An information security detection method and device for informatization equipment

Abstract

The application discloses an information security detection method and device for information equipment, and relates to the technical field of information security detection, and in particular relates to an information security detection method and device for information equipment.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of information security and information systems, and particularly relates to an information security detection method and device for information equipment. BACKGROUND

[0002] With the rapid development of information technology, information equipment has been widely used in various fields. However, these devices are facing increasingly severe information security threats, such as malicious code attacks, illegal access and data leakage, etc. Traditional information security detection methods mainly focus on single-dimensional detection, such as only scanning the running code of the device or only monitoring the network connection. These methods have the following problems: limited detection dimension: only focusing on a certain aspect of the running code or network connection of the device, which cannot comprehensively evaluate the overall security of the device. For example, only detecting the running code may ignore the malicious data entering the device through the network connection. Insufficient detection accuracy: traditional code detection methods are mostly based on simple string matching or rule matching, which are prone to false positives and false negatives. For network connection detection, it is also difficult to accurately distinguish between normal traffic and abnormal traffic. Lack of fusion evaluation: the detection results of running security and connection security are not comprehensively evaluated, making it difficult to obtain accurate overall security status. This may lead to security vulnerabilities being ignored or excessive alarms interfering with normal operation. Therefore, a method is needed that can comprehensively and accurately detect the information security status of information equipment while improving detection accuracy and efficiency. SUMMARY

[0003] The present application mainly solves the problem of how to comprehensively and accurately detect the information security status of information equipment, and discloses an information security detection method and device for information equipment.

[0004] In a first aspect, the present application discloses an information security detection method for information equipment, comprising:

[0005] S1, performing running security detection on the information equipment to be detected to obtain running security detection result information;

[0006] S2, performing connection security detection on the information equipment to obtain a set of connection security detection result information;

[0007] S3, performing fusion evaluation processing on the running security detection result information and the set of connection security detection result information to obtain an information security detection result value of the information equipment.

[0008] The running security detection on the information equipment to be detected to obtain running security detection result information comprises:

[0009] S11, Obtain the current running code information of the storage module of the information technology device to be tested;

[0010] S12, using a preset suspicious code library, the currently running code information is detected and processed to obtain running security detection result information; the suspicious code library includes several suspicious codes.

[0011] The process of using a preset suspicious code library to detect and process the currently running code information to obtain runtime security detection result information includes:

[0012] S121, For each suspicious code in the preset suspicious code library and the information of the currently running code, perform text recognition processing to obtain the corresponding text information vector;

[0013] S122, perform position embedding information extraction processing on each text information vector to obtain the text embedding vector corresponding to each text information vector;

[0014] S123, For each suspicious code, perform vector comparison and discrimination processing with the currently running code information to obtain the corresponding similarity value;

[0015] S124, for each suspicious code, determine whether its corresponding similarity value is greater than a preset discrimination threshold to obtain the corresponding first discrimination result; when the first discrimination result is yes, determine that the appearance discrimination result of the suspicious code is 1; when the first discrimination result is no, determine that the appearance discrimination result of the suspicious code is 0.

[0016] S125, the total number of suspicious codes with a judgment result of 1 is obtained, and the total number is calculated using a preset piecewise linear function to obtain the operation security detection result information.

[0017] The step of performing vector comparison and discrimination processing on each suspicious code and the currently running code information to obtain the corresponding similarity value includes:

[0018] S1231, Subtract the text embedding vector of each suspicious code from the text embedding vector of the currently running code information to obtain a difference vector;

[0019] S1232, Perform statistical processing on the value distribution probability of the difference vector to obtain the value distribution probability value; the value distribution probability value is the distribution probability of the value of the difference vector within a value interval;

[0020] S1233, Based on the value distribution probability value, perform similarity calculation on the text information vectors of the suspicious code and the currently running code information to obtain the similarity value corresponding to the suspicious code.

