Threat early warning method, electronic equipment and storage medium

Abstract

The invention provides a threat early warning method, electronic equipment and a storage medium, and relates to the technical field of data security transmission, and the method comprises the steps: obtaining a transmission attribute information list of transmission data, determining a predicted threat level of transmission data leakage of a data provider based on the transmission attribute information list, and sending the predicted threat level to the data provider. And performing early warning on the data provider through an AI model based on the predicted threat level of transmission data leakage of the data provider. According to the invention, the threat level of transmission data leakage can be determined more accurately.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data security transmission, in particular to a threat early warning method, an electronic device and a storage medium. BACKGROUND

[0002] In today's big data environment, model training and application of various industries increasingly rely on large-scale data sets. However, the data required to support model training is usually mastered by multiple independent data providers, and there is no connection between different data providers, and part of the data of the data provider is encrypted data, which usually refuses to disclose its encrypted data for direct external model training. In the prior art, the data of several data providers is desensitized and transmitted to a third-party platform, and data processing operations are performed on the third-party platform. Many of the data transmitted by the data provider to the third-party platform are encrypted data, so it is very important to predict and protect malicious attacks on the encrypted data of the data provider. Patent CN113961969B discloses a security threat collaborative modeling method and system, which trains an AI model under the condition that the data provider does not completely share the data, but does not disclose the threat level that the transmitted data may be subjected to. In the prior art, network layer anomalies are still monitored by a traffic analysis engine, but the accuracy of predicting the threat level using only traffic analysis is not high. SUMMARY

[0003] To solve the above technical problems, the technical scheme adopted by the present application is as follows: According to a first aspect of the present application, a threat early warning method is provided, which comprises the following steps: Obtaining a transmission attribute information list of transmission data sent by a data provider to a data center platform within a current time window W0, the transmission attribute information list including a plurality of transmission attribute information of a batch of transmission data, the transmission attribute information including at least: a data update period T0 of the transmission data, a size S0 of the transmission data, and an encryption strategy of the transmission data; T0 is the time interval between two consecutive transmissions of transmission data from the data provider to the data center platform; According to the transmission attribute information list, determining a predicted threat level corresponding to the transmission data sent by the data provider to the data center platform, the higher the predicted threat level, the greater the risk of the corresponding transmission data being leaked; Based on the predicted threat level, the data provider is warned by an AI model; According to the transmission attribute information list, determining a predicted threat level corresponding to the transmission data sent by the data provider to the data center platform, includes: The product of the normalized data update period, lg(S0+1), the transmission abnormal value and the preset weight factor is taken as a first threat V1; the transmission abnormal value is the sum of 1 and a transmission abnormal behavior value A0, and A0 is the sum of the preset scores corresponding to each abnormal behavior of all transmission data in W0; A security attenuation value φ(E0) is determined based on the complexity value E0 of the encryption strategy of the transmission data, and the product of φ(E0) and V1 is taken as a second threat V2, wherein φ(E0) is inversely proportional to E0; A predicted threat level corresponding to the transmission data sent by the data provider to the data center platform is determined based on V2, wherein the predicted threat level ranges from 0 to 1.

[0004] According to a second aspect of the present application, a non-transitory computer readable storage medium is provided, which stores a computer program, and the computer program is loaded and executed by a processor to implement the method described above.

[0005] According to a third aspect of the present application, an electronic device is provided, which comprises a processor, a memory, and a computer program stored on the memory and executable on the processor, and the processor implements the method described above when executing the computer program.

[0006] The present application has at least the following beneficial effects: the transmission attribute information list of the transmission data in the current time window W0 is obtained, the predicted threat level of the transmission data leakage of the data provider is determined based on the transmission attribute information list in W0, and the data provider is warned through an AI model based on the predicted threat level of the transmission data leakage of the data provider, wherein the product of the normalized data update period, the transmission risk value, the preset weight factor C0 and the transmission abnormal value is taken as a first threat V1, a security attenuation value φ(E0) is determined based on the complexity value E0 of the encryption strategy of the transmission data, and the product of φ(E0) and V1 is taken as a second threat V2, and the predicted threat level of the transmission data leakage of the data provider is determined based on V2, and the threat level of the transmission data leakage is more accurately determined by the transmission data update period, data size and other dimensions. BRIEF DESCRIPTION OF DRAWINGS

[0007] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced as follows. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative effort.

[0008] Figure 1 A flowchart of a threat warning method provided by the embodiments of the present application is shown. DETAILED DESCRIPTION

[0009] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work fall within the scope of the present application.

