations, user behaviors, and security events, audit the system logs regularly, and check for abnormal behaviors and security vulnerabilities.

[0011] Preferably, the control core module is used to control access to system resources to ensure that only authorized operations can be executed, execute software programs, process and analyze data, and ensure the correct execution of system logic; the intelligent monitoring and warning module collects system operation status, network traffic, and user behavior data, and uses AI algorithms to analyze the collected data in real time to identify abnormal patterns and potential threats; the security management module is used for user authentication and permission management to ensure that only authenticated users can access the system and assign corresponding permissions according to user roles; the storage management module securely stores system data and key information of software programs, backs up system data regularly, and ensures rapid recovery in case of data loss or damage; the log recording and auditing module records the log information of all system operations, user behaviors, and security events, audits the system logs regularly, and checks for abnormal behaviors and security vulnerabilities.

[0012] Preferably, the control core module includes a control unit and an information processing unit; the control unit is used to physically control access to system resources. The control unit includes a hardware switch and a controller; the hardware switch is used to turn on or off access to specific system resources, including servers, databases, and network devices, and the hardware switch ensures that only authorized personnel can operate through a password protection mechanism; the controller receives instructions from the information processing unit and controls the status of the hardware switch according to these instructions; the information processing unit is used to be responsible for executing software programs, processing and analyzing data, and ensuring the correct execution of system logic. The information processing unit includes a program execution engine and a data analysis unit; the program execution engine is used to be responsible for running various software programs of the system, including operating systems, application programs, and security software; the data analysis unit is used to process and analyze various data collected by the system, including system status data, user behavior data, and network traffic data, and discovers abnormalities and potential threats in the system through data processing and analysis; when the control core module is working, it includes the following steps:

[0013] S201: When the system starts, the control core module first performs initialization operations, including loading system configurations, checking the status of hardware switches, and starting the program execution engine;

[0014] S202: After initialization is completed, the control core module enters a standby state, waiting to receive instructions and data;

[0015] S203: When the system needs to access specific resources, it sends an instruction to the control core module. After receiving the instruction, the control core module first verifies the instruction to ensure its legality and correctness.

[0016] S204: After the verification passes, the control core module passes the instruction to the information processing unit for processing. The information processing component executes corresponding programs and operations according to the instruction content and returns the processing result to the control core module.

[0017] S205: The control core module controls the opening or closing of the hardware switch according to the result returned by the information processing unit to perform access control on system resources.

[0018] S206: During the resource access process, the control core module continuously monitors the resource usage situation and system status.

[0019] S207: When the control core module discovers abnormal behaviors and potential threats during the monitoring process, including unauthorized access attempts and abnormal resource usage, it triggers the early warning mechanism. After the early warning mechanism is started, the control core module processes according to the preset response strategy, including cutting off the abnormal access and notifying the administrator.

[0020] Preferably, the intelligent monitoring and early warning module includes a data collection sub-module, a data analysis sub-module, and an early warning response sub-module; the data collection sub-module is used to collect system operation status, network traffic, and user behavior data by using sensors and log recording methods; the data analysis sub-module is used to perform real-time analysis on the collected data by using the long short-term memory network model algorithm to identify and predict abnormal patterns and potential threats; the early warning response sub-module is used to trigger the early warning mechanism when the data analysis sub-module detects potential threats and process through the preset response strategy.

[0021] Preferably, when the intelligent monitoring and early warning module is working, it includes the following steps:

[0022] S401: The data collection sub-module collects system operation status, network traffic, and user behavior data through sensors and log recording methods.

[0023] S402: The data is transmitted to the data analysis sub-module.

[0024] S403: Preprocess the collected data, including data cleaning, denoising, and format conversion; convert the data into time series data.

[0025] S404: The data analysis sub-module uses the LSTM model, an anomaly detection algorithm based on deep learning, to perform real-time analysis on the preprocessed data. By learning the time series features of historical data, it determines whether there are anomalies in the current data and predicts the anomaly patterns and potential threats in the system for a period of time in the future;

[0026] S405: If the analysis result of the LSTM model algorithm shows potential threats, the early warning response sub-module immediately triggers the early warning mechanism.

[0027] Preferably, the data analysis sub-module uses the LSTM model, an anomaly detection algorithm based on deep learning, to perform real-time analysis on the preprocessed data. By learning the time series features of historical data, it determines whether there are anomalies in the current data and predicts the anomaly patterns and potential threats in the system for a period of time in the future; The LSTM layer of the LSTM model contains multiple LSTM cells. Each cell processes the data of one time step and passes the information to the next time step. The internal state of the LSTM cell is controlled by the forget gate, input gate, and output gate. The specific calculation steps of the LSTM model are as follows:

[0028] S501: The input layer receives the preprocessed time series data as input;

[0029] S502: Determine how much information from the previous time step needs to be forgotten through the forget gate. The calculation formula is as follows:

[0030] f t =σ(W f ·[h t-1 ,x t +b f );

[0031] Among them, f t is the output of the forget gate, σ is the activation function, W f is the weight matrix, h t-1 is the hidden state of the previous time step, x t is the input of the current time step, b f is the bias term;

[0032] S503: Determine how much information of the current time step needs to be added to the cell state through the input gate. The calculation formula is as follows:

[0033] i t =σ(W i ·[h t-1 ,x t +b i );

[0034] Among them, i t is the output of the input gate;

[0035] S504: Update the cell state according to the outputs of the forget gate and the input gate. The calculation formula is as follows:

[0036] C t = f t · C t-1 + i t · tanh(W C · [h t-1 , x t + b C );

[0037] Among them, C t is the cell state at the current time step;

[0038] S505: Determine the output at the current time step through the output gate. The calculation formula is as follows:

[0039] o t = σ(W o · [h t-1 , x t + b o );

[0040] h t = o t · tanh(C t );

[0041] Among them, o t is the output of the output gate, and h t is the hidden state at the current time step;

[0042] S506: The output layer further processes the output of the LSTM layer, including a fully connected layer, a softmax layer, etc., to obtain the final prediction result.

[0043] Preferably, the security management module includes a user authentication and permission management unit, a security policy configuration unit, and a security event monitoring and response unit; the user authentication and permission management unit is used to verify the identity of the user to ensure that only legitimate users can access the system, and allocate corresponding system resource access permissions according to the roles and responsibilities of the users; the security policy configuration unit defines which users or user groups can access which resources, and when and where they can access these resources through access control policies, and determines the encryption method of data during storage and transmission through data encryption policies to protect the confidentiality and integrity of the data; the security event monitoring and response unit is used to monitor the security events of the system, including login attempts, permission changes, and data access, and trigger a response mechanism when detecting suspicious activities or potential threats, including sending alerts, isolating the infected area, and recording events.

[0044] Preferably, when the security management module is working, it includes the following steps:

[0045] S701: The user inputs the username and password through the login interface;

[0046] S702: The system verifies the user information. If the information is correct, the user is allowed to access the system; if the information is incorrect, the access is refused and the login attempt is recorded;

[0047] S703: The system assigns corresponding system resource access permissions to the user according to the user's role and permission configuration;

[0048] S704: When the user attempts to access a resource, the system checks the user's permissions. If the user has the permission to access, the access is allowed; otherwise, the access is refused;

[0049] S705: The system conducts real-time inspection and control on the user's access request according to the configured security policy. If the user request conforms to the security policy, the operation is allowed; if not, the operation is refused and the event is recorded;

[0050] S706: The system continuously monitors the user behavior, system status and security events. When suspicious activities or potential threats are detected, the system triggers the response mechanism.

[0051] Preferably, the storage management module includes a secure storage unit, a data backup unit and a storage management unit; the secure storage unit is used to encrypt and store data using encryption technology to prevent the data from being accessed by unauthorized users and implement the access control policy to ensure that only authorized users or processes can access the stored data; the data backup unit is used to automatically back up the system data regularly to ensure rapid recovery in case of data loss or damage; the storage management unit is used to monitor the status and usage of the storage device, promptly discover and handle storage failures or insufficient capacity problems, provide the dynamic allocation and adjustment function of storage resources, optimize the utilization of storage resources according to the system requirements, and at the same time support the life cycle management of stored data, including the processes of data creation, use, archiving and deletion.

[0052] Preferably, the log recording and auditing module includes a log recording unit, a log storage unit, a security auditing unit, and an alarm response unit; the log recording unit is used to capture and record all system operations, including but not limited to system startup, shutdown, configuration changes, resource access, record user behaviors, including login attempts, successful logins, logouts, permission usage, file access, record security events, including unauthorized access attempts, malware detections, security policy violations; the log storage unit is used to store log information, prevent unauthorized access and tampering, provide log query and retrieval functions, facilitate quick location and analysis of specific events, and implement log lifecycle management, including the processes of log creation, storage, archiving, and deletion; the security auditing unit is used to regularly audit system logs, check for abnormal behaviors or security vulnerabilities, analyze log information according to preset auditing rules and policies, generate audit reports, and provide visual displays of audit results for easy understanding and analysis by administrators; the alarm response unit is used to trigger an alarm mechanism when abnormal behaviors or security vulnerabilities are found during auditing, provide real-time alarm notifications, including emails, text messages, system pop-ups, ensure that administrators respond in a timely manner, and execute corresponding handling measures according to preset response policies, including isolating the infected area and notifying relevant users.

[0053] The operating control platform usage method for a high-security information system includes the following steps:

[0054] S1001: At system startup, perform initialization configuration, including loading security policies and setting hardware switch states;

[0055] S1002: Configure the intelligent monitoring and warning module, and set data collection frequencies, analysis models, and warning threshold parameters;

[0056] S1003: Users perform identity authentication through the security management module to ensure that only authorized users can access the system;

[0057] S1004: The system assigns corresponding system resource access permissions according to the roles and permissions of users;

[0058] S1005: When the system is running normally, the intelligent monitoring and warning module continuously collects and analyzes system data;

[0059] S1006: Once potential threats or abnormal behaviors are detected, immediately trigger the warning mechanism and handle them through preset response policies;

[0060] S1007: The system regularly audits system logs to check for abnormal behaviors or security vulnerabilities;

[0061] S1008: Record the log information of all system operations, user behaviors, and security events;

[0062] S1009: Adjust the system configuration and optimize the security policy in a timely manner according to the feedback of the intelligent monitoring and early warning system, and regularly maintain and upgrade the system.

[0063] Advantages of the present invention:

[0064] 1. In comparison with traditional information systems that mainly rely on manually set threshold monitoring and regular system inspections, this monitoring method has obvious lag. It often can only detect and handle problems after they occur and is difficult to early warn of potential system threats. By using AI algorithms to analyze system data in real time, the present invention can identify abnormal patterns and potential threats in advance, thus effectively warning and handling system security problems, greatly improving the security and response speed of the system.

[0065] 2. The control core module of the present invention realizes the physical control of system resources through hardware switches and controllers, ensuring that only authorized operations can be executed, enhancing the physical security of the system.

[0066] 3. Through the user authentication and permission management functions of the security management module, it can ensure that only authenticated users can access the system and allocate corresponding permissions according to user roles, realizing fine-grained access control.

[0067] 4. The log record auditing module can record the log information of all system operations, user behaviors, and security events, and regularly audit the system logs, which helps to detect and handle abnormal behaviors and security vulnerabilities in a timely manner, improving the auditability and traceability of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0068] Figure 1 Shown is a schematic diagram of the working process of the operation control platform of the high-security information system of the present invention;

[0069] Figure 2 Shown is a schematic diagram of the steps of the usage method of the operation control platform of the high-security information system of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0070] The present invention will be further described below with reference to the drawings and embodiments.

[0071] Please refer to Figure 1-2 , the present invention provides an embodiment: an operation control platform of a high-security information system and its usage method, including:

[0072] A control core module for controlling access to system resources, ensuring that only authorized operations can be executed, executing software programs, processing and analyzing data, and ensuring the correct execution of system logic;

[0073] Intelligent Monitoring and Warning Module, which is used to collect system operation status, network traffic, and user behavior data, and uses AI algorithms to analyze the collected data in real time to identify abnormal patterns and potential threats;

[0074] Security Management Module, which is used for user authentication and permission management to ensure that only authenticated users can access the system and assign corresponding permissions according to user roles;

[0075] Storage Management Module, which is used to securely store system data and key information of software programs, and regularly back up system data to ensure rapid recovery in case of data loss or damage;

[0076] Log Recording and Auditing Module, which is used to record log information of all system operations, user behaviors, and security events, and regularly audit system logs to check for abnormal behaviors and security vulnerabilities.