[0021] The expression for the similarity calculation is:

[0022]

[0023] Where xs is the similarity value corresponding to the suspicious code, p j Let X be the probability distribution of the difference vector within the j-th value interval, where J is the number of value intervals. i and Y i The i-th element of the text information vectors representing the suspicious code and the currently running code is respectively, and N is the length of the text information vector.

[0024] The connection security detection of the information device, resulting in a set of connection security detection result information, includes:

[0025] S21, the information device is subjected to access terminal detection to obtain a set of read and write information of the externally accessed mobile storage medium; the set of read and write information includes the identity information and read and write data information of the externally accessed mobile storage medium; the read and write data information includes the total amount of read and write data and the read and write frequency information.

[0026] S22, using a preset set of trusted mobile storage medium identity information, determine whether the identity information of the externally accessed mobile storage medium is in the set of trusted mobile storage medium identity information, and obtain a second discrimination result;

[0027] S23, when the second determination result is negative, perform a first anomaly determination calculation on the read / write data information to obtain a read / write anomaly determination value; when the second determination result is positive, no operation is performed;

[0028] S24, perform data transmission detection on the information equipment to obtain data transmission information; the data transmission information includes connection domain name information, connection IP address information, SSL channel information, uplink and downlink traffic ratio information, and traffic time distribution information; the traffic time distribution information is the traffic value of the information equipment communicating with the outside at each moment;

[0029] S25, using a preset set of secure connection information, determine whether the connection domain name information, connection IP address information, and SSL channel information are all in the set of secure connection information, and obtain a third discrimination result;

[0030] S26, when the third judgment result is negative, perform a second anomaly judgment calculation on the uplink and downlink traffic ratio information and traffic time distribution information to obtain a traffic anomaly judgment value; when the third judgment result is positive, no operation is performed;

[0031] S27. Using the traffic anomaly discrimination value, read / write anomaly discrimination value, second discrimination result and third discrimination result, a connection security detection result information set is constructed.

[0032] The expression for the first anomaly detection calculation is:

[0033]

[0034] Where α2 and α1 are the preset lower and upper limits of the total amount of read and write data, respectively, α is the total amount of read and write data, β2 and β1 are the preset lower and upper limits of read and write frequency information, respectively, β is the read and write frequency information, and y1 is the read and write anomaly detection value. Represents the ReLU activation function;

[0035] The second anomaly detection calculation process, which involves performing a second anomaly detection value on the uplink / downlink traffic ratio information and traffic time distribution information, includes:

[0036] The flow time distribution information is fitted with a polynomial function to obtain the flow time distribution function g(t); the independent variable and dependent variable of the flow time distribution function are the time value t and the flow value, respectively.

[0037] Based on the traffic temporal distribution function, a feature optimization model is constructed;

[0038] The feature optimization model is solved to obtain the flow characteristic values;

[0039] The traffic feature value and the uplink / downlink traffic ratio information are fused and calculated to obtain the traffic anomaly discrimination value.

[0040] A second aspect of the present invention discloses an information security detection device for information technology equipment, the device comprising:

[0041] Memory containing executable program code;

[0042] A processor coupled to the memory;

[0043] The processor calls the executable program code stored in the memory to execute the information security detection method for information technology equipment.

[0044] In a third aspect, the present invention discloses a computer-readable storage medium storing computer instructions, which, when invoked by a computer, are used to execute the information security detection method for information technology equipment.

[0045] In a fourth aspect of this invention, an information data processing terminal is disclosed, which is used to implement the information security detection method for information technology equipment.

[0046] The beneficial effects of this invention are as follows:

[0047] This invention combines operational security detection and connection security detection to perform multi-dimensional inspections of information technology devices, enabling a more comprehensive discovery of potential security threats. Employing technologies such as text recognition, location embedding, and vector comparison, it performs deep inspection of the running code, effectively improving detection accuracy and reducing false positives and false negatives. The fusion and evaluation of operational and connection security detection results more accurately reflects the overall security status of the device, providing a more reliable basis for security decisions. By constructing an anomaly detection model, it can quickly identify abnormal traffic and unauthorized access behaviors, promptly identifying potential security risks. Attached Figure Description

[0048] Figure 1 This is a flowchart illustrating the implementation of the method of the present invention. Detailed Implementation

[0049] To better understand the content of this invention, an embodiment is provided here.