[0010] It should be noted that the terms "first", "second", and the like in the specification and claims of the present application and the above-described drawings are used to distinguish similar objects, and do not necessarily have to be used to describe a specific order or sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product, or server including a series of steps or units does not have to be limited to only those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to the process, method, product, or device.

[0011] The embodiments of the present application provide a threat warning method, as shown in Figure 1 for warning transmission data sent by a data provider to a data center platform, the method comprising the following steps: S100, obtaining a transmission attribute information list of transmission data sent by a data provider to a data center platform in a current time window W0, the transmission attribute information list comprising a plurality of transmission attribute information of a batch of transmission data, the transmission attribute information at least comprising: a data update period T0 of the transmission data, a size S0 of the transmission data, and an encryption strategy of the transmission data; T0 is the time interval between two consecutive transmissions of transmission data by the data provider to the data center platform.

[0012] In an embodiment of the present application, the encryption strategy of the transmission data is a plurality of initial encryption strategies of the transmission data, and the initial encryption strategy is an encryption method. It can be understood that the transmission data can be encrypted by a combination of a plurality of initial encryption strategies, but the data provider does not want to disclose the combination mode of the initial encryption strategies due to reasons such as the security of the transmission data, and only discloses the initial encryption strategy of the transmission data.

[0013] S200, determining a predicted threat level corresponding to the transmission data sent by the data provider to the data center platform according to the transmission attribute information list, and the higher the predicted threat level, the greater the risk of the corresponding transmission data being leaked.

[0014] S300, based on the predicted threat level, warning the data provider through the AI model. Specifically, the AI model is used to perform hierarchical warning through the predicted threat level.

[0015] In the method, S200 determines the predicted threat level of the transmission data sent by the data provider to the data center platform according to the transmission attribute information list, and the method further comprises: S210, obtaining a product value of the normalized data update period, lg(S0+1), the transmission abnormal value and the preset weight factor C0 as a first threat value V1; the transmission abnormal value is the sum of 1 and the transmission abnormal behavior value A0, A0 is the sum of the preset scores corresponding to each abnormal behavior of all transmission data in W0, and lg() is a logarithmic function.

[0016] Specifically, those skilled in the art know that any normalization method in the prior art belongs to the protection scope of the present application, and will not be described here.

[0017] Specifically, the first threat value V1=ST0×lg(S0+1)×C0×(A0+1), ST0 is the normalized data update period. It can be understood that fast update behavior may cover up the stealing behavior, for example, when the data provider updates the transmission data, a stealing request is initiated at the same time. Because the data center platform is busy processing update traffic, the abnormal detection system may misjudge the stealing traffic as update traffic. Therefore, the smaller the data update period is, the greater the first threat value is. In addition, the larger the transmission data is, the greater the harm of large amount of data leakage is, so the larger the first threat value is. Setting lg(S0+1) avoids the failure when S0 is 0.

[0018] In an embodiment of the present application, the preset scores corresponding to the abnormal behaviors are preset, the transmission abnormal behaviors in W0 are obtained, and the transmission abnormal behavior value is determined. If there are multiple transmission abnormal behaviors in W0, the sum of the preset scores corresponding to the multiple transmission abnormal behaviors is obtained as the transmission abnormal behavior value.

[0019] Further, the dimensions of the abnormal behaviors at least include: request rate, access rate in irregular time period, access proportion in unusual area, etc.

[0020] S220, determining a security attenuation value φ(E0) based on the complexity value E0 of the encryption strategy of the transmission data, and obtaining a product value of φ(E0) and V1 as a second threat value V2, wherein φ(E0) and E0 are in inverse proportion.

[0021] Specifically, φ(E0) is equal to the sum of the attenuation exponential value and the preset leakage probability a; the attenuation exponential value is the negative x power of the natural constant e, x is the product value of the preset attenuation coefficient b and the specified value Y; the specified value Y is the γ power of E0, and γ is the preset adjustment factor.

[0022] Specifically, V2=V1*phi(E0), phi(E0)=e -x +a, x=b*Y, Y=(E0) γ The security attenuation value is determined through the encryption strategy of the transmission data, when the encryption strategy of the transmission data is complex, E0 is larger, phi(E0) is smaller, and V2 is smaller at this time, that is, the second threat amount is smaller when the encryption strategy of the transmission data is more complex.

[0023] In an embodiment of the present application, the complexity level of each initial encryption strategy is determined to determine the complexity of each initial encryption strategy, based on the encryption strategy of the transmission data, all combination modes of the initial encryption strategies are determined to determine the complexity of each combination mode, and the maximum value in the complexity of the combination mode is taken as the complexity value E0 of the encryption strategy of the transmