Information security interaction method and system

Abstract

The invention discloses an information security interaction method and system. The method comprises the steps of obtaining an original information file based on an information access request; constructing a vector space model based on the original information file; calculating a membership function of a relationship between the security features and the security types based on the original information file and the vector space model, calculating a fuzzy variable of each security feature based on the membership function, and selecting the features with fuzzy variable values meeting requirements as fuzzy variables of security type edges; key security features are selected based on the fuzzy variables of the security type edges, a support vector machine classification method is adopted to perform classification learning on the key security features, a classification model is obtained, and the security features are identified through the classification model; and analyzing the original information file based on the security feature, encrypting the analyzed original information file and transmitting the encrypted original information file to an information request end, and receiving and decrypting the encrypted original information file by the information request end to complete information interaction. The security feature recognition rate is improved, and the false alarm rate is reduced.

Description

Technical Field

[0001] The present invention belongs to the field of information security technology, and in particular relates to an information security interaction method and system. Background Art

[0002] With the rapid development of information technology and the Internet, the era of big data has also arrived. Big data refers to a collection of data that cannot be captured, managed and processed by conventional software tools within a certain time frame. It is a massive, high-growth and diversified information asset that requires new processing models to have stronger decision-making power, insight discovery and process optimization capabilities. Information security refers to the technical and management security protection established and adopted for data processing systems in order to protect computer hardware, software and data from being destroyed, changed and leaked due to accidental or malicious reasons.

[0003] At present, people's mining and application of massive data make data more open and transparent. The direct calling of various information interaction interfaces may cause information destruction and tampering and privacy leakage. In the relevant technologies, most data security mechanisms adopt a security protection method that only encrypts the data on the data provider side. In the process of network electronic information interaction, the generation of information security vulnerabilities has caused damage to data integrity, availability and confidentiality. Based on the analysis of the protocol syntax, format and session flow of the information interaction process, corresponding abnormal data packets are generated for possible information security vulnerabilities as test cases for fuzz testing. When abnormal information of the information interaction process is monitored, the error that causes the information abnormality can be analyzed and exploited. This method has high detection efficiency, but has the problem of high false negative rate.

[0004] Therefore, it is necessary to provide a new information security interaction method and system to solve the above technical problems. Summary of the Invention

[0005] In order to solve the technical problem that the existing method of generating corresponding abnormal data packets for possible information security vulnerabilities as test cases for fuzzy testing based on the analysis of the protocol syntax, format and session flow of the information interaction process has a high detection missed rate, the present invention proposes an information security interaction method and system to solve the problems existing in the above-mentioned prior art.

[0006] To achieve the above objectives, the present invention provides an information security interaction method, comprising:

[0007] After receiving the information access request from the information requesting end, the information server obtains the original information file based on the information access request; constructs a vector space model based on the original information file; the original information file includes data content, metadata, security attributes and request related information;

[0008] Calculating a membership function of the relationship between security features and security types based on the original information file and the vector space model, calculating a fuzzy variable for each security feature based on the membership function, and selecting features whose fuzzy variable values meet the requirements as fuzzy variables at the edge of the security type;

[0009] Based on the fuzzy variables of the security type edge, key security features are selected and classified using the support vector machine classification method to learn the key security features and obtain a classification model. The classification model is then used to identify security features.

[0010] The original information file is analyzed based on security features, the analyzed original information file is encrypted and transmitted to the information request end, and the information request end receives and decrypts it to complete the information interaction.

[0011] Optionally, the original information file is preprocessed, and a vector space model is constructed based on the preprocessed data; the preprocessing includes word segmentation, removal of stop words, and word vectorization processing.

[0012] Optionally, the vector space model is:

[0013]

[0014] Among them, d i is the information text to be processed, C i is the security type to which the information text belongs, m is the number of security types, W ik is the kth feature weight of the information text type, w jk and w ik are security feature text vectors respectively.

[0015] Optionally, the membership function is:

[0016]

[0017] Among them, μ ci (t) is the total security feature, t is the security feature that appears during the information interaction process, tf it is the number of times the security feature appears in the security type, tf t is the number of times the security feature t appears in all security features during the information interaction process, d it is the number of texts containing features in the security type, D i is the number of all security texts in the security type, and N is the actual number of all security texts.

[0018] Optionally, the support vector machine classification method combines a convolutional neural network model with a support vector machine model to obtain a classification model including an input layer, a convolution layer, a pooling layer, an attention layer, a fully connected layer and an output layer.

[0019] Optionally, the process of encrypting the analyzed original information file includes:

[0020] Information files are uploaded via the encrypted SFTP protocol, and batch file locations are generated when multiple files are interacted. The SFTP protocol is converted to the S3 protocol via a protocol conversion gateway and transmitted to the information requesting end.

[0021] Optionally, a discrete function of a feature classification set is established according to the security type of the security feature, a discrete degree value is calculated according to the discrete function of the security feature classification set, a normal behavior set of the information interaction process is identified according to the discrete degree value, the normal behavior set is modeled based on a hidden Markov model, and the vector space model is dynamically updated.

[0022] The present invention also provides an information security interaction system, comprising:

[0023] an interactive security detection module configured to collect interactive information files between the information server and the information request terminal and establish a vector space model;

[0024] A fuzzy classification module, connected to the interactive security detection module, is used to calculate the relationship between security features and security types based on a membership function and generate fuzzy variables;

[0025] a machine learning module, connected to the fuzzy classification module, which uses a model combining a support vector machine and a convolutional neural network to classify and learn security features, wherein the model includes an attention layer to adjust feature weights;

[0026] The encryption transmission module includes a network management module and an encryption module; the encryption module is used to encrypt the classified information files to be interacted; the gateway module is used to convert the file encryption protocol and transmit the information files;

[0027] Information server, used for storing information file data;

[0028] The information request machine is connected to the information server and the interactive security detection module, and is used for sending an information interactive request to the information server.

[0029] The present invention also provides a computer device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the above method.

[0030] The present invention also provides a computer-readable storage medium having a computer program stored thereon, which implements the steps of the above method when executed by a processor.

[0031] Compared with the prior art, the present invention has the following advantages and technical effects:

[0032] The present invention configures an interactive security detection module between the information server and the information request end, presents the information files in the information interaction process in the form of vectors, targets the edge fuzziness of security type classification, and uses approximation to measure the membership function of the relationship between security features and security types, thereby improving the security feature recognition rate and reducing the false alarm rate.

[0033] The present invention adds fuzzy variables of security type edges to the selection process of security features in the information interaction process, and adopts support vector machine classification method to classify and learn the security features according to the selection results, thereby improving the model's ability to select feature words and also reducing the number of model parameters. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] The accompanying drawings, which constitute part of this application, are intended to provide a further understanding of this application. The exemplary embodiments and descriptions of this application are intended to explain this application and do not constitute an improper limitation on this application. In the accompanying drawings:

[0035] Figure 1 A flowchart of an information security interaction method according to an embodiment of the present invention;

[0036] Figure 2 A structural block diagram of a support vector machine classification according to an embodiment of the present invention;

[0037] Figure 3 This is a structural block diagram of the information security interaction system according to an embodiment of the present invention. DETAILED DESCRIPTION

[0038] It should be noted that, in the absence of conflict, the embodiments and features of the embodiments in this application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0039] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0040] Example 1

[0041] like Figure 1-2 As shown, this embodiment provides an information security interaction method, including:

[0042] After receiving the information access request from the information requester, the information server obtains the original information file based on the information access request; constructs a vector space model based on the original information file; the original information file includes data content, metadata, security attributes and request related information;

[0043] As a specific implementation method, the original information file is preprocessed, and a vector space model is constructed based on the preprocessed data; the preprocessing includes word segmentation, stop word removal and word vectorization processing.

[0044] As a specific implementation, the vector space model is:

[0045]

[0046] Among them, d i is the information text to be processed, C i is the security type to which the information text belongs, m is the number of security types, W ik is the kth feature weight of the information text type, w jk and w ik are security feature text vectors respectively.