[0050] Figure 1 This is a flowchart illustrating the implementation of the method of the present invention.

[0051] In a first aspect, the present invention discloses an information security detection method for information technology equipment, comprising:

[0052] S1, Perform operational safety testing on the information technology equipment to be tested, and obtain operational safety testing result information;

[0053] S2, perform connection security detection on the information device to obtain a set of connection security detection result information;

[0054] S3, perform fusion evaluation processing on the set of operational security detection results and connection security detection results to obtain the information security detection result value of the information equipment;

[0055] The operational safety testing of the information technology equipment to be tested yields operational safety test results, including:

[0056] S11, Obtain the current running code information of the storage module of the information technology device to be tested;

[0057] S12, using a preset suspicious code library, the currently running code information is detected and processed to obtain running security detection result information; the suspicious code library includes several suspicious codes; the types of the suspicious codes include Trojan suspicious codes, virus suspicious codes, and running address suspicious codes;

[0058] The process of using a preset suspicious code library to detect and process the currently running code information to obtain runtime security detection result information includes:

[0059] S121, For each suspicious code in the preset suspicious code library and the information of the currently running code, perform text recognition processing to obtain the corresponding text information vector;

[0060] S122, perform position embedding information extraction processing on each text information vector to obtain the text embedding vector corresponding to each text information vector;

[0061] S123, For each suspicious code, perform vector comparison and discrimination processing with the currently running code information to obtain the corresponding similarity value;

[0062] S124, for each suspicious code, determine whether its corresponding similarity value is greater than a preset discrimination threshold to obtain the corresponding first discrimination result; when the first discrimination result is yes, determine that the appearance discrimination result of the suspicious code is 1; when the first discrimination result is no, determine that the appearance discrimination result of the suspicious code is 0.

[0063] S125, the total number of suspicious codes with a judgment result of 1 is obtained, and the total number is calculated using a preset piecewise linear function to obtain the operation security detection result information.

[0064] The location embedding information extraction and processing can be achieved through offset encoding.

[0065] The step of performing vector comparison and discrimination processing on each suspicious code and the currently running code information to obtain the corresponding similarity value includes:

[0066] S1231, Subtract the text embedding vector of each suspicious code from the text embedding vector of the currently running code information to obtain a difference vector;

[0067] S1232, Perform statistical processing on the value distribution probability of the difference vector to obtain the value distribution probability value; the value distribution probability value is the distribution probability of the value of the difference vector within a value interval;

[0068] S1233, Based on the value distribution probability value, perform similarity calculation on the text information vectors of the suspicious code and the currently running code information to obtain the similarity value corresponding to the suspicious code;

[0069] The expression for the similarity calculation is:

[0070]

[0071] Where xs is the similarity value corresponding to the suspicious code, p j Let X be the probability distribution of the difference vector within the j-th value interval, where J is the number of value intervals. i and Y i The i-th element of the text information vectors representing the suspicious code and the currently running code is respectively, and N is the length of the text information vector.

[0072] This expression, by combining the differences and probability distributions of text embedding vectors, can more accurately measure the similarity between suspicious code and currently running code. This comprehensive calculation method based on probability and vector differences, compared to traditional string matching, can more effectively identify potential threats in code, improving detection accuracy and robustness.

[0073] The expression for the piecewise linear function can be:

[0074]

[0075] Where Q is the total number, Fd is the operational safety detection result information, b0 to b3 are the segmented values, and a1 to a3 are the scaling factors.

[0076] The storage module of the information technology device includes memory and cache;

[0077] The step of obtaining the current running code information of the storage module of the information technology device to be tested is to read the currently running program code from the memory or cache of the information technology device.

