Method for self-monitoring and detecting secret computer based on gigabit network

Abstract

The application relates to the field of computer security technology, and discloses a secret-related computer security self-monitoring detection method based on a gigabit network. The method first acquires communication data and equipment characteristic data through a network flow analysis module to determine monitoring node division; then constructs a detection index set according to the communication data, and determines an abnormal data acquisition strategy in combination with the monitoring node division; then uses an abnormal data acquisition terminal to acquire real-time communication data according to the strategy, identifies a security risk level and a rule violation item, and obtains detection result data; finally, the detection result data is transmitted to a monitoring control platform according to a self-monitoring feedback mechanism to update indexes. The method realizes accurate detection and self-monitoring of secret-related computer security risks in a gigabit network environment, improves security, and is suitable for the field of secret-related computer security detection.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of computer security technology, in particular to a secret computer security self-monitoring detection method based on a gigabit network. BACKGROUND

[0002] In the current high-speed development of informatization, gigabit networks have become the mainstream of data transmission, but this has also brought increasingly severe security challenges to secret computers. With the continuous upgrading and complexification of network attack methods, traditional secret computer security detection methods have gradually shown many shortcomings. From the monitoring method, the traditional method mostly relies on manual periodic inspection or simple rule matching, and this passive monitoring mode is difficult to capture abnormal behavior in the network in real time. In the gigabit network environment, the data transmission rate is extremely fast, up to gigabit per second, and a large amount of data flows instantaneously. Due to the limitations of processing speed and real-time performance, the traditional method is easy to miss key abnormal data and cannot timely discover potential security risks.

[0003] In terms of detection accuracy, the traditional detection method has poor adaptability to complex network environments. In modern networks, communication protocols are diverse, and data flow is complex and variable. The traditional method can only detect a limited number of protocol types and simple data flow directions. It lacks deep packet analysis capabilities and is difficult to accurately extract key communication data such as communication protocol type, data flow direction, and transmission rate, resulting in inaccurate identification of security risks.

[0004] The traditional method lacks comprehensive analysis of the features of secret computer equipment. The hardware configuration, operating system version, and security software deployment status of secret computers are critical to determining the division of monitoring nodes, but the traditional method rarely extracts and analyzes these features in depth, which cannot scientifically and reasonably divide the monitoring nodes, and thus affects the effectiveness of the entire security detection.

[0005] The traditional abnormal data collection strategy lacks flexibility and pertinence. It cannot dynamically adjust according to the risk situation of different monitoring nodes and time window segments, and the selection of collection points and the planning of collection paths are not optimized. In the face of complex situations such as electromagnetic interference and network congestion, it is difficult to ensure the integrity and accuracy of data collection.

[0006] The traditional security risk identification model training method is relatively single, usually based on limited labeled data and simple algorithms, which is difficult to adapt to the diversified communication scenarios and complex security risk level identification requirements in the gigabit network environment, and the statistics of violations are not comprehensive and accurate.

[0007] The traditional detection result feedback mechanism is not perfect, and the detection result cannot be effectively fed back to the supervision control platform for index updating, so that the detection index cannot be adjusted and optimized in time according to the actual situation, and it is difficult to continuously adapt to the changing security situation. The traditional secret computer security detection method has obvious defects in real-time performance, detection accuracy, adaptability and flexibility in the gigabit network environment, and a new secret computer security self-monitoring detection method based on gigabit network is urgently needed to solve these problems. SUMMARY

[0008] The purpose of the present application is to provide a secret computer security self-monitoring detection method based on gigabit network to solve the problems raised in the background art.

[0009] To achieve the above purpose, the present application provides the following technical scheme: a secret computer security self-monitoring detection method based on gigabit network, the method comprising:

[0010] The network traffic analysis module obtains the gigabit network communication data and device feature data of the secret computer, and determines the monitoring node division of the secret computer according to the device feature data;

[0011] According to the communication data, a set of security self-monitoring detection indexes is constructed, and an abnormal data acquisition strategy is determined according to the detection index set and the monitoring node division;

[0012] The abnormal data acquisition terminal obtains the real-time communication data of the secret computer according to the acquisition strategy, identifies the security risk level and the violation item of the secret computer according to the real-time communication data, and obtains the detection result data;

[0013] The detection result data is transmitted to the supervision control platform for index updating according to the self-monitoring feedback mechanism.

[0014] Preferably, the network traffic analysis module obtains the gigabit network communication data and device feature data of the secret computer, and determines the monitoring node division of the secret computer according to the device feature data, specifically:

[0015] The network traffic analysis module calls a protocol decoding algorithm to perform deep packet analysis on the gigabit network communication data, and extracts communication data such as communication protocol type, data flow direction and transmission rate;

[0016] The hardware configuration, operating system version and security software deployment state of the secret computer are extracted to obtain the device feature data;

[0017] The K-means clustering algorithm is used to cluster the spatial features of the device feature data, and the initial threshold value of the cluster center is set as the device security level coefficient;

[0018] According to the clustering result, the secret computer is divided into M monitoring nodes, and each monitoring node is labeled with a network interface identifier, a data interaction frequency, and a security sensitivity level to construct a node feature vector set;

[0019] A topological connection relationship of the node feature vector set is obtained, and a three-dimensional monitoring node distribution map is constructed according to the topological connection relationship;

[0020] A communication load weight of each node is calculated according to the three-dimensional monitoring node distribution map, a monitoring node weight thermodynamic map and a load gradient field are constructed according to the communication load weight, and the monitoring node division of the secret computer is determined according to the thermodynamic map and the gradient field.

[0021] Preferably, the secret self-monitoring detection index set is constructed according to the communication data, and the abnormal data acquisition strategy is determined according to the detection index set and the monitoring node division, specifically:

[0022] Multi-dimensional feature extraction is performed on the communication data, an index feature tensor is constructed through normalization processing, a secret risk factor identification is performed on the transmission characteristics of the communication data based on a fuzzy analytic hierarchy process, and a secret self-monitoring detection index set containing data encryption strength, illegal external connection frequency, and sensitive data transmission volume is generated;

[0023] The monitoring node division and the detection index set are subjected to a dimension matching operation to construct a secret risk multi-dimensional evaluation model, the evaluation model is segmented according to a preset time step to construct T time window segments;

[0024] Risk score information of each time window segment is obtained according to the monitoring node division, and time window segments with similar score trends in the risk multi-dimensional evaluation model are subjected to clustering processing based on an OPTICS clustering algorithm to obtain clustering output;

[0025] The priority order of the risk evaluation of each time window segment is determined according to the clustering output, the corresponding space-time coordinates of each time window segment in the secret computer are obtained, the risk detection importance of each node in the secret computer is evaluated according to the priority order and the corresponding space-time coordinates, and a detection importance score of each node is obtained;

[0026] The detection requirement information of each node in the secret computer is determined according to the detection importance score of each node, and the detection requirement information includes whether to trigger acquisition and acquisition frequency requirement information;

[0027] The abnormal data collection terminal acquires the data collection completeness parameters of different nodes, determines the optimal distance parameters of the abnormal data collection terminal for collecting data of each node of the secret computer according to the data collection completeness parameters and detection requirement information, and determines the collection point set of the abnormal data collection terminal according to the optimal distance parameters.

[0028] The abnormal data collection terminal determines the abnormal data collection strategy according to the collection point set.

[0029] Preferably, the abnormal data collection terminal determines the abnormal data collection strategy according to the collection point set, specifically:

[0030] The abnormal data collection terminal acquires the space-time coordinate parameters of each collection point and the initial deployment position parameters of the abnormal data collection terminal, and determines the communication blind area in the secret computer according to the detection index set.

