Internet information risk assessment method and system
By monitoring the Internet information data flow in real time, extracting up and down time vectors and noise vectors, and establishing an adversarial training model, the low accuracy problem caused by single-dimensional prediction in the existing technology is solved, and higher accuracy and robustness of information security risk prediction are achieved.
Patent Information
- Application Number
- CN202510641719.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-05-19
- Publication Date
- 2025-08-22
AI Technical Summary
Existing information security risk prediction technologies only consider information characteristics from a single dimension, and cannot comprehensively and accurately reflect information security risks, resulting in low prediction accuracy in complex network environments and difficult to meet the needs of information security guarantee.
By monitoring the Internet information data flow in real time, defining the time series set and predicting the target random variables, extracting the upper and lower time vectors and noise vectors, establishing a prediction target model and conducting adversarial training, calculating the approximate generation distribution and prediction variance, and outputting the prediction results of the outlier points and intervals.
It improves the accuracy of information security risk prediction, increases the credibility and robustness of detection results, and can effectively respond to information security threats in complex network environments.
Smart Images
Figure CN120528643A_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the technical field of Internet information security, and in particular relates to an Internet information risk assessment method and system. Background Art
[0002] With the accelerating advancement of informatization and economic globalization, the internet has permeated every aspect of our lives and work, profoundly changing our lifestyles and work patterns. In the field of information security, various information security risk prediction technologies have been developed to address increasingly severe security challenges. Currently, common information security risk prediction methods primarily extract information features from a specific dimension. These features are then fed into a pre-trained prediction model as input data. Through model calculations, risk prediction labels and no-risk prediction labels are generated, and corresponding risk prediction information and no-risk prediction information are then derived based on these labels. This prediction method can, to a certain extent, provide a reference for information security risk assessment.
[0003] However, this existing information security risk prediction technology has significant limitations. It only considers information characteristics along a single dimension, while information security risks are often the result of the interplay of multiple factors, including inherent flaws in information systems, the leakage of sensitive information, the prevalence of computer viruses, and hacker intrusions. This single-dimensional prediction method fails to fully and accurately reflect the true nature of information security risks, resulting in low security risk prediction accuracy. With the emergence of new and complex network environments, such as big data and cloud computing, information security issues are further exacerbated. This low-accuracy prediction method is unable to meet the growing demand for information security assurance and cannot effectively address complex and ever-changing information security threats. Summary of the Invention
[0004] In order to solve the above technical problems, the present invention proposes an Internet information risk assessment method and system to solve the problems existing in the above-mentioned prior art.
[0005] To achieve the above objectives, in a first aspect, the present invention provides an Internet information risk assessment method, comprising:
[0006] Monitor the information data flow of the Internet in real time, define a time series set of the information data flow and a prediction target random variable; wherein the prediction target random variable is the time series data monitored on the time series set, and the information data flow comes from a physical entity;
[0007] Extracting upper and lower time vectors based on the time series set and the predicted target random variable; obtaining a noise vector of the time series set, and integrating the upper and lower time vectors with the noise vector as input data;
[0008] Establish a prediction target model;
[0009] Based on the input data, adversarial training is performed on the prediction target model to obtain an approximate generative distribution of the time series data;
[0010] The prediction variance is calculated for the approximate generated distribution, anomaly scores are completed at all times, and prediction results of all abnormal points and abnormal intervals are output based on the anomaly scores.
[0011] Preferably, the step of integrating the upper and lower time vectors and the noise vector as input data includes:
[0012] Use LSTM to extract the vector value of the current moment and the vector value of the next moment as the upper and lower moment vectors;
[0013] The data noise adopts Gaussian distribution, and the noise vector is obtained by random sampling from the noise distribution. The upper and lower time vectors and the noise vector are integrated as the input data.
[0014] Preferably, the step of performing adversarial training on the prediction target model includes:
[0015] Perform N training, randomly sample m noise vectors from the noise distribution, randomly sample m data vectors from the prediction target data distribution, use the m noise vectors to generate prediction data, and update the prediction target model;
[0016] Execute the training of T, re-adopt m noise vectors from the noise distribution, and update the prediction target model;
[0017] The iterative training ends.