[0078] The connection security detection of the information device, resulting in a set of connection security detection result information, includes:

[0079] S21, the information device is subjected to access terminal detection to obtain a set of read and write information of the externally accessed mobile storage medium; the set of read and write information includes the identity information and read and write data information of the externally accessed mobile storage medium; the read and write data information includes the total amount of read and write data and the read and write frequency information.

[0080] S22, using a preset set of trusted mobile storage medium identity information, determine whether the identity information of the externally accessed mobile storage medium is in the set of trusted mobile storage medium identity information, and obtain a second discrimination result;

[0081] S23, when the second determination result is negative, perform a first anomaly determination calculation on the read / write data information to obtain a read / write anomaly determination value; when the second determination result is positive, no operation is performed;

[0082] S24, perform data transmission detection on the information equipment to obtain data transmission information; the data transmission information includes connection domain name information, connection IP address information, SSL channel information, uplink and downlink traffic ratio information, and traffic time distribution information; the traffic time distribution information is the traffic value of the information equipment communicating with the outside world at different times;

[0083] S25, using a preset set of secure connection information, determine whether the connection domain name information, connection IP address information, and SSL channel information are all in the set of secure connection information, and obtain a third discrimination result;

[0084] S26, when the third judgment result is negative, perform a second anomaly judgment calculation on the uplink and downlink traffic ratio information and traffic time distribution information to obtain a traffic anomaly judgment value; when the third judgment result is positive, no operation is performed;

[0085] S27. Using the traffic anomaly discrimination value, read / write anomaly discrimination value, second discrimination result and third discrimination result, a connection security detection result information set is constructed.

[0086] The expression for the first anomaly detection calculation is:

[0087]

[0088] Where α2 and α1 are the preset lower and upper limits of the total amount of read and write data, respectively, α is the total amount of read and write data, β2 and β1 are the preset lower and upper limits of read and write frequency information, respectively, β is the read and write frequency information, and y1 is the read and write anomaly detection value. This represents the ReLU function. This expression combines the ReLU activation function and the arctangent function to detect anomalies in the total amount of data read and written and the frequency of read and write operations. The ReLU function effectively handles non-linear relationships, while the arctangent function smoothly handles anomalies, making the detection results more accurate and stable. This combined approach effectively distinguishes between normal and abnormal read and write behaviors, improving detection sensitivity.

[0089] The second anomaly detection calculation process, which involves performing a second anomaly detection value on the uplink / downlink traffic ratio information and traffic time distribution information, includes:

[0090] The flow time distribution information is fitted with a polynomial function to obtain the flow time distribution function g(t); the independent variable and dependent variable of the flow time distribution function are the time value t and the flow value, respectively.

[0091] Based on the traffic temporal distribution function, a feature optimization model is constructed;

[0092] The feature optimization model is solved to obtain the flow characteristic values;

[0093] The traffic feature value and the uplink / downlink traffic ratio information are fused and calculated to obtain the traffic anomaly discrimination value.

[0094] The second anomaly detection calculation process involves fitting the traffic temporal distribution information to a polynomial function to obtain the traffic temporal distribution function. A feature optimization model is then constructed based on this function, and the traffic feature values ​​are obtained by solving for them. These feature values ​​are then fused with the uplink / downlink traffic ratio information to generate anomaly detection values. Through polynomial function fitting and the feature optimization model, the characteristics of the traffic temporal distribution can be accurately described, thus more effectively identifying abnormal traffic patterns. This fusion calculation method comprehensively considers the temporal characteristics and traffic ratios of the traffic, improving the accuracy and reliability of traffic anomaly detection. This method can promptly detect traffic anomalies, providing strong support for network security protection.

[0095] The expression for the feature optimization model is:

[0096]

[0097] Where r is the flow characteristic value to be solved, ti is the i-th time value of the flow time distribution information, N1 is the total number of time values, g(ti) is the value of the flow time distribution function at time ti, gmax is the maximum value of the flow time distribution function at all times, and e is the natural constant.