[0031] The abnormal data collection terminal performs path optimization on the initial deployment position parameters and the space-time coordinate parameters of each collection point based on a genetic algorithm, takes the communication blind area as a path constraint area, and outputs the shortest initial collection path of the abnormal data collection terminal.

[0032] The abnormal data collection terminal acquires the equipment state change parameters when collecting according to the shortest initial collection path in real time, and determines the electromagnetic interference intensity and network congestion degree of the real-time collection position of the abnormal data collection terminal according to the state change parameters.

[0033] The abnormal data collection terminal acquires the anti-interference performance parameters, which include the signal filtering ability parameters of the terminal to different intensity interference.

[0034] The abnormal data collection terminal acquires the response delay parameters of the electromagnetic interference intensity and the network congestion degree, and determines the collection path adjustment lag of the abnormal data collection terminal according to the response delay parameters.

[0035] The abnormal data collection terminal analyzes the electromagnetic interference intensity and the network congestion degree of the real-time collection position according to the anti-interference performance parameters and the collection path adjustment lag, and calculates the collection path offset cumulative value of the abnormal data collection terminal within the response delay time.

[0036] If the collection path offset cumulative value is less than a set threshold, the abnormal data collection terminal determines the path offset direction and offset amount of the abnormal data collection terminal along the shortest initial collection path according to the offset cumulative value, determines the adjustment direction and adjustment amount of the abnormal data collection terminal according to the offset direction and offset amount, and obtains the adjustment parameters.

[0037] The abnormal data collection terminal adjusts the shortest initial collection path in real-time collection according to the adjustment parameters, and obtains the first collection strategy.

[0038] If the collection path offset cumulative value is greater than a set threshold, the electromagnetic interference strength and network congestion degree parameters of the real-time collection path of the abnormal data collection terminal are acquired, an interference change map is constructed according to the parameters, and the interference change trend of the detection area in the secret computer is determined according to the interference change map;

[0039] The interference change trend is interpolated based on a spline interpolation method, the interference parameters within the preset range of the shortest initial collection path are determined, the collection stability of the abnormal data collection terminal within the preset range of the shortest initial collection path is determined according to the interference parameters and the anti-interference performance parameters, the shortest initial collection path segment with the collection path offset cumulative value greater than the set threshold is optimized according to the collection stability, an updated collection path is obtained, and the abnormal data collection terminal collects according to the updated collection path to obtain a second collection strategy.

[0040] Preferably, the abnormal data collection terminal acquires real-time communication data of the secret computer according to the collection strategy, identifies the security risk level and the violation item of the secret computer according to the real-time communication data, and obtains detection result data, specifically:

[0041] Standard communication data of different communication scenarios of the secret computer is acquired, and the standard communication data is labeled with a risk level to obtain labeled communication data;

[0042] A security risk identification model is constructed based on a support vector machine algorithm, and the labeled communication data is imported into the identification model for training;

[0043] The abnormal data collection terminal acquires real-time communication data of the secret computer according to the collection strategy, imports the real-time communication data into the trained security risk identification model for security risk level identification, and counts the violation items of each communication scenario to obtain detection result data.

[0044] Preferably, the detection result data is transmitted to the supervision control platform for index updating according to a self-supervision feedback mechanism, specifically:

[0045] A hierarchical data update protocol stack is constructed based on the self-supervision feedback mechanism, the detection result data is feature-extracted, and a detection feedback signal is constructed;

[0046] The detection feedback signal is transmitted to the supervision control platform according to the hierarchical data update protocol stack, and an index mapping operation is performed on the detection feedback signal to obtain security self-supervision detection update data of the secret computer.

[0047] Preferably, the data transmission of the detection feedback signal to the supervision control platform according to the layered data update protocol stack is performed, and an index mapping operation is performed on the detection feedback signal to obtain the secret computer security self-monitoring detection update data, specifically:

[0048] The historical detection database of the supervision control platform is acquired, and similarity matching is performed between the detection feedback signal and the historical detection database to obtain a matching output;

[0049] The distribution characteristics of abnormal data in the detection feedback signal are determined according to the matching output, and time sequence smoothing is performed on the abnormal data based on a moving average filtering algorithm to obtain effective feedback data;

[0050] The effective feedback data and the detection index set are dimensionally aligned to construct an index update correlation matrix, and the detection index item that needs to be adjusted is determined according to the weight change trend of each index in the correlation matrix;

[0051] The detection index item that needs to be adjusted is updated in terms of threshold range or weight coefficient to generate an updated secret self-monitoring detection index set, the updated detection index set is stored to the supervision control platform, and the secret computer security self-monitoring detection update data is obtained.

[0052] Preferably, the effective feedback data and the detection index set are dimensionally aligned to construct an index update correlation matrix, and the detection index item that needs to be adjusted is determined according to the weight change trend of each index in the correlation matrix, specifically:

[0053] Factor analysis is performed on the effective feedback data to extract key factors affecting security risks, and the corresponding correlation relationship with the detection index set is determined according to the key factors;

[0054] The correlation degree values of each detection index and the key factors are calculated based on a correlation coefficient matrix to construct an index update correlation matrix;

[0055] The correlation degree values of each index in the correlation matrix are sorted, and the detection index item with an absolute correlation degree value less than a set threshold value is selected as the detection index item that needs to be adjusted.

[0056] Preferably, the detection index item that needs to be adjusted is updated in terms of threshold range or weight coefficient to generate an updated secret self-monitoring detection index set, specifically:

[0057] For the detection index item that needs to be adjusted, the upper and lower thresholds are reset according to the statistical distribution of the effective feedback data;

[0058] For the qualitative indicators in the detection index items that need to be adjusted, the level description is redefined according to the semantic analysis result of the effective feedback data;

[0059] The weight coefficients of all detection index items are normalized and adjusted to ensure that the total weight sum is 1, and an updated set of secret self-monitoring detection indexes is generated.

[0060] Preferably, the secret risk multi-dimensional evaluation model is constructed, specifically:

[0061] The core dimensions of the secret risk evaluation are determined, including data transmission compliance, interface access security, log record integrity and violation behavior traceability;

[0062] Specific evaluation indexes are set for each core dimension, wherein the data transmission compliance includes encryption protocol matching degree and sensitive data identification rate; the interface access security includes external device authentication rate and remote login authorization rate; the log record integrity includes operation log retention time length and abnormal behavior record completeness; and the violation behavior traceability includes event traceability success rate and responsibility subject positioning accuracy rate;

[0063] Based on the Bayesian network algorithm, an expert system is organized to evaluate the importance of each dimension and index, and the weight coefficients of each dimension and the sub-weight coefficients of each index in the corresponding dimension are calculated according to the evaluation result;

[0064] The evaluation indexes, weight coefficients and sub-weight coefficients of each dimension are structured and integrated to construct a secret risk multi-dimensional evaluation model containing multi-dimensional indexes and hierarchical weights.

[0065] Compared with the prior art, the beneficial effects of the present application are:

[0066] In terms of monitoring node division, the protocol decoding algorithm is called by the network traffic analysis module to perform deep packet analysis on the gigabit network communication data, which can accurately extract communication protocol types, data flow direction, transmission rate and other communication data, and at the same time, feature extraction is performed on device characteristic data such as hardware configuration of the secret computer, then the K-means clustering algorithm is used for spatial feature clustering, the initial threshold of the clustering center is set by the device security level coefficient, the secret computer is scientifically divided into M monitoring nodes, and relevant information is labeled to construct a node feature vector set, the topological connection relationship is obtained to construct a three-dimensional monitoring node distribution map, and then the communication load weight is calculated to construct a heat map and a gradient field, so that the accurate and scientific division of the secret computer monitoring node is realized, which lays a solid foundation for subsequent secret detection.