[0018] Preferably, the step of calculating the prediction variance for the approximate generated distribution comprises:
[0019] Initialize the length of the time series to be detected according to the approximate generating distribution;
[0020] Initialize the anomaly score according to the initialization length, and the initial anomaly score at all times is zero;
[0021] According to the initialized anomaly score, obtain the corresponding item's predicted data and generate the upper and lower time vectors;
[0022] Based on the obtained prediction data and its generation upper and lower time vectors, an empty generation result set is established;
[0023] Repeatedly executing the prediction target model according to the generated result set to obtain the generation distribution of the time series data;
[0024] Calculate the prediction variance based on the generated distribution of the obtained time series data.
[0025] Preferably, the step of outputting the prediction results of all abnormal points and abnormal intervals includes:
[0026] Calculate the anomaly score of the nth item and complete the anomaly score for all moments;
[0027] Based on the anomaly score, all anomaly point and anomaly interval prediction results are output.
[0028] Preferably, after outputting all the abnormal point and abnormal interval prediction results, the following steps are also included:
[0029] Determine whether the abnormal score is greater than the normal risk value;
[0030] If it is greater, the abnormal score is matched with the corresponding risk level range to obtain the risk level of the information system, and an early warning message is sent to indicate that there is a risk, and the early warning message includes the risk level.
[0031] Preferably, after sending the early warning information indicating that there is a risk, the method further includes:
[0032] Retrieve data based on real-time monitoring information data streams to obtain a set of protection solutions;
[0033] Performing data identification on the protection solution set, and building a solution decision model based on the data identification results;
[0034] The anomaly location results and risk warning information are input into the solution decision model to output the operation and maintenance protection plan.
[0035] Preferably, the protection scheme set includes protection schemes and information anomaly types, which are associated with each other.
[0036] In a second aspect, the present invention further provides an Internet information risk assessment system for implementing the method described in the first aspect, comprising:
[0037] Information monitoring module, used to monitor information data flow in real time;
[0038] A prediction and evaluation module is used to analyze the anomalies of the data in the information data flow and perform anomaly scoring to obtain the information risk level;
[0039] A feedback recording module is used to provide feedback and record the risk level of the information;
[0040] The early warning module is used to send an early warning according to the risk level of the information, prompting that the information has risks.
[0041] Preferably, the prediction and evaluation module includes:
[0042] Vector extraction unit, used to extract the upper and lower time vectors using LSTM;
[0043] The model training unit is used to perform adversarial training on the prediction target model to obtain the approximate generative distribution of time series data;
[0044] The anomaly scoring unit is used to calculate the prediction variance for the approximate generated distribution, complete the anomaly scoring at all times, and output the prediction results of all anomaly points and anomaly intervals.
[0045] Compared with the prior art, the present invention has the following advantages and technical effects:
[0046] The present invention provides an Internet information risk assessment method. First, the information data flow of the Internet is monitored in real time, and a time series set and a prediction target random variable of the information data flow are defined, wherein the information data flow comes from a physical entity; second, based on the time series set and the prediction target random variable, upper and lower time vectors are extracted; a noise vector of the time series set is obtained, and the upper and lower time vectors and the noise vector are integrated as input data; then, a prediction target model is established; further, based on the input data, adversarial training is performed on the prediction target model to obtain an approximate generative distribution of time series data; finally, the prediction variance is calculated for the approximate generative distribution, anomaly scores are completed for all moments, and prediction results of all abnormal points and abnormal intervals are output based on the anomaly scores.
[0047] The present invention monitors the information data flow in real time and analyzes the abnormal situation of the information data, defines the information data monitoring time series set and the prediction target random variable, and the prediction target random variable is the time series data monitored on the time series set. Considering the impact of multiple dimensions on information security, it can effectively predict information security risks, making the information security risk prediction more accurate.