[0077] Preferably, the Control Core Module is used to control access to system resources to ensure that only authorized operations can be executed, execute software programs, process and analyze data to ensure the correct execution of system logic; the Intelligent Monitoring and Warning Module collects system operation status, network traffic, and user behavior data, and uses AI algorithms to analyze the collected data in real time to identify abnormal patterns and potential threats; the Security Management Module is used for user authentication and permission management to ensure that only authenticated users can access the system and assign corresponding permissions according to user roles; the Storage Management Module securely stores system data and key information of software programs, and regularly back up system data to ensure rapid recovery in case of data loss or damage; the Log Recording and Auditing Module records log information of all system operations, user behaviors, and security events, and regularly audit system logs to check for abnormal behaviors and security vulnerabilities.

[0078] Preferably, the control core module includes a control unit and an information processing unit; the control unit is used for physically controlling the access to system resources. The control unit includes a hardware switch and a controller; the hardware switch is used to turn on or off the access to specific system resources, including servers, databases, and network devices. The hardware switch ensures that only authorized personnel can operate through a password protection mechanism; the controller receives instructions from the information processing unit and controls the state of the hardware switch according to these instructions; the information processing unit is responsible for executing software programs, processing and analyzing data, and ensuring the correct execution of system logic. The information processing unit includes a program execution engine and a data analysis unit; the program execution engine is responsible for running various software programs of the system, including operating systems, application programs, and security software; the data analysis unit is used to process and analyze various data collected by the system, including system status data, user behavior data, and network traffic data. Through data processing and analysis, anomalies and potential threats in the system are discovered; when the control core module is working, it includes the following steps:

[0079] S201: When the system starts, the control core module first performs initialization operations, including loading system configurations, checking the status of the hardware switch, and starting the program execution engine;

[0080] S202: After initialization is completed, the control core module enters the standby state, waiting to receive instructions and data;

[0081] S203: When the system needs to access specific resources, an instruction is sent to the control core module. After receiving the instruction, the control core module first performs instruction verification to ensure the legality and correctness of the instruction;

[0082] S204: After verification passes, the control core module passes the instruction to the information processing unit for processing. The information processing component executes corresponding programs and operations according to the instruction content and returns the processing result to the control core module;

[0083] S205: The control core module controls the opening or closing of the hardware switch according to the result returned by the information processing unit to perform access control on system resources;

[0084] S206: During the resource access process, the control core module continuously monitors the resource usage situation and system status;

[0085] S207: When the control core module discovers abnormal behaviors and potential threats during the monitoring process, including unauthorized access attempts and abnormal resource usage, it triggers an early warning mechanism; after the early warning mechanism is started, the control core module processes according to the preset response strategy, including cutting off abnormal access and notifying the administrator.

[0086] Preferably, the intelligent monitoring and early warning module includes a data acquisition sub-module, a data analysis sub-module, and an early warning response sub-module; the data acquisition sub-module is used to collect system operation status, network traffic, and user behavior data by using sensors and log recording methods; the data analysis sub-module is used to perform real-time analysis on the collected data by using the long short-term memory network model algorithm to identify and predict abnormal patterns and potential threats; the early warning response sub-module is used to trigger the early warning mechanism when the data analysis sub-module detects potential threats and process them through preset response strategies.

[0087] Preferably, when the intelligent monitoring and early warning module is working, it includes the following steps:

[0088] S401: The data acquisition sub-module collects system operation status, network traffic, and user behavior data through sensors and log recording methods;

[0089] S402: The data is transmitted to the data analysis sub-module;

[0090] S403: Preprocess the collected data, including data cleaning, denoising, and format conversion; convert the data into time series data;

[0091] S404: The data analysis sub-module performs real-time analysis on the preprocessed data by using the LSTM model, an anomaly detection algorithm based on deep learning. By learning the time series features of historical data, it determines whether there are anomalies in the current data and predicts the abnormal patterns and potential threats of the system in the next period of time;

[0092] S405: If the analysis result of the LSTM model algorithm shows potential threats, the early warning response sub-module immediately triggers the early warning mechanism.