[0067] In the construction of detection index set and the determination of abnormal data collection strategy, multi-dimensional feature extraction and normalization processing of communication data are performed to construct index feature tensor, fuzzy analytic hierarchy process is used to identify security risk elements to generate a detection index set containing key elements, monitoring nodes are divided and matched with the dimensions of the detection index set to construct a multi-dimensional evaluation model and segmented into time window segments, OPTICS clustering algorithm is used for clustering processing of the time window segments to determine risk assessment priority ranking and node detection importance score, and the optimal distance parameter and collection point set are determined combined with the collection completeness parameter, so as to form a scientific and reasonable abnormal data collection strategy. This strategy can dynamically adjust the collection point and collection frequency according to the risk situation and collection demand of different nodes, improving the pertinence and effectiveness of data collection.

[0068] In the optimization of abnormal data collection path, the collection point and terminal initial deployment position parameters are obtained, the communication blind area is determined, the genetic algorithm is used for path optimization, the communication blind area is taken as the constraint region to output the shortest initial collection path, the device state change parameter is obtained in real time, the electromagnetic interference strength and network congestion degree are analyzed, the anti-interference performance parameter and response delay parameter are combined to calculate the collection path offset cumulative value, and according to the comparison result of the cumulative value and the set threshold, the collection path is adjusted or optimized respectively to obtain a reasonable collection strategy. This effectively solves the problem that the collection path is affected by electromagnetic interference and network congestion in complex network environment, ensuring the stability and accuracy of data collection.

[0069] In the identification of security risk level and violation item, standard communication data of different communication scenarios are obtained and labeled with risk level, a security risk identification model is constructed and trained based on support vector machine algorithm, real-time communication data is obtained by the abnormal data collection terminal and imported into the model for identification and violation item statistics, and detection result data is obtained. This method improves the accuracy of security risk level identification and the comprehensiveness of violation item statistics, and can more accurately find the security risks existing in the secret computer.

[0070] In the detection result feedback and index updating, a hierarchical data update protocol stack is constructed based on a self-regulatory feedback mechanism, detection feedback signals are constructed by extracting features from detection result data, transmitted to the supervision control platform and subjected to index mapping operation, the historical detection database is obtained for similarity matching, the abnormal data distribution characteristics are determined and smoothed to obtain effective feedback data, the correlation matrix is constructed by aligning the detection index set dimensions, the detection index items that need to be adjusted are determined according to the weight change trend, and the threshold range or weight coefficient of the detection index items is updated to generate an updated detection index set. This realizes the dynamic updating of detection index, makes the detection method continuously adapt to the changing security situation, and improves the effectiveness and reliability of security detection.

[0071] Through the synergistic effect of the above various links, the application realizes comprehensive, real-time and accurate detection and self-monitoring of the secret risk of the secret computer in the gigabit network environment, greatly improves the security of the secret computer, and has significant technical advantages and practical value. BRIEF DESCRIPTION OF DRAWINGS

[0072] Figure 1 The working principle diagram of the secret computer security self-monitoring detection method based on the gigabit network is described in the application.

[0073] Figure 2 The flowchart of the monitoring node division method is described.

[0074] Figure 3 The flowchart of the abnormal data acquisition strategy generation is described.

[0075] Figure 4 The flowchart of the abnormal data acquisition terminal path optimization is described. DETAILED DESCRIPTION

[0076] The technical solutions in the embodiments of the application will be clearly and completely described below with reference to the drawings in the embodiments of the application. Obviously, the described embodiments are only part of the embodiments of the application, not all the embodiments. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the application.

[0077] Please refer to Figures 1-4 The secret computer security self-monitoring detection method based on the gigabit network is described in the application, and the specific implementation steps are as follows:

[0078] The network traffic analysis module obtains the gigabit network communication data and device feature data of the secret computer, and determines the monitoring node division of the secret computer according to the device feature data;

[0079] The communication data is used to construct a secret self-monitoring detection index set, and the detection index set and the monitoring node division are used to determine an abnormal data acquisition strategy;

[0080] The abnormal data acquisition terminal obtains real-time communication data of the secret computer according to the acquisition strategy, identifies the secret risk level and the violation item of the secret computer according to the real-time communication data, and obtains detection result data;

[0081] The detection result data is transmitted to the monitoring control platform according to the self-monitoring feedback mechanism for index updating.

[0082] Embodiment 1:

[0083] This embodiment mainly focuses on obtaining the Gigabit network communication data and device characteristic data of the secret computer based on the network traffic analysis module, and determining the monitoring node division of the secret computer according to the device characteristic data.

[0084] The network traffic analysis module needs to obtain the Gigabit network communication data. This module performs deep analysis on the data packets transmitted in the Gigabit network by calling the protocol decoding algorithm. In actual operation, there may be multiple communication protocols in the network, such as TCP / IP protocol, UDP protocol, ICMP protocol, etc. For each protocol, the protocol decoding algorithm will analyze its specific format and structure. Taking the TCP / IP protocol as an example, the algorithm will analyze the source IP address, destination IP address, port number, sequence number, acknowledgement number, etc. in the header, and analyze the data part to extract the communication protocol type. When determining the data flow direction, the relationship between the source IP address and the destination IP address is used to determine whether the data is sent from the secret computer to the external device or received from the external device to the secret computer. The transmission rate is obtained by calculating the amount of data transmitted per unit time, such as the number of bytes or bits transmitted per second.

[0085] The network traffic analysis module also needs to extract the device characteristic data of the secret computer. This process involves multiple aspects: hardware configuration, which needs to obtain the CPU model, core number, main frequency, memory capacity, type, hard disk capacity, interface type, etc. information; operating system version, which needs to determine whether it is Windows system, Linux system or other operating system, and the specific version number, such as Windows10 Professional 1909 version, Ubuntu20.04LTS, etc.; security software deployment state, which needs to determine whether the firewall, antivirus software, intrusion detection system, etc. security software is installed, if installed, also need to understand its specific software name, version number and current running state, such as whether it is normally enabled, whether the virus library is updated to the latest, etc. Through the extraction of these information, comprehensive device characteristic data is formed.

[0086] The K-means clustering algorithm is used to cluster the spatial features of the device feature data. When applying the algorithm, first set the initial threshold of the clustering center as the device security level coefficient. The determination of the device security level coefficient needs to consider multiple factors, such as the security performance of the hardware, whether encryption hard disk and other security hardware are used; the security of the operating system, whether all security patches are installed in time; the protection ability of the security software, the virus detection rate of the antivirus software, whether the firewall rule setting is reasonable, etc. These factors jointly determine the security level coefficient of the device, which will be used as the initial value of the clustering center. Through the iterative calculation of the K-means clustering algorithm, the confidential computers with similar device feature data are divided into the same class, and finally the entire confidential computer system is divided into M monitoring nodes.

[0087] For each monitoring node, detailed labeling is required. Network interface identification is the unique identification of each node, such as eth0, eth1, wlan0, etc., which is used to distinguish different network interfaces. Data interaction frequency refers to the number of data exchanges between the node and other nodes in unit time, which can be counted by network traffic monitoring tools. The security sensitivity level is determined according to the sensitivity of the data processed by the node, which is usually divided into high, medium and low three levels. For example, the node processing national secret level data is marked as high security sensitivity level, and the node processing ordinary office data is marked as low security sensitivity level. Through these labels, the node feature vector set is constructed, each vector contains network interface identification, data interaction frequency, security sensitivity level, etc., so as to comprehensively describe the characteristics of each monitoring node.