[0048] The present invention extracts the upper and lower time vectors, adopts Gaussian distribution for data noise, randomly samples from the noise distribution to obtain noise vectors, integrates the noise vectors through the upper and lower time vectors to form a new input, and evaluates the risk abnormality degree of information data from two aspects: the upper and lower time vectors and the data noise, thereby increasing the credibility and robustness of the information risk detection results. BRIEF DESCRIPTION OF THE DRAWINGS
[0049] The accompanying drawings, which constitute part of this application, are intended to provide a further understanding of this application. The exemplary embodiments and descriptions of this application are intended to explain this application and do not constitute an improper limitation on this application. In the accompanying drawings:
[0050] Figure 1 This is a flow chart of an Internet information risk assessment method according to an embodiment of the present invention;
[0051] Figure 2 This is a flowchart of a prediction target model according to an embodiment of the present invention;
[0052] Figure 3 This is a structural block diagram of an Internet information risk assessment system according to an embodiment of the present invention. DETAILED DESCRIPTION
[0053] It should be noted that, in the absence of conflict, the embodiments and features of the embodiments in this application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.
[0054] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.
[0055] First, the technical terms involved in the following embodiments are explained.
[0056] Example 1
[0057] like Figure 1-2 As shown, this embodiment provides an Internet information risk assessment method, including:
[0058] S1, real-time monitoring of information data flow, defining the information data monitoring time series set T = {t1, t2, ..., t n}, with a length of N, defines the predicted target random variable X, where X is the time series data monitored on the time series set T, expressed as X n ={x1,x2,…,x n ), 1≤n≤N, for any moment t, its true value is related to the previous moment;
[0059] S2. Use LSTM to extract the upper and lower time vectors, where the upper and lower time vectors are represented by the vector value of monitoring the current moment and the vector value of predicting the next moment. The data noise adopts Gaussian distribution, and the noise vector is obtained by random sampling from the noise distribution. The noise vector is integrated with the upper and lower time vectors to form a new input data, that is, X t+1 =T(z|c), where z is the noise vector and c is the upper and lower time vectors. The prediction target model ω=X[log N(x|c)]+Z[log(1-N(T(z|c)))] is established, where Z is the noise vector set monitored on the time series set T;
[0060] S3. Establish a prediction target model;
[0061] S4. Based on the input data, the prediction target model is trained adversarially for k times. In each iterative training cycle, N is trained first, and then T is trained to obtain the approximate generative distribution of the time series data. The prediction variance is calculated for the approximate generative distribution, and the anomaly score at all times is completed. The anomaly score is divided into three risk levels, namely, level one safety, level two safety, and non-safety, and the prediction results of all anomaly points and anomaly intervals are output.
[0062] The specific steps for adversarial training of the prediction target model include:
[0063] Perform N training, randomly sample m noise vectors {z1,z2,…,z m};
[0064] Randomly sample m data vectors {(c1,x1),…,(c m ,x m )};
[0065] Generate prediction data using m noise vectors {T(z1|c1),…,T(z m |c m )};
[0066] Update the prediction target model
[0067] Perform the training of T and re-adopt m noise vectors {z1,z2,…,z m};
[0068] Update the prediction target model
[0069] The iterative training ends.
[0070] When predicting the distribution, the prediction results of the given conditions are sampled through M experiments, and the overall mean and variance are estimated by calculating the sample mean and variance, where the mean at time t is:
[0071]
[0072] Based on the mean, the variance of time t is estimated as follows:
[0073]
[0074] The prediction result at time t is c t is a known conditional probability distribution, which can be considered to be approximately Gaussian distribution;
[0075] The anomaly score is defined as Where A is the anomaly score of all time series, σ is the prediction variance, ν is the value boundary of the time series obtained in the training data, and E(x t -X t ) is the degree of deviation between the predicted value and the true value.