[0098] The feature optimization model models the changes in flow over time using a flow time distribution function, accurately capturing the dynamic characteristics of flow changes. This modeling method reflects the true flow situation better than simple statistical methods (such as average or peak flow), helping to more accurately identify abnormal flow patterns. The flow feature values ​​in the model are dynamically solved through an optimization process, adaptively reflecting the characteristics of the flow time distribution. This adaptive method automatically adjusts feature values ​​according to different flow patterns, improving the model's flexibility and adaptability. The model incorporates the maximum value of the flow time distribution function to normalize the flow. This normalization method eliminates the influence of the absolute value of the flow, making the model more robust to flow data of different scales and improving detection accuracy. The nonlinear function in the model captures the nonlinear characteristics in the flow time distribution. This nonlinear processing method more accurately describes the complex changes in flow, improving the model's ability to identify abnormal flow.

[0099] The simplex method can be used to solve the feature optimization model.

[0100] In the polynomial function fitting process, the independent variable and the dependent variable are the time information and flow information of the flow time distribution information, respectively.

[0101] The expression for the fusion calculation is:

[0102]

[0103] Where ρ is the traffic anomaly detection value, and ω is the uplink / downlink traffic ratio information. max This is the upper limit of the preset uplink / downlink traffic ratio.

[0104] When the second or third judgment result is yes, no operation is performed, and the values ​​of the traffic anomaly judgment value and the read / write anomaly judgment value are empty;

[0105] The secure connection information set includes all secure connection domain name information, connection IP address information, and SSL channel information.

[0106] The connection domain name information, connection IP address information, SSL channel information, and uplink / downlink traffic ratio information can be obtained through traffic monitoring software such as Wireshark or by reading log information;

[0107] The expression for the fusion evaluation process is:

[0108] AP = |1-y1f1|×|1-ρf2|,

[0109] Wherein, AP is the information connection security detection result value of the information device, and f1 and f2 are the discriminant variables corresponding to the second and third discriminant results, respectively.

[0110] A second aspect of the present invention discloses an information security detection device for information technology equipment, the device comprising:

[0111] Memory containing executable program code;

[0112] A processor coupled to the memory;

[0113] The processor calls the executable program code stored in the memory to execute the information security detection method for information technology equipment.

[0114] In a third aspect, the present invention discloses a computer-readable storage medium storing computer instructions, which, when invoked by a computer, are used to execute the information security detection method for information technology equipment.

[0115] The above description is merely an embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principle of the present invention should be included within the scope of the claims of the present invention.