[0088] After constructing the node feature vector set, the topological connection relationship of these vector sets needs to be obtained. The topological connection relationship reflects the physical connection and logical connection mode of each monitoring node in the network, including the connection path, bandwidth, delay, etc. between nodes. Through network topology discovery algorithm, the connection relationship between nodes can be automatically detected and drawn. Using these topological connection relationships, a three-dimensional monitoring node distribution diagram is constructed. In this distribution diagram, each node is presented in the form of three-dimensional coordinates, and the connection line between nodes represents the communication link between them, and through different colors and thicknesses, the bandwidth and load of the link can be represented, so as to intuitively show the structure and node distribution of the entire confidential computer network.

[0089] To determine the division of monitoring nodes, the communication load weight of each node also needs to be calculated. The calculation of the communication load weight needs to consider multiple factors, such as the amount of data processed by the node per unit time, the delay time of data transmission, the occupancy rate of CPU and memory, etc. By collecting these parameters and performing weighted calculation, the communication load weight value of each node is obtained. According to these weight values, a monitoring node weight heat map is constructed. In the heat map, high-load nodes are displayed in darker colors, and low-load nodes are displayed in lighter colors, thus intuitively reflecting the load situation of each node. At the same time, a load gradient field is constructed, and the change trend of the load is shown through the direction and size of the gradient.

[0090] According to the three-dimensional monitoring node distribution map, the monitoring node weight heat map and the load gradient field, the monitoring node division of the secret computer is comprehensively determined. In the division process, the security sensitivity level, communication load situation and topology connection relationship of the node need to be considered, and nodes with similar characteristics and functions are divided into a monitoring node for targeted monitoring and management. For example, nodes with high security sensitivity level and high communication load are divided into a monitoring node, equipped with higher level of security monitoring measures; nodes with low security sensitivity level and low communication load are divided into another monitoring node, using a relatively simplified monitoring method.

[0091] Embodiment 2:

[0092] This embodiment mainly focuses on the process of constructing a secret self-monitoring detection index set according to communication data, and determining an abnormal data collection strategy in combination with monitoring node division.

[0093] Multi-dimensional feature extraction of communication data is the basis for constructing the detection index set. This process needs to analyze the features of communication data from multiple angles: in the time dimension, the specific time period of data transmission is extracted, such as morning, afternoon or night of weekdays, and the transmission frequency in different time periods; in the content dimension, the proportion of sensitive information in the transmission data is analyzed, such as identifying secret files, sensitive texts, etc. through keyword matching or data classification algorithm; in the protocol dimension, the encryption protocol type (such as SSL / TLS version) and key length parameters are obtained; in the traffic dimension, the number of data packets, byte size and transmission rate fluctuation per unit time are counted. After extracting these features, the data needs to be normalized to convert different dimensional features into values within a unified range (such as between 0 and 1) to eliminate the influence of dimensional differences on subsequent analysis, and then construct an index feature tensor that integrates multi-dimensional feature data, providing structured input for subsequent risk assessment.

[0094] Based on fuzzy analytic hierarchy process (FAHP), the transmission characteristics of communication data are identified as risk factors for confidentiality. This method first needs to construct a fuzzy judgment matrix, inviting experts in the field to evaluate the relative importance of each risk factor, such as the importance of data encryption strength compared to the frequency of unauthorized external connections. Through fuzzy logic processing of the uncertainty in expert evaluation, the weight order of each risk factor is determined. The final set of self-monitoring detection indicators for confidentiality includes core indicators: data encryption strength, which can be measured by parameters such as encryption algorithm security (such as AES-256 or DES), key update period, etc.; frequency of unauthorized external connections, which counts the number of connections between the classified computer and unauthorized external networks (such as the public internet); and sensitive data transmission volume, which calculates the total size of sensitive files or the number of sensitive information fields transmitted within a specified time. These indicators are directly related to the core dimensions of the classified computer's confidentiality risk.

[0095] The monitoring nodes are divided and matched with the detection indicator set. Each monitoring node has been labeled with security sensitivity level, data interaction frequency, etc. during division, and these characteristics need to be matched with the detection indicator set at this time: for example, for a node with high security sensitivity level, the sensitive data transmission volume indicator needs to set a stricter threshold; for a node with frequent data interaction, the monitoring frequency of the unauthorized external connection frequency indicator needs to be correspondingly increased. Through this matching, a multi-dimensional evaluation model of confidentiality risk is constructed, which takes monitoring nodes as evaluation objects and detection indicators as evaluation dimensions, forming a multi-node and multi-indicator evaluation system. Subsequently, the evaluation model is divided into T time window segments according to the preset time step (such as 1 hour, 6 hours or 1 day), each window segment corresponds to an independent evaluation period, which facilitates dynamic analysis of the trend of risk changes over time.

[0096] Based on the division of monitoring nodes, risk score information is calculated for each time window segment. The scoring process needs to consider the deviation of the actual value of each detection indicator from the security threshold: for example, if the sensitive data transmission volume of a node in a certain time window exceeds the threshold by 20%, the corresponding indicator score is 80 points (out of 100), and if the encryption strength does not meet the AES-256 standard, the score is 60 points. The indicator scores are weighted and summed according to the weights to obtain the comprehensive risk score of the time window segment. The OPTICS (Ordering Points To Identify the Clustering Structure) clustering algorithm is used to cluster time window segments with similar scoring trends. This algorithm calculates the reachable distance of sample points to identify clusters of sample points with similar densities, and can effectively handle non-convex clustering problems. For example, time window segments with high risk scores in the morning of consecutive working days are classified into one category, and weekend window segments with low risk scores are classified into another category, obtaining the clustering output result.

[0097] According to the clustering output, the risk assessment priority ranking of each time window segment is determined. The window segments with high priority (such as the window segments in the high-risk cluster) need to be monitored with high priority, and the window segments with low priority can be appropriately reduced in monitoring frequency. At the same time, the corresponding space-time coordinates of each time window segment in the secret-related computer are obtained, that is, the physical location or network topology location of the monitoring node involved in the window segment, and the corresponding time range. Combined with the priority ranking and space-time coordinates, the detection importance of each node is evaluated: the monitoring node in the high-priority window segment at the key topology location (such as the network core node) has a higher detection importance score; on the contrary, the edge node in the low-priority window segment has a lower score. The detection importance score is calculated by comprehensively considering factors such as node risk score, topology location, security sensitivity level, etc.

[0098] Based on the detection importance score of each node, the detection requirement information is determined. A threshold (such as 60 points) is set, and the nodes with a score exceeding the threshold trigger data collection, and the higher the score, the higher the collection frequency. For example, a node with a score of 90 points needs to collect data every minute, and a node with a score of 70 points needs to collect data every 10 minutes. At the same time, the collection completeness parameter of the abnormal data collection terminal for different node data is obtained, which reflects the collection comprehensiveness of the collection terminal for node data in different locations or network environments, for example, the collection completeness within a range of 3 meters from the node can reach 95%, and outside 5 meters can drop to 80%. According to the collection completeness parameter and the detection requirement information, the optimal distance parameter of the collection terminal for each node is determined: for nodes with high detection requirements and fast collection completeness decrease with distance, the optimal distance is set to 2 meters; on the contrary, the optimal distance of low detection requirement nodes can be set to 5 meters. According to the optimal distance parameter, combined with the space-time coordinates of the node, the collection point set is determined, and each point corresponds to a specific physical location (such as next to the cabinet, under the office table) or network access point (such as switch port).