[0093] Preferably, the data analysis sub-module performs real-time analysis on the preprocessed data by using the LSTM model, an anomaly detection algorithm based on deep learning. By learning the time series features of historical data, it determines whether there are anomalies in the current data and predicts the abnormal patterns and potential threats of the system in the next period of time; the LSTM layer of the LSTM model contains multiple LSTM units, each unit processes the data of one time step and passes the information to the next time step, and the internal state of the LSTM unit is controlled by the forget gate, input gate, and output gate. The specific calculation steps of the LSTM model are as follows:

[0094] S501: The input layer receives the preprocessed time series data as input;

[0095] S502: Determine how much information from the previous time step needs to be forgotten through the forget gate. The calculation formula is as follows:

[0096] f t= σ(W f · [h t-1 , x t + b f );

[0097] Where f t is the output of the forget gate, σ is the activation function, W f is the weight matrix, h t-1 is the hidden state at the previous time step, x t is the input at the current time step, and b f is the bias term;

[0098] S503: Determine how much information at the current time step needs to be added to the cell state through the input gate. The calculation formula is as follows:

[0099] i t = σ(W i · [h t-1 , x t + b i );

[0100] Where i t is the output of the input gate;

[0101] S504: Update the cell state according to the outputs of the forget gate and the input gate. The calculation formula is as follows:

[0102] C t = f t · C t-1 + i t · tanh(W C · [h t-1 , x t + b C );

[0103] Where C t is the cell state at the current time step;

[0104] S505: Determine the output at the current time step through the output gate. The calculation formula is as follows:

[0105] o t = σ(W o · [h t-1 , x t + b o );

[0106] h t = o t · tanh(C t );

[0107] Where o t is the output of the output gate, and ht is the hidden state at the current time step;

[0108] S506: The output layer further processes the output of the LSTM layer, including a fully connected layer, a softmax layer, etc., to obtain the final prediction result.

[0109] Preferably, the security management module includes a user authentication and permission management unit, a security policy configuration unit, and a security event monitoring and response unit; the user authentication and permission management unit is used to verify the identity of the user, ensure that only legitimate users can access the system, and allocate corresponding system resource access permissions according to the roles and responsibilities of the users; the security policy configuration unit defines which users or user groups can access which resources, and when and where they can access these resources through access control policies, and determines the encryption method of data during storage and transmission through data encryption policies to protect the confidentiality and integrity of the data; the security event monitoring and response unit is used to monitor the security events of the system, including login attempts, permission changes, and data access, and trigger a response mechanism when detecting suspicious activities or potential threats, including sending alerts, isolating the infected area, and recording events.

[0110] Preferably, when the security management module is working, it includes the following steps:

[0111] S701: The user enters the username and password through the login interface;

[0112] S702: The system verifies the user information. If the information is correct, the user is allowed to access the system; if the information is incorrect, access is denied and the login attempt is recorded;

[0113] S703: The system allocates corresponding system resource access permissions to the user according to the user's role and permission configuration;

[0114] S704: When the user attempts to access a resource, the system checks the user's permissions. If the user has permission to access, access is allowed; otherwise, access is denied;

[0115] S705: The system performs real-time inspection and control on the user's access request according to the configured security policy; if the user request conforms to the security policy, the operation is allowed; if not, the operation is denied and the event is recorded;

[0116] S706: The system continuously monitors the user behavior, system status, and security events, and triggers a response mechanism when detecting suspicious activities or potential threats.

[0117] Preferably, the storage management module includes a secure storage unit, a data backup unit, and a storage management unit; the secure storage unit is used to encrypt and store data using encryption technology to prevent unauthorized access to the data and implement access control policies to ensure that only authorized users or processes can access the stored data; the data backup unit is used to automatically back up system data regularly to ensure rapid recovery in case of data loss or corruption; the storage management unit is used to monitor the status and usage of storage devices, promptly detect and handle storage failures or insufficient capacity problems, provide dynamic allocation and adjustment functions for storage resources, optimize the utilization of storage resources according to system requirements, and at the same time support the life cycle management of stored data, including the processes of data creation, use, archiving, and deletion.