Claims

1. An information security detection method for an informationized device, characterized by, The method comprises the following steps: S1, performing operation safety detection on the information equipment to be detected to obtain operation safety detection result information, which comprises: S11, obtaining current operation code information of a storage module of the information equipment to be detected; S12, detecting and processing the current operation code information by using a preset suspicious code library to obtain operation safety detection result information, wherein the suspicious code library comprises a plurality of suspicious codes, and specifically comprises: S121, respectively performing text recognition processing on each suspicious code of the preset suspicious code library and the current operation code information to obtain corresponding text information vectors; S122, respectively performing position embedding information extraction processing on each text information vector to obtain a text embedding vector corresponding to each text information vector; S123, performing vector comparison and discrimination processing on each suspicious code and the current operation code information to obtain a corresponding similarity value; S124, judging whether the corresponding similarity value of each suspicious code is greater than a preset discrimination threshold to obtain a corresponding first discrimination result; when the first discrimination result is yes, it is determined that the appearance discrimination result of the suspicious code is 1; when the first discrimination result is no, it is determined that the appearance discrimination result of the suspicious code is 0; S125, counting the total number of suspicious codes with an appearance discrimination result of 1, and calculating the total number by using a preset piecewise linear function to obtain operation safety detection result information; S2, performing connection safety detection on the information equipment to obtain a connection safety detection result information set, which comprises: S21, performing access terminal detection on the information equipment to obtain a read-write information set of an externally accessed mobile storage medium; the read-write information set comprises identity information and read-write data information of the externally accessed mobile storage medium; the read-write data information comprises read-write data total amount and read-write frequency information; S22, judging whether the identity information of the externally accessed mobile storage medium is in a preset trusted mobile storage medium identity information set by using the trusted mobile storage medium identity information set to obtain a second discrimination result; S23, when the second discrimination result is no, performing first abnormality discrimination calculation processing on the read-write data information to obtain a read-write abnormality discrimination value; when the second discrimination result is yes, no operation is performed; S24, performing data transmission detection on the information equipment to obtain data transmission information; the data transmission information comprises connection domain name information, connection IP address information, SSL channel information, uplink-downlink traffic ratio information, and traffic time distribution information; the traffic time distribution information is a traffic value of the information equipment communicating with the outside at each time point; S25, judging whether the connection domain name information, connection IP address information, and SSL channel information are all in a preset safe connection information set by using the safe connection information set to obtain a third discrimination result; S26, when the third discrimination result is no, performing second abnormality discrimination calculation processing on the uplink-downlink traffic ratio information and the traffic time distribution information to obtain a traffic abnormality discrimination value; when the third discrimination result is yes, not performing operation; S27, constructing a connection security detection result information set by using the traffic abnormality discrimination value, the read-write abnormality discrimination value, the second discrimination result and the third discrimination result; S3, performing fusion evaluation processing on the running security detection result information and the connection security detection result information set to obtain an information security detection result value of the information equipment.

2. The information security detection method for informatization equipment according to claim 1, wherein, The vector comparison discrimination processing of each suspicious code with the current running code information includes: S1231, subtracting the text embedding vector of each suspicious code from the text embedding vector of the current running code information to obtain a difference vector; S1232, performing value distribution probability statistical processing on the difference vector to obtain a value distribution probability value; the value distribution probability value is a distribution probability of a value of the difference vector in a value interval; S1233, performing similarity calculation on the text information vectors of the suspicious code and the current running code information based on the value distribution probability value to obtain a similarity value corresponding to the suspicious code.

3. The information security detection method for informatization equipment according to claim 2, wherein The expression of the similarity calculation is: wherein xs is the similarity value corresponding to the suspicious code, p j is the distribution probability of the value of the difference vector in the jth value interval, J is the number of value intervals, X i and Y i are the ith elements of the text information vectors of the suspicious code and the current running code information, respectively, and N is the length of the text information vector.

4. The information security detection method for informatization equipment according to claim 1, wherein, The expression of the first abnormality discrimination calculation processing is: Wherein, α2 and α1 are respectively preset lower limit value and upper limit value of total read-write data amount, α is total read-write data amount, β2 and β1 are respectively preset lower limit value and upper limit value of read-write frequency information, β is read-write frequency information, y1 is read-write abnormality discrimination value, denotes a RELU activation function; The second abnormality discrimination calculation processing on the uplink-downlink traffic ratio information and the traffic time distribution information to obtain a traffic abnormality discrimination value includes: performing polynomial function fitting on the traffic time distribution information to obtain a traffic time distribution function g(t); the independent variable and the dependent variable of the traffic time distribution function are time value t and traffic value, respectively; constructing a feature optimization model based on the traffic time distribution function; solving the feature optimization model to obtain a traffic feature value; performing fusion calculation on the traffic feature value and the uplink-downlink traffic ratio information to obtain a traffic abnormality discrimination value.

5. An information security detection device for an informationized device, characterized by comprising: The device includes: a memory storing executable program codes; a processor coupled with the memory; the processor invokes the executable program codes stored in the memory to execute the information security detection method for information equipment according to any one of claims 1 to 4.

6. A computer readable storage medium characterized by, The computer readable storage medium stores computer instructions, which are invoked by a computer to execute the information security detection method for information equipment according to any one of claims 1 to 4.

Images