[0099] According to the collection point set, the abnormal data collection strategy is determined. The strategy needs to clarify the deployment location, movement path and collection frequency of the collection terminal: for fixed point nodes (such as servers), the collection terminal is fixedly deployed at the optimal distance; for mobile nodes (such as laptops), the collection terminal needs to dynamically adjust the location according to the space-time coordinates of the node. For example, a laptop is located in A office from 9 am to 11 am, and the collection terminal needs to move to a position 2 meters away from the computer in A office before 8:50 am, and collect data every minute; after 11 am, the computer moves to B conference room, and the collection terminal needs to reach the corresponding point in B conference room before 11:10 am. The strategy also needs to consider the resource allocation of the collection terminal, such as when multiple nodes are high-priority at the same time, the node with the highest importance score is collected first to ensure efficient use of detection resources.

[0100] Embodiment 3:

[0101] The embodiment mainly focuses on the process of determining the abnormal data collection strategy by the abnormal data collection terminal according to the collection point set, and specifically relates to the key steps of collection path optimization, real-time interference analysis and path adjustment.

[0102] The abnormal data collection terminal needs to obtain the space-time coordinate parameters of each collection point, which includes the physical location coordinates (such as the specific values of X, Y, Z axes) of the collection point and the effective collection time window corresponding to the point, for example, a certain point needs to collect data only during 8:00-18:00 on weekdays. At the same time, the initial deployment location parameters of the abnormal data collection terminal need to be determined, that is, the initial physical location of the terminal when it starts to perform the collection task. On this basis, according to the constructed confidential self-monitoring detection index set, the network communication of the secret computer is analyzed to determine the communication blind area. The communication blind area usually refers to the area where the network signal is weak and the data transmission cannot be effectively monitored, such as some corners inside the building, the vicinity of the edge node in the network topology structure, etc.

[0103] The initial deployment location parameters and the space-time coordinate parameters of each collection point are optimized based on genetic algorithm. The application of genetic algorithm needs to encode the path solution first, for example, the order of each collection point is encoded as a chromosome. Then set the fitness function, which mainly considers the total length of the path, whether it can cover all points within the specified time and other factors. In the process of algorithm running, through selection, crossover, mutation and other operations, continuous iteration optimization is carried out, so as to search for the optimal solution in the possible path solution space. It should be noted that in the optimization process, the communication blind area is regarded as the path constraint area, that is, to ensure that the generated path does not pass through these blind areas, so as to avoid incomplete data collection due to signal problems. After multiple iterations of genetic algorithm, the shortest initial collection path of the abnormal data collection terminal is finally output, which can make the terminal complete the coverage of all collection points with the shortest moving distance and time.

[0104] In the process of real-time collection of the abnormal data collection terminal according to the shortest initial collection path, the device state change parameters of the terminal need to be obtained in real time. These parameters include the power, working temperature, network connection state of the terminal. Through the analysis of these state change parameters, the electromagnetic interference intensity and network congestion degree of the real-time collection position of the terminal can be determined. For example, when the terminal power is low, its signal receiving ability may decrease, which indirectly reflects that the electromagnetic interference of the current position may be strong; when the network connection state shows high delay and large packet loss rate, it means that the network congestion degree of the current position is high.

[0105] The anti-interference performance parameter of the abnormal data acquisition terminal needs to be obtained, which mainly includes the signal filtering capability of the terminal to different intensity interference. For example, the terminal can filter out a certain proportion of interference signals when facing strong electromagnetic interference, ensuring the reception of effective data; and in the case of weak interference, its signal filtering capability can be stronger. In addition, the response delay parameter of the terminal to the electromagnetic interference intensity and the network congestion degree also needs to be obtained, that is, the time required from the detection of interference or congestion by the terminal to the corresponding adjustment measures. According to the response delay parameter, the acquisition path adjustment lag of the terminal can be determined, that is, the time delay of path adjustment due to response delay.

[0106] Based on the anti-interference performance parameter and the acquisition path adjustment lag, the electromagnetic interference intensity and the network congestion degree of the real-time acquisition position of the terminal are comprehensively analyzed, and the acquisition path offset cumulative value of the terminal within the response delay time is calculated. The cumulative value reflects the degree of deviation of the actual acquisition path of the terminal from the shortest initial acquisition path due to interference and congestion during the response delay period.

[0107] If the acquisition path offset cumulative value is less than the pre-set threshold value, it means that the current electromagnetic interference and network congestion have less impact on the acquisition path, and there is no need to make a large adjustment to the path. At this time, the path offset direction and offset amount of the terminal along the shortest initial acquisition path are determined according to the offset cumulative value, and then the adjustment direction and adjustment amount are determined to obtain the adjustment parameter. According to the adjustment parameter, a small range of adjustment processing is performed on the shortest initial acquisition path to obtain the first acquisition strategy. For example, if the offset cumulative value shows that the terminal has deviated 0.5 meters to the right during the response delay period, the adjustment parameter is to move 0.5 meters to the left to make the terminal return to the vicinity of the initial path.

[0108] If the acquisition path offset cumulative value is greater than the set threshold value, it means that the current interference and congestion have a greater impact on the acquisition path, and the path needs to be re-planned. At this time, the electromagnetic interference intensity and the network congestion degree parameter of the real-time acquisition path of the terminal are obtained, and an interference change map is constructed according to these parameters. The map takes time and space as coordinate axes, and shows the changes of electromagnetic interference intensity and network congestion degree, which can directly reflect the change trend of interference, such as whether the interference intensity is gradually increasing, whether the congestion area is expanding, etc.

[0109] The spline interpolation method is used for interpolation processing of the interference change trend. Based on the known data points, the spline interpolation method can construct a smooth curve, thereby predicting the interference parameters of each point within the preset range of the shortest initial collection path. According to the predicted interference parameters and the anti-interference performance parameters of the terminal, the collection stability of the terminal within the preset range of the shortest initial collection path is evaluated. For example, if the electromagnetic interference intensity of a certain path is predicted to exceed the anti-interference capability of the terminal, it is determined that the collection stability of the path is poor. According to the collection stability evaluation result, the shortest initial collection path segment with a collection path offset cumulative value greater than a set threshold is optimized to avoid high-interference and high-congestion areas, the path is re-planned, and an updated collection path is obtained. The abnormal data collection terminal performs collection operation according to the updated collection path, and obtains a second collection strategy.

[0110] Embodiment 4

[0111] This embodiment mainly focuses on the process that the abnormal data collection terminal acquires real-time communication data according to the collection strategy, and identifies the confidentiality risk level and the violation item by means of the confidentiality risk identification model, and finally obtains the detection result data. The implementation mode is described in detail below in combination with specific examples.

[0112] Taking a confidential office network of a certain unit as an example, the network includes multiple computers processing data of different security levels, and the daily communication scenarios include internal file transmission, external device access, confidential system access, etc. The standard communication data of the confidential computer in different communication scenarios needs to be obtained. For example, in the internal file transmission scenario, the standard communication data may include non-sensitive office documents transmitted through the internal encryption protocol of the unit, and the data flow characteristics are 10-20 data packets per second, each data packet size is about 10KB-50KB, and the AES-256 encryption algorithm is used; in the external device access scenario, the standard communication data is the communication record when the authenticated confidential USB is accessed, which is characterized by a short period of high flow (about 500KB / s) at the moment of access, and then the normal data interaction frequency is restored, and the device access process conforms to the preset authentication process; in the confidential system access scenario, the standard communication data is the flow of accessing the confidential server through the VPN encryption channel, which is characterized by continuous and stable low flow (about 5KB / s-10KB / s), and the communication protocol conforms to the specific security specification.