[0076] The steps of anomaly scoring include:
[0077] Initialize the length n of the time series to be detected;
[0078] Initialize the anomaly score A, and the initial anomaly score at all times is 0;
[0079] Get the prediction data of the nth item and its generation time vector (c, x);
[0080] Create an empty build result set
[0081] Repeat the prediction target model m times to obtain the generation distribution x of the time series data g ←x g ∪T(z,x);
[0082] For the generated result set, calculate the prediction variance σ;
[0083] Calculate the anomaly score of the nth item and complete the anomaly score for all moments;
[0084] Output all abnormal point and abnormal interval prediction results.
[0085] A t As a time series X n Abnormal label, considering the abnormal threshold τ, if A t ≥τ, then A t =1 means that time t is an abnormal value. In the present invention, an automatic abnormal threshold is designed: u is the average value of A, σ is the standard deviation of A, and the threshold is τ n =u+2*σ.
[0086] After obtaining the abnormality score, it also includes: judging whether the abnormality score is greater than the normal risk value; if it is greater, matching the abnormality score with the corresponding risk level range to obtain the risk level of the information system, and sending an early warning prompt information that there is a risk, and the early warning prompt information includes the risk level.
[0087] This embodiment also includes generating an operation and maintenance protection plan based on anomaly scores and warning risk information, specifically including: retrieving data based on real-time monitoring information data streams, obtaining a protection plan set, performing data identification on the protection plan set, and building a plan decision model based on the data identification results; inputting the anomaly location results and risk warning information into the plan decision model, and outputting an operation and maintenance protection plan.
[0088] The protection plan set includes protection plans and information anomaly types, which are associated with each other.
[0089] Example:
[0090] This example conducts experimental evaluation on a cloud server dataset. The cloud server dataset consists of real-world and artificially synthesized time series, with markers for risk anomalies and abnormal regions. In this example, two categories of real data are selected:
[0091] Cloud monitoring: cloud server CPU usage, network traffic, and hard disk read and write indicators;
[0092] Multi-source: Time series data with multiple known abnormal causes, including cloud hosts and information traffic data.
[0093] Each sequence of data files has a corresponding abnormal record in the abnormal label file. This field records the start and end timestamps of all abnormal intervals in the data sequence.
[0094] For each data set, in order to understand the difficulty of anomaly identification and the impact of the statistical characteristics of the data set on the anomaly identification results, the standard deviation and anomaly interval were calculated respectively. The basic information of different types of data in the collected data set is shown in Table 1 below.
[0095] Table 1
[0096]
[0097] To demonstrate the feasibility of this embodiment, anomaly detection was performed on a time series with three abnormal intervals and compared with existing LOF functions, one-class learning OCSVM, and multi-layer perceptron MLP. Monitoring data from a server in a data center continuously recorded CPU usage until a complete system failure. Experiments showed that the proportion of normal categories in the data was much higher than that of abnormal categories. However, due to the importance of anomalies, the identification of abnormal data has higher value than that of normal data. Therefore, this embodiment has improved both overall performance and stability, making information security risk prediction more accurate and increasing the credibility and robustness of anomaly detection results.
[0098] Example 2
[0099] Based on the same inventive concept, such as Figure 3 As shown, this embodiment further provides an Internet information risk assessment system for implementing the method described in the first embodiment, including:
[0100] Information monitoring module, used to monitor information data flow in real time;
[0101] A prediction and evaluation module is used to analyze the anomalies of the data in the information data flow and perform anomaly scoring to obtain the information risk level;
[0102] A feedback recording module is used to provide feedback and record the risk level of the information;
[0103] The early warning module is used to send an early warning according to the risk level of the information, prompting that the information has risks.
[0104] Furthermore, the prediction and evaluation module includes:
[0105] Vector extraction unit, used to extract the upper and lower time vectors using LSTM;
[0106] The model training unit is used to perform adversarial training on the prediction target model to obtain the approximate generative distribution of time series data;
[0107] The anomaly scoring unit is used to calculate the prediction variance for the approximate generated distribution, complete the anomaly scoring at all times, and output the prediction results of all anomaly points and anomaly intervals.
[0108] The Internet information risk assessment system provided by this embodiment has all the advantages of the Internet information risk assessment method provided by the first embodiment.
[0109] The above are merely preferred embodiments of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.