[0047] Calculate the membership function of the relationship between security features and security types based on the original information file and the vector space model, calculate the fuzzy variables of each security feature based on the membership function, and select the features whose fuzzy variable values meet the requirements as the fuzzy variables at the edge of the security type;

[0048] As a specific implementation method, the membership function is:

[0049]

[0050] Among them, μ ci (t) is the total security feature, t is the security feature that appears during the information interaction process, tf it is the number of times the security feature appears in the security type, tf t is the number of times the security feature t appears in all security features during the information interaction process, d it is the number of texts containing features in the security type, D i is the number of all security texts in the security type, and N is the actual number of all security texts.

[0051] Specifically, aiming at the edge fuzziness of security type classification, the approximation is used to measure the membership function of the relationship between security features and security types.

[0052] Based on the fuzzy variables of the security type edge, key security features are selected and classified using the support vector machine classification method to learn the key security features and obtain a classification model. The classification model is then used to identify security features.

[0053] As a specific implementation method, the support vector machine classification method combines the convolutional neural network model with the support vector machine model to obtain a classification model including an input layer, a convolution layer, a pooling layer, an attention layer, a fully connected layer and an output layer. Figure 2 shown.

[0054] Specifically, the input layer uses different types of information files as training sets for input and model training;

[0055] Convolutional layer: It selects feature words through local perception and weight sharing.

[0056] Pooling layer: reduces the dimension of the convolutional data to further extract features;

[0057] Attention layer: assigns more weight to feature words or sentences that have an impact on text category differentiation. At the same time, the weight of feature words or sentences with less category differentiation significance can be reduced, reducing the number of feature words with weak category differentiation ability and simplifying the model parameters.

[0058] Fully connected layer: The connection is done in a fully connected manner, that is, each neuron is connected to all neurons in the previous layer;

[0059] Output layer: Use the classifier to output the classification results.

[0060] Specifically, the fuzzy variables of the security type edge are added to the selection process of security features in the information interaction process, and we get Where M(t) is the fuzzy variable of the security feature in the information interaction process. According to the selection results, the support vector machine classification method is used to classify and learn the security features, realize the security detection of the information interaction process, and improve the recognition rate of security features.

[0061] The original information file is analyzed based on security features, the analyzed original information file is encrypted and transmitted to the information request end, and the information request end receives and decrypts it to complete the information interaction.

[0062] As a specific implementation method, the process of encrypting the analyzed original information file includes:

[0063] Information files are uploaded via the encrypted SFTP protocol, and batch file locations are generated when multiple files are interacted. The SFTP protocol is converted to the S3 protocol via a protocol conversion gateway and transmitted to the information requesting end.

[0064] Specifically, the method for encrypting the information file includes:

[0065] 1) Upload the information file using encrypted SFTP. Multiple file interactions form batch file locations 1, 2, ... n;

[0066] 2) The file is uploaded to the gateway module via the SFTP encryption protocol, and the gateway module performs protocol conversion;

[0067] 3) The data of the information file to be interacted is sent to the information requesting end through the gateway module.

[0068] As a specific implementation method, a discrete function of a feature classification set is established according to the security type of the security feature, a discrete degree value is calculated according to the discrete function of the security feature classification set, a normal behavior set of the information interaction process is identified according to the discrete degree value, the normal behavior set is modeled based on the hidden Markov model, and the vector space model is dynamically updated.

[0069] Specifically, a discrete function of the feature classification set is established according to the security type of the security feature. The discrete degree value is used as the basis for identifying the normal behavior set of the information interaction process. On this basis, the normal information interaction process behavior set is modeled using the hidden Markov model, thereby realizing the update of the vector space model of the information interaction process.

[0070] Assume that X is a security feature and Q is a security feature classification set, where Q = {X1,…,X n}, expand the security type of the security feature in the information interaction to obtain the p-dimensional data matrix GF, and for the j-th security type, the ordered sequence S can be obtained j ={X 1j ,…,X nj}, calculate the discrete degree value:

[0071]

[0072] Where σ(Q) is the discrete value of feature j in the feature classification set.

[0073] like Figure 3 As shown, this embodiment also provides an information security interaction system, including:

[0074] an interactive security detection module configured to collect interactive information files between the information server and the information request terminal and establish a vector space model;

[0075] The fuzzy classification module is connected to the interactive security detection module and is used to calculate the relationship between security features and security types based on the membership function and generate fuzzy variables;

[0076] The machine learning module is connected to the fuzzy classification module and uses a model that combines support vector machines and convolutional neural networks to classify and learn security features. The model includes an attention layer to adjust feature weights.