[0113] After obtaining this standard communication data, it needs to be labeled with its risk level. Risk levels are typically divided into three categories: low risk, medium risk, and high risk. Taking internal file transfer scenarios as an example, if the transferred file is a non-sensitive office document and the encryption algorithm meets the requirements, it is labeled as low risk; if the transferred file is non-sensitive but does not use the specified encryption algorithm, it is labeled as medium risk; if the transferred file is a sensitive file and is not encrypted, it is labeled as high risk. For external device access scenarios, unauthenticated devices accessing the network or abnormal data transmission occurring during the access process will be labeled as medium or high risk. During the labeling process, the violations corresponding to each standard communication data are also recorded. For example, in internal file transfers, violations such as "not using the AES-256 encryption algorithm" and "transmitting sensitive data without labeling the security level" are recorded; in external device access, violations such as "failed device authentication" and "illegally transmitting large amounts of data" are recorded, thus obtaining the labeled communication data.

[0114] A confidentiality risk identification model is constructed based on the Support Vector Machine (SVM) algorithm. The core of the SVM algorithm is to find an optimal hyperplane to classify communication data with different risk levels. When constructing the model, the type of kernel function needs to be determined; common kernel functions include linear kernels, polynomial kernels, and radial basis function (RBF) kernels. Taking the RBF kernel as an example, it can map data to a high-dimensional space, thus better handling nonlinear classification problems. Labeled communication data is imported into the identification model for training. During training, the model learns the mapping relationship between the features of the standard communication data and the risk levels and violations.

[0115] Taking labeled data from internal file transfer scenarios as an example, the model learns the association between features such as using the AES-256 encryption algorithm and data packet size within a normal range and low risk level; it learns the association between features such as transmitting non-sensitive data without using the prescribed encryption algorithm and medium risk level; and it learns the association between features such as transmitting sensitive data without encryption and high risk level. During training, the model's parameters, such as kernel function parameters and penalty factors, are continuously adjusted to improve the model's recognition accuracy.

[0116] The abnormal data acquisition terminal collects real-time communication data from classified computers at designated times and locations according to a defined acquisition strategy. For example, in the aforementioned classified office network, the acquisition strategy might stipulate that real-time communication data from computers processing sensitive data be collected every 10 minutes between 8:00 AM and 6:00 PM on weekdays, with the collection point being a network access point near the computer's rack. The real-time communication data acquired by the acquisition terminal may include traffic data from a particular internal file transfer, such as the number and size of transmitted data packets, the encryption algorithm used, and the source and destination IP addresses.

[0117] The real-time communication data is imported into the trained secret risk identification model, and the model extracts and analyzes the features of the real-time data. Taking the internal file transmission data collected in real time as an example, if the data shows that the DES encryption algorithm is used (instead of the specified AES-256), and ordinary office documents are transmitted, the model will identify the risk level of the communication data as medium risk according to the mapping relationship obtained by training. At the same time, the model will count the violation items of the communication scene to determine that there is a violation item of “not using the specified encryption algorithm”.

[0118] If the data collected in real time shows that the secret computer is connected with an external non-secure network (such as the public Internet), and a large amount of data is transmitted, the model will identify the risk level of the communication data as high risk according to the annotation of similar situations in the training data, and count the violation items of “illegal external connection” and “possible leakage of sensitive data”.

[0119] By processing the real-time communication data collected each time, the model can continuously identify the secret risk level and violation items of the secret computer, and finally obtain the detection result data. These detection result data comprehensively reflect the secret risk situation and violation behavior of the secret computer in different time and communication scenarios, providing an important basis for the subsequent supervision and control platform to update the indicators.

[0120] In actual application, as the communication scene of the secret computer changes and new security threats appear, it is necessary to continuously update the standard communication data and annotated communication data, and retrain the secret risk identification model to improve the adaptability and identification accuracy of the model, so as to ensure that various secret risks and violation behaviors can be identified in a timely and accurate manner, and the information security of the secret computer is ensured.

[0121] Embodiment 5:

[0122] In the secret computer secret self-monitoring detection method based on a gigabit network, embodiment 5 mainly focuses on the process of transmitting the detection result data to the supervision and control platform through the self-monitoring feedback mechanism and updating the indicators. The implementation is described in detail below with specific examples.

[0123] Taking the network system of a secret unit as an example, the unit has deployed multiple secret computers for processing files of different security levels. After the abnormal data collection terminal completes the real-time communication data collection of a secret computer, a set of detection result data is obtained. For example, within a certain time period, the computer has connected with an external unauthorized network for 3 times, and the data packets transmitted contain unencrypted sensitive documents. The detection result data shows that the secret risk level of the computer is high risk, and the violation items include “illegal external connection” and “sensitive data transmission without encryption”.

[0124] A hierarchical data update protocol stack is constructed based on the self-monitoring feedback mechanism. The protocol stack includes a physical layer, a data link layer, a network layer, a transport layer, and an application layer. The physical layer is responsible for converting detection result data into electrical or optical signals for transmission, such as through optical fiber or network cable transmission; the data link layer encapsulates data into frames, adds source and destination addresses, and other information to ensure reliable transmission of data in the link; the network layer selects the appropriate path to transmit data to the monitoring control platform according to the network topology; the transport layer is responsible for data segmentation and recombination to ensure data transmission integrity; and the application layer parses and processes the data so that it can be identified and used by the monitoring control platform.

[0125] Feature extraction is performed on the detection result data to construct a detection feedback signal. In the above example, the extracted features include the number of illegal external connections, the transmission volume of sensitive data, the use of encryption algorithms, risk levels, and other information, which are integrated into a detection feedback signal, such as a data packet encapsulated in a specific format, containing fields such as timestamp, classified computer identification, risk level, and illegal item list.

[0126] According to the hierarchical data update protocol stack, the detection feedback signal is transmitted to the monitoring control platform. During transmission, each layer of the protocol processes the data, such as the physical layer ensuring stable signal transmission, the data link layer performing error detection and correction, the network layer selecting the optimal path, the transport layer controlling data flow and order, and the application layer parsing the data and passing it to the corresponding module of the monitoring control platform.

[0127] After transmission is complete, the detection feedback signal is subjected to index mapping operations. The historical detection database of the monitoring control platform is obtained, which stores the detection data of the classified unit in the past, such as the illegal records of each classified computer in the past six months, the risk level changes, the threshold and weight of the detection indicators, and other information. The detection feedback signal is matched with the historical detection database, such as by comparing the number of illegal external connections, the transmission volume of sensitive data, and other features with similar cases in the historical data to find historical records with high matching degrees.

[0128] Suppose there are similar cases of illegal external connections and unencrypted transmission of sensitive data in the historical detection database, and the matching output shows that the risk levels of these cases are high risk, and the main detection indicators involved are "illegal external connection frequency" and "sensitive data transmission volume". According to the matching output, the distribution characteristics of the abnormal data in the detection feedback signal are determined, i.e., the abnormal data mainly concentrates on these two detection indicators.

[0129] The moving average filtering algorithm is used for time series smoothing operation of abnormal data. For example, the moving average value of the same type of abnormal data in the past week is calculated to eliminate random fluctuations in the data and obtain effective feedback data. Assuming that the frequency of illegal external connection of the secret computer in the past week is 2, 1, 3, 2, 1, 3, and 2 times, respectively, and the moving average filtering (window size is 3) is calculated, the smoothed illegal external connection frequency is 2, 2, 2, 2, 2 times, which makes the data more stable and facilitates subsequent analysis.