Claims
1. A method for assessing Internet information risk, characterized in that: The following steps are involved: Monitor the information data flow of the Internet in real time, define a time series set of the information data flow and a prediction target random variable; wherein the prediction target random variable is the time series data monitored on the time series set, and the information data flow comes from a physical entity; Extracting upper and lower time vectors based on the time series set and the predicted target random variable; obtaining a noise vector of the time series set, and integrating the upper and lower time vectors with the noise vector as input data; Establish a prediction target model; Based on the input data, adversarial training is performed on the prediction target model to obtain an approximate generative distribution of the time series data; The prediction variance is calculated for the approximate generated distribution, anomaly scores are completed at all times, and prediction results of all abnormal points and abnormal intervals are output based on the anomaly scores.
2. The method according to claim 1, characterized in that The step of integrating the upper and lower time vectors and the noise vector as input data comprises: Use LSTM to extract the vector value of the current moment and the vector value of the next moment as the upper and lower moment vectors; The data noise adopts Gaussian distribution, and the noise vector is obtained by random sampling from the noise distribution. The upper and lower time vectors and the noise vector are integrated as the input data.
3. The method according to claim 1, characterized in that The steps for adversarial training of the prediction target model include: Perform N training, randomly sample m noise vectors from the noise distribution, randomly sample m data vectors from the prediction target data distribution, use the m noise vectors to generate prediction data, and update the prediction target model; Execute the training of T, re-adopt m noise vectors from the noise distribution, and update the prediction target model; The iterative training ends.
4. The method according to claim 1, wherein The step of calculating the prediction variance for the approximate generated distribution includes: Initialize the length of the time series to be detected according to the approximate generating distribution; Initialize the anomaly score according to the initialization length, and the initial anomaly score at all times is zero; According to the initialized anomaly score, obtain the corresponding item's predicted data and generate the upper and lower time vectors; Based on the obtained prediction data and its generation upper and lower time vectors, an empty generation result set is established; Repeatedly executing the prediction target model according to the generated result set to obtain the generation distribution of the time series data; Calculate the prediction variance based on the generated distribution of the obtained time series data.
5. The method according to claim 1, wherein The steps for outputting the prediction results of all abnormal points and abnormal intervals include: Calculate the anomaly score of the nth item and complete the anomaly score for all moments; Based on the anomaly score, all anomaly point and anomaly interval prediction results are output.
6. The method according to claim 1, characterized in that After outputting all the abnormal point and abnormal interval prediction results, it also includes: Determine whether the abnormal score is greater than the normal risk value; If it is greater, the abnormal score is matched with the corresponding risk level range to obtain the risk level of the information system, and an early warning message is sent to indicate that there is a risk, and the early warning message includes the risk level.
7. The method according to claim 1, characterized in that After sending the warning message that there is a risk, the following also applies: Retrieve data based on real-time monitoring information data streams to obtain a set of protection solutions; Performing data identification on the protection solution set, and building a solution decision model based on the data identification results; The anomaly location results and risk warning information are input into the solution decision model to output the operation and maintenance protection plan.
8. The method according to claim 7, characterized in that The protection scheme set includes protection schemes and information anomaly types, which are associated with each other.
9. An Internet information risk assessment system, characterized in that: The method for implementing any one of claims 1 to 8 comprises: Information monitoring module, used to monitor information data flow in real time; A prediction and evaluation module is used to analyze the anomalies of the data in the information data flow and perform anomaly scoring to obtain the information risk level; A feedback recording module is used to provide feedback and record the risk level of the information; The early warning module is used to send an early warning according to the risk level of the information, prompting that the information has risks.
10. The system according to claim 9, characterized in that The prediction and evaluation module includes: Vector extraction unit, used to extract the upper and lower time vectors using LSTM; The model training unit is used to perform adversarial training on the prediction target model to obtain the approximate generative distribution of time series data; The anomaly scoring unit is used to calculate the prediction variance for the approximate generated distribution, complete the anomaly scoring at all times, and output the prediction results of all anomaly points and anomaly intervals.