[0118] Preferably, the log recording and auditing module includes a log recording unit, a log storage unit, a security auditing unit, and an alarm response unit; the log recording unit is used to capture and record all system operations, including but not limited to system startup, shutdown, configuration changes, resource access, record user behaviors, including login attempts, successful logins, logouts, permission usage, file access, and record security events, including unauthorized access attempts, malware detections, security policy violations; the log storage unit is used to store log information, prevent unauthorized access and tampering, provide log query and retrieval functions to facilitate quick location and analysis of specific events, and implement log life cycle management, including the processes of log creation, storage, archiving, and deletion; the security auditing unit is used to regularly audit system logs to check for abnormal behaviors or security vulnerabilities, analyze log information according to preset audit rules and policies, generate audit reports, and provide visual displays of audit results to facilitate understanding and analysis by administrators; the alarm response unit is used to trigger an alarm mechanism when abnormal behaviors or security vulnerabilities are detected during auditing, provide real-time alarm notifications, including emails, text messages, system pop-ups, to ensure that administrators can respond promptly and execute corresponding handling measures according to preset response policies, including isolating the infected area and notifying relevant users.

[0119] The usage method of the operation control platform for a high-security information system includes the following steps:

[0120] S1001: At system startup, perform initialization configuration, including loading security policies and setting the states of hardware switches;

[0121] S1002: Configure the intelligent monitoring and early warning module, and set data collection frequencies, analysis models, and early warning threshold parameters;

[0122] S1003: Users authenticate through the security management module to ensure that only authorized users can access the system;

[0123] S1004: The system assigns corresponding system resource access permissions according to the user's role and permissions;

[0124] S1005: When the system is running normally, the intelligent monitoring and early warning module continuously collects and analyzes system data;

[0125] S1006: Once potential threats or abnormal behaviors are detected, the early warning mechanism is immediately triggered and processed through preset response strategies;

[0126] S1007: The system regularly audits system logs to check for abnormal behaviors or security vulnerabilities;

[0127] S1008: Record the log information of all system operations, user behaviors, and security events;

[0128] S1009: According to the feedback of the intelligent monitoring and early warning system, timely adjust the system configuration and optimize the security strategy, and regularly maintain and upgrade the system.

[0129] The embodiments of the present invention have been described in detail above in conjunction with the accompanying drawings. However, the present invention is not limited to the above embodiments, and various changes can be made without departing from the spirit of the present invention within the scope of knowledge possessed by those skilled in the art.

Claims

1. Operating control platform for a high-security information system; characterized in that: It includes: A control core module, which is used to control access to system resources, ensure that only authorized operations can be executed, execute software programs, process and analyze data, and ensure the correct execution of system logic; An intelligent monitoring and warning module, which is used to collect system operation status, network traffic, and user behavior data, and use AI algorithms to analyze the collected data in real time to identify abnormal patterns and potential threats; A security management module, which is used for user authentication and permission management, ensuring that only authenticated users can access the system and assigning corresponding permissions according to user roles; A storage management module, which is used to securely store system data and key information of software programs, and regularly back up system data to ensure rapid recovery in case of data loss or damage; A log recording and auditing module, which is used to record log information of all system operations, user behaviors, and security events, and regularly audit system logs to check for abnormal behaviors and security vulnerabilities.

2. The operation control platform of the high-security information system according to claim 1, characterized in that: The control core module includes a control unit and an information processing unit; the control unit is used to physically control access to system resources, and the control unit includes a hardware switch and a controller; the hardware switch is used to turn on or off access to specific system resources, including servers, databases, and network devices, and the hardware switch ensures that only authorized personnel can operate through a password protection mechanism; the controller receives instructions from the information processing unit and controls the state of the hardware switch according to these instructions; the information processing unit is used to be responsible for executing software programs, processing and analyzing data, and ensuring the correct execution of system logic, and the information processing unit includes a program execution engine and a data analysis unit; the program execution engine is used to be responsible for running various software programs of the system, including operating systems, application programs, and security software; the data analysis unit is used to process and analyze various data collected by the system, including system status data, user behavior data, and network traffic data, and discover abnormalities and potential threats in the system through data processing and analysis; when the control core module is working, it includes the following steps: S201: When the system starts up, the control core module first performs initialization operations, including loading system configurations, checking the status of hardware switches, and starting the program execution engine; S202: After initialization is completed, the control core module enters a standby state, waiting to receive instructions and data; S203: When the system needs to access specific resources, it sends an instruction to the control core module. After receiving the instruction, the control core module first performs instruction verification to ensure the legality and correctness of the instruction; S204: After verification passes, the control core module passes the instruction to the information processing unit for processing. The information processing component executes corresponding programs and operations according to the instruction content and returns the processing result to the control core module; S205: The control core module controls the opening or closing of the hardware switch according to the result returned by the information processing unit to perform access control on system resources; S206: During the resource access process, the control core module continuously monitors the usage of resources and the system status; S207: When the control core module detects abnormal behaviors and potential threats during monitoring, including unauthorized access attempts and abnormal resource usage, it triggers the warning mechanism. After the warning mechanism is activated, the control core module processes according to the preset response strategies, including cutting off the abnormal access and notifying the administrator.

3. The operation control platform of the high-security information system according to claim 2, characterized in that: The intelligent monitoring and warning module includes a data collection sub-module, a data analysis sub-module, and a warning response sub-module. The data collection sub-module is used to collect system operation status, network traffic, and user behavior data by using sensors and logging methods. The data analysis sub-module is used to perform real-time analysis on the collected data by using the long short-term memory network model algorithm to identify and predict abnormal patterns and potential threats. The warning response sub-module is used to trigger the warning mechanism when the data analysis sub-module detects potential threats and process through the preset response strategies.

4. The operation control platform of the high-security information system according to claim 3, characterized in that: When the intelligent monitoring and warning module is working, it includes the following steps: S401: The data collection sub-module collects system operation status, network traffic, and user behavior data through sensors and logging methods. S402: The data is transmitted to the data analysis sub-module. S403: Preprocess the collected data, including data cleaning, denoising, and format conversion; convert the data into time series data. S404: The data analysis sub-module performs real-time analysis on the preprocessed data by using the LSTM model, an anomaly detection algorithm based on deep learning. By learning the time series features of historical data, it determines whether there are abnormalities in the current data and predicts the abnormal patterns and potential threats of the system in the next period of time. S405: If the analysis result of the LSTM model algorithm shows potential threats, the warning response sub-module immediately triggers the warning mechanism.

5. The operation control platform of the high-security information system according to claim 4, characterized in that: The data analysis sub-module performs real-time analysis on the preprocessed data by using the LSTM model, an anomaly detection algorithm based on deep learning. By learning the time series features of historical data, it determines whether there are abnormalities in the current data and predicts the abnormal patterns and potential threats of the system in the next period of time. The LSTM layer of the LSTM model contains multiple LSTM units. Each unit processes the data of one time step and passes the information to the next time step. The internal state of the LSTM unit is controlled by the forget gate, input gate, and output gate. The specific calculation steps of the LSTM model are as follows: S501: The input layer receives the preprocessed time series data as input. S502: Determine how much information from the previous time step needs to be forgotten through the forget gate. The calculation formula is as follows: f t = σ(W f · [h t-1 , x t + b f ); where, f t is the output of the forget gate, σ is the activation function, W f is the weight matrix, h t-1 is the hidden state at the previous time step, x t is the input at the current time step, b f is the bias term; S503: Determine how much information of the current time step needs to be added to the cell state through the input gate. The calculation formula is as follows: i t = σ(W i · [h t-1 , x t + b i ); where i t is the output of the input gate; S504: Update the cell state according to the outputs of the forget gate and input gate. The calculation formula is as follows: C t = f t ·C t-1 + i t ·tanh(W C ·[h t-1 , x t + b C ) Among them, C t is the cell state at the current time step; S505: Determine the output of the current time step through the output gate. The calculation formula is as follows: o t = σ(W o · [h t-1 , x t + b o ); h t = o t ·tanh(C t ); where, o t is the output of the output gate, h t is the hidden state at the current time step; S506: The output layer further processes the output of the LSTM layer, including the fully connected layer, softmax layer, etc., to obtain the final prediction result.