[0130] The effective feedback data is aligned with the detection index set in dimension to construct an index update correlation matrix. The detection index set includes “data encryption strength”, “illegal external connection frequency”, “sensitive data transmission volume” and other indexes. For the effective feedback data in the above example, the “illegal external connection frequency” and “sensitive data transmission volume” are closely related to the abnormal data, and the “data encryption strength” index is also affected because the sensitive data is transmitted without encryption.

[0131] The correlation values of each detection index and the key factor are calculated based on the correlation coefficient matrix. The key factor is the main factor leading to high risk, i.e. “illegal external connection” and “sensitive data transmission without encryption”. The correlation coefficients of each detection index and these key factors are calculated, for example, the correlation coefficient of “illegal external connection frequency” with the key factor is 0.9, the correlation coefficient of “sensitive data transmission volume” is 0.85, and the correlation coefficient of “data encryption strength” is 0.7, while the correlation coefficient of other indexes such as “interface access security” is 0.3. According to these correlation values, an index update correlation matrix is constructed, in which each row and column corresponds to a detection index and a key factor, respectively, and the cell value is the correlation coefficient.

[0132] The correlation values of each index in the correlation matrix are sorted, and the detection index items with correlation absolute values less than a set threshold (such as 0.5) are selected as the detection index items that need to be adjusted. In the example, indexes with low correlation such as “interface access security” are selected.

[0133] The threshold range update or weight coefficient update is performed on the detection index items that need to be adjusted. For the quantitative index “illegal external connection frequency”, the original threshold is not more than 1 time per month, and according to the situation of multiple illegal external connections of the computer in a short time in the feedback data, the threshold upper limit is re-set to not more than 1 time per week, and the threshold is reduced to improve the monitoring intensity; for the qualitative index “data encryption strength”, the original level description of “not using the specified encryption algorithm” belongs to medium risk, and now according to the situation of high risk caused by the transmission of sensitive data without encryption in the feedback data, the level description is re-defined as “not using the specified encryption algorithm and transmitting sensitive data is high risk”.

[0134] The weight coefficients of all detection index items are normalized and adjusted to ensure that the total weight sum is 1. For example, the original weight of "violation external connection frequency" is 20%, the weight of "sensitive data transmission volume" is 25%, the weight of "data encryption strength" is 20%, and the weight of other indicators is 35% in total. Since the abnormal data shows that the importance of the first three indicators has increased, the weight of "violation external connection frequency" is adjusted to 25% after adjustment, the weight of "sensitive data transmission volume" is 30%, the weight of "data encryption strength" is 25%, and the weight of other indicators is 20% in total. The sum of all weights after adjustment is still 100%.

[0135] The updated confidential self-monitoring detection index set is generated and stored in the supervision control platform. In the subsequent detection process, the supervision control platform will use the updated index set to evaluate and detect the security risk of the secret computer, so that the detection index can better reflect the current security situation and improve the accuracy and effectiveness of the detection.

[0136] Through such a self-monitoring feedback mechanism and index updating process, the confidential self-monitoring detection method of the secret computer can continuously adapt to new security threats and changes, continuously optimize the detection index, improve the identification and prevention ability of the security risk, and ensure the safety of the secret information.

[0137] It should be noted that in this paper, relational terms such as first and second are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply that there is any such actual relationship or order between these entities or operations. Moreover, the terms "include", "contain" or any other variant thereof are intended to cover non-exclusive inclusion, so that the process, method, article or equipment including a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such process, method, article or equipment.

[0138] Although the embodiments of the present application have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and variations can be made to the embodiments without departing from the principles and spirit of the present application, and the scope of the present application is defined by the appended claims and their equivalents.

Claims

1. A method for secret computer security self-monitoring detection based on a gigabit network, characterized in that, The method comprises the following steps: Based on network traffic analysis module to obtain the gigabit network communication data and equipment characteristic data of the secret computer, according to the equipment characteristic data to determine the monitoring node division of the secret computer; According to the communication data, a secret self-monitoring detection index set is constructed, and an abnormal data acquisition strategy is determined according to the detection index set and the monitoring node division; The abnormal data acquisition terminal obtains the real-time communication data of the secret computer according to the acquisition strategy, identifies the secret risk level and the violation item of the secret computer according to the real-time communication data, and obtains the detection result data; The detection result data is transmitted to the supervision control platform according to the self-monitoring feedback mechanism for index updating; The network traffic analysis module obtains the gigabit network communication data and equipment characteristic data of the secret computer, and determines the monitoring node division of the secret computer according to the equipment characteristic data, specifically: The network traffic analysis module calls a protocol decoding algorithm to perform deep packet analysis on the gigabit network communication data, extracts communication data such as communication protocol type, data flow direction and transmission rate; The hardware configuration, operating system version and security software deployment state of the secret computer are extracted to obtain the equipment characteristic data; The K-means clustering algorithm is used to perform spatial feature clustering on the equipment characteristic data, and the initial threshold of the clustering center is set as the equipment security level coefficient; According to the clustering result, the secret computer is divided into M monitoring nodes, and each monitoring node is labeled with network interface identifier, data interaction frequency and security sensitivity level to construct a node feature vector set; The topological connection relationship of the node feature vector set is obtained, and a three-dimensional monitoring node distribution map is constructed according to the topological connection relationship; According to the three-dimensional monitoring node distribution map, the communication load weight of each node is calculated, the monitoring node weight thermodynamic map and load gradient field are constructed according to the communication load weight, and the monitoring node division of the secret computer is determined according to the thermodynamic map and gradient field.

2. The method according to claim 1, wherein the method further comprises: According to the communication data, a secret self-monitoring detection index set is constructed, and an abnormal data acquisition strategy is determined according to the detection index set and the monitoring node division, specifically: Multi-dimensional feature extraction is performed on the communication data, an index feature tensor is constructed through normalization processing, the transmission characteristics of the communication data are identified based on fuzzy analytic hierarchy process to generate a secret self-monitoring detection index set containing data encryption strength, violation external connection frequency and sensitive data transmission volume; The monitoring node division and the detection index set are subjected to dimension matching operation to construct a secret risk multi-dimensional evaluation model, the evaluation model is segmented according to a preset time step to construct T time window segments; According to the monitoring node division, risk score information of each time window segment is obtained, and the time window segments with similar score trends in the risk multi-dimensional evaluation model are clustered based on the OPTICS clustering algorithm to obtain clustering output; According to the clustering output, a priority ranking of a risk assessment of each time window segment is determined, a corresponding space-time coordinate of each time window segment in the secret-related computer is obtained, a risk detection importance assessment of each node in the secret-related computer is performed according to the priority ranking and the corresponding space-time coordinate, and a detection importance score of each node is obtained; According to the detection importance score of each node, detection requirement information of each node in the secret-related computer is determined, and the detection requirement information includes whether to trigger acquisition and acquisition frequency requirement information; An acquisition completeness parameter of the abnormal data acquisition terminal for different node data is obtained, an optimal distance parameter of the abnormal data acquisition terminal for data acquisition of each node in the secret-related computer is determined according to the acquisition completeness parameter and the detection requirement information, and a collection point set of the abnormal data acquisition terminal is determined according to the optimal distance parameter; An abnormal data acquisition strategy of the abnormal data acquisition terminal is determined according to the collection point set.