[0077] The encryption transmission module includes a network management module and an encryption module; the encryption module is used to encrypt the classified information files to be interacted; the gateway module is used to convert the file encryption protocol and transmit the information files;

[0078] Information server, used for storing information file data;

[0079] The information request machine is connected to the information server and the interactive security detection module, and is used for sending an information interactive request to the information server.

[0080] This embodiment further provides a computer device, comprising: a memory, a processor, a computer program stored in the memory and executable on the processor, and the processor executes the computer program to implement the steps of the above method.

[0081] This embodiment further provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of the above method are implemented.

[0082] The above are merely preferred embodiments of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.

Claims

1. An information security interaction method, characterized in that: The following steps are involved: After receiving the information access request from the information requesting end, the information server obtains the original information file based on the information access request; Constructing a vector space model based on the original information file; the original information file includes data content, metadata, security attributes and request related information; Calculating a membership function of the relationship between security features and security types based on the original information file and the vector space model, calculating a fuzzy variable for each security feature based on the membership function, and selecting features whose fuzzy variable values meet the requirements as fuzzy variables at the edge of the security type; Based on the fuzzy variables of the security type edge, key security features are selected and classified using the support vector machine classification method to learn the key security features and obtain a classification model. The classification model is then used to identify security features. The original information file is analyzed based on security features, the analyzed original information file is encrypted and transmitted to the information request end, and the information request end receives and decrypts it to complete the information interaction.

2. The information security interaction method according to claim 1, characterized in that: The original information file is preprocessed, and a vector space model is constructed based on the preprocessed data; the preprocessing includes word segmentation, stop word removal and word vectorization processing.

3. The information security interaction method according to claim 2, characterized in that: The vector space model is: Among them, d i is the information text to be processed, C i is the security type to which the information text belongs, m is the number of security types, W ik is the kth feature weight of the information text type, w jk and w ik are security feature text vectors respectively.

4. The information security interaction method according to claim 1, characterized in that: The membership function is: Among them, μ ci (t) is the total security feature, t is the security feature that appears during the information interaction process, tf it is the number of times the security feature appears in the security type, tf t is the number of times the security feature t appears in all security features during the information interaction process, d it is the number of texts containing features in the security type, D i is the number of all security texts in the security type, and N is the actual number of all security texts.

5. The information security interaction method according to claim 1, characterized in that: The support vector machine classification method combines a convolutional neural network model with a support vector machine model to obtain a classification model including an input layer, a convolution layer, a pooling layer, an attention layer, a fully connected layer and an output layer.

6. The information security interaction method according to claim 1, characterized in that: The process of encrypting the analyzed original information file includes: Information files are uploaded via the encrypted SFTP protocol, and batch file locations are generated when multiple files are interacted. The SFTP protocol is converted to the S3 protocol via a protocol conversion gateway and transmitted to the information requesting end.

7. The information security interaction method according to claim 1, characterized in that: Also includes: A discrete function of a feature classification set is established according to the security type of the security feature, a discrete degree value is calculated according to the discrete function of the security feature classification set, a normal behavior set of the information interaction process is identified according to the discrete degree value, the normal behavior set is modeled based on a hidden Markov model, and the vector space model is dynamically updated.

8. An information security interaction system, characterized in that: include: an interactive security detection module configured to collect interactive information files between the information server and the information request terminal and establish a vector space model; A fuzzy classification module, connected to the interactive security detection module, is used to calculate the relationship between security features and security types based on a membership function and generate fuzzy variables; a machine learning module, connected to the fuzzy classification module, which uses a model combining a support vector machine and a convolutional neural network to classify and learn security features, wherein the model includes an attention layer to adjust feature weights; The encrypted transmission module includes a network management module and an encryption module; An encryption module is used to encrypt the classified information files to be interacted with; Gateway module, used to convert file encryption protocols and transmit information files; Information server, used for storing information file data; The information request machine is connected to the information server and the interactive security detection module, and is used for sending an information interactive request to the information server.

9. A computer device comprising: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images