6. The operation control platform of the high-security information system according to claim 5, characterized in that: The security management module includes a user authentication and authorization management unit, a security policy configuration unit, and a security event monitoring and response unit; the user authentication and authorization management unit is used to verify the identity of users, ensure that only legitimate users can access the system, and allocate corresponding system resource access permissions according to the roles and responsibilities of users; the security policy configuration unit defines which users or user groups can access which resources, and when and where they can access these resources through access control policies, and determines the encryption method of data during storage and transmission through data encryption policies to protect the confidentiality and integrity of data; The security event monitoring and response unit is used to monitor the security events of the system, including login attempts, permission changes, and data access. When suspicious activities or potential threats are detected, it triggers a response mechanism, including sending alerts, isolating the infected area, and recording events.

7. The operation control platform of the high-security information system according to claim 6, characterized in that: When the security management module is working, it includes the following steps: S701: The user enters the username and password through the login interface; S702: The system verifies the user information. If the information is correct, the user is allowed to access the system; if the information is incorrect, access is denied and the login attempt is recorded; S703: The system allocates corresponding system resource access permissions to the user according to the user's role and permission configuration; S704: When the user attempts to access a resource, the system checks the user's permissions. If the user has permission to access, access is allowed; otherwise, access is denied; S705: The system conducts real-time inspection and control of the user's access request according to the configured security policy; if the user request conforms to the security policy, the operation is allowed; if not, the operation is denied and the event is recorded; S706: The system continuously monitors user behavior, system status, and security events. When suspicious activities or potential threats are detected, the system triggers a response mechanism.

8. The operation control platform of the high-security information system according to claim 7, characterized in that: The storage management module includes a secure storage unit, a data backup unit, and a storage management unit; the secure storage unit is used to encrypt and store data using encryption technology to prevent the data from being accessed by unauthorized users, and implements access control policies to ensure that only authorized users or processes can access the stored data; The data backup unit is used to automatically back up system data regularly to ensure rapid recovery in case of data loss or damage; the storage management unit is used to monitor the status and usage of storage devices, promptly detect and handle storage failures or insufficient capacity problems, provide dynamic allocation and adjustment functions of storage resources, optimize the utilization of storage resources according to system requirements, and at the same time support the life cycle management of stored data, including the processes of data creation, use, archiving, and deletion.

9. The operation control platform of the high-security information system according to claim 8, wherein: The log recording and auditing module includes a log recording unit, a log storage unit, a security auditing unit, and an alarm response unit; the log recording unit is used to capture and record all system operations, including but not limited to system startup, shutdown, configuration changes, resource access, record user behaviors, including login attempts, successful logins, logouts, permission usage, file access, record security events, including unauthorized access attempts, malware detection, security policy violations; the log storage unit is used to store log information, prevent unauthorized access and tampering, provide log query and retrieval functions, facilitate quick location and analysis of specific events, and implement log lifecycle management, including the processes of log creation, storage, archiving, and deletion; the security auditing unit is used to regularly audit system logs, check for abnormal behaviors or security vulnerabilities, analyze log information according to preset auditing rules and policies, generate audit reports, and provide visual displays of audit results for easy understanding and analysis by administrators; the alarm response unit is used to trigger an alarm mechanism when abnormal behaviors or security vulnerabilities are found during auditing, provide real-time alarm notifications, including emails, text messages, system pop-ups, ensure that administrators respond in a timely manner, and execute corresponding handling measures according to preset response policies, including isolating the infected area and notifying relevant users.

10. Method for using an operation control platform of a high-security information system, characterized in that: It includes the following steps: S1001: When the system starts up, perform initialization configuration, including loading security policies and setting the hardware switch status; S1002: Configure the intelligent monitoring and warning module, and set data collection frequency, analysis model, and warning threshold parameters; S1003: Users authenticate their identities through the security management module to ensure that only authorized users can access the system; S1004: The system assigns corresponding system resource access permissions according to the roles and permissions of users; S1005: When the system is running normally, the intelligent monitoring and warning module continuously collects and analyzes system data; S1006: Once potential threats or abnormal behaviors are detected, immediately trigger the warning mechanism and process them through preset response policies; S1007: The system regularly audits system logs to check for abnormal behaviors or security vulnerabilities; S1008: Record the log information of all system operations, user behaviors, and security events; S1009: According to the feedback of the intelligent monitoring and warning system, timely adjust system configuration and optimize security policies, and regularly maintain and upgrade the system.

Images