3. The method according to claim 2, wherein the method further comprises: receiving the network packet from the network interface card; and determining whether the network packet is a network packet of a network protocol supported by the network interface card. The abnormal data acquisition strategy of the abnormal data acquisition terminal determined according to the collection point set is specifically: Space-time coordinate parameters of each collection point and initial deployment position parameters of the abnormal data acquisition terminal are obtained, and a communication blind area in the secret-related computer is determined according to the detection index set; Path optimization is performed on the initial deployment position parameters and the space-time coordinate parameters of each collection point based on a genetic algorithm, the communication blind area is taken as a path constraint region, and a shortest initial acquisition path of the abnormal data acquisition terminal is output; Device state change parameters of the abnormal data acquisition terminal during acquisition according to the shortest initial acquisition path are obtained in real time, and the electromagnetic interference intensity and the network congestion degree of the real-time acquisition position of the abnormal data acquisition terminal are determined according to the state change parameters; Anti-interference performance parameters of the abnormal data acquisition terminal are obtained, and the anti-interference performance parameters include signal filtering capability parameters of the terminal for different intensity interference; Response delay parameters of the abnormal data acquisition terminal for the electromagnetic interference intensity and the network congestion degree are obtained, and an acquisition path adjustment lag of the abnormal data acquisition terminal is determined according to the response delay parameters; The electromagnetic interference intensity and the network congestion degree of the real-time acquisition position of the abnormal data acquisition terminal are analyzed according to the anti-interference performance parameters and the acquisition path adjustment lag, and an acquisition path offset cumulative value of the abnormal data acquisition terminal within a response delay time is calculated; If the acquisition path offset cumulative value is less than a set threshold value, a path offset direction and an offset amount of the abnormal data acquisition terminal along the shortest initial acquisition path are determined according to the offset cumulative value, an adjustment direction and an adjustment amount of the abnormal data acquisition terminal are determined according to the offset direction and the offset amount, and an adjustment parameter is obtained; The shortest initial acquisition path of the abnormal data acquisition terminal in real-time acquisition is adjusted according to the adjustment parameter, and a first acquisition strategy is obtained. If the collection path offset cumulative value is greater than a set threshold, the electromagnetic interference intensity and network congestion degree parameters of the real-time collection path of the abnormal data collection terminal are acquired, an interference change map is constructed according to the parameters, and the interference change trend of the detection area in the secret computer is determined according to the interference change map; The interference change trend is interpolated based on a spline interpolation method, the interference parameters within the preset range of the shortest initial collection path are determined, the collection stability of the abnormal data collection terminal within the preset range of the shortest initial collection path is determined according to the interference parameters and the anti-interference performance parameters, the shortest initial collection path segment with the collection path offset cumulative value greater than the set threshold is optimized according to the collection stability, an updated collection path is obtained, and the abnormal data collection terminal collects according to the updated collection path to obtain a second collection strategy.

4. The method according to claim 1, wherein the method further comprises: if the number of the packets is less than the threshold, sending a warning message to the computer. The abnormal data collection terminal acquires real-time communication data of the secret computer according to the collection strategy, identifies the security risk level and the violation item of the secret computer according to the real-time communication data, and obtains detection result data, specifically: Standard communication data of different communication scenarios of the secret computer is acquired, the standard communication data is labeled with a risk level, and labeled communication data is obtained; A security risk identification model is constructed based on a support vector machine algorithm, and the labeled communication data is imported into the identification model for training; The abnormal data collection terminal acquires real-time communication data of the secret computer according to the collection strategy, imports the real-time communication data into the trained security risk identification model for security risk level identification, and counts the violation items of each communication scenario to obtain detection result data.

5. The method for self-monitoring and detection of classified computer security based on gigabit networks according to claim 1, characterized in that, The detection result data is transmitted to the supervision control platform for index updating according to the self-supervision feedback mechanism, specifically: A hierarchical data update protocol stack is constructed based on the self-supervision feedback mechanism, the detection result data is feature extracted, and a detection feedback signal is constructed; The detection feedback signal is transmitted to the supervision control platform according to the hierarchical data update protocol stack, and index mapping operation is performed on the detection feedback signal to obtain security self-supervision detection update data of the secret computer.

6. The method for self-monitoring and detection of classified computer security based on gigabit networks according to claim 5, characterized in that, The detection feedback signal is transmitted to the supervision control platform according to the hierarchical data update protocol stack, and index mapping operation is performed on the detection feedback signal to obtain security self-supervision detection update data of the secret computer, specifically: A historical detection database of the supervision control platform is acquired, the detection feedback signal is matched with the historical detection database to obtain a matching output; The distribution characteristics of abnormal data in the detection feedback signal are determined according to the matching output, and the abnormal data is time series smoothed based on a moving average filtering algorithm to obtain effective feedback data; The effective feedback data and the detection index set are dimensionally aligned to construct an index update association matrix, and the detection index item that needs to be adjusted is determined according to the weight change trend of each index in the association matrix; The threshold range update or weight coefficient update is performed on the detection index item needing adjustment, an updated secret self-monitoring detection index set is generated, the updated detection index set is stored to the monitoring control platform, and secret computer secret self-monitoring detection update data is obtained.

7. The method according to claim 6, wherein the method further comprises: if the number of the packets is less than the threshold, determining that the computer is in the normal state; and if the number of the packets is greater than the threshold, determining that the computer is in the abnormal state. The effective feedback data is dimensionally aligned with the detection index set, an index update association matrix is constructed, and the detection index item needing adjustment is determined according to the weight change trend of each index in the association matrix, specifically as follows: Factor analysis is performed on the effective feedback data, key factors affecting the secret risk are extracted, and the corresponding association relationship with the detection index set is determined according to the key factors; A correlation degree value of each detection index and the key factor is calculated based on a correlation coefficient matrix, and an index update association matrix is constructed. The correlation degree values of each index in the association matrix are sorted, and the detection index item with an absolute value of the correlation degree less than a set threshold is selected as the detection index item needing adjustment.

8. The method according to claim 7, wherein the method further comprises: if the number of the packets is less than the threshold, determining that the computer is in the normal state; and if the number of the packets is greater than the threshold, determining that the computer is in the abnormal state. The threshold range update or weight coefficient update is performed on the detection index item needing adjustment, an updated secret self-monitoring detection index set is generated, the updated detection index set is stored to the monitoring control platform, and secret computer secret self-monitoring detection update data is obtained. For the detection index item needing adjustment belonging to a quantitative index, the upper and lower limits of the threshold are reset according to the statistical distribution of the effective feedback data; For the detection index item needing adjustment belonging to a qualitative index, the level description is redefined according to the semantic analysis result of the effective feedback data; The weight coefficients of all detection index items are normalized and adjusted to ensure that the total weight sum is 1, and an updated secret self-monitoring detection index set is generated.

9. The method for self-monitoring and detection of classified computer security based on gigabit networks according to claim 2, characterized in that, The secret risk multi-dimensional evaluation model is constructed, specifically as follows: The core dimensions of secret risk evaluation are determined, including data transmission compliance, interface access security, log record integrity, and violation behavior traceability; Specific evaluation indexes are set for each core dimension, wherein the data transmission compliance includes encryption protocol matching degree and sensitive data identification rate; the interface access security includes external device authentication rate and remote login authorization rate; the log record integrity includes operation log retention time length and abnormal behavior record completeness; and the violation behavior traceability includes event traceability success rate and responsibility subject positioning accuracy rate; An expert system based on a Bayesian network algorithm is used to evaluate the importance of each dimension and index, and the weight coefficient of each dimension and the sub-weight coefficient of each index in the corresponding dimension are calculated according to the evaluation result; The evaluation indexes, weight coefficients and sub-weight coefficients of each dimension are structured and integrated, and a secret risk multi-dimensional evaluation model containing multi-dimensional indexes and hierarchical weights is constructed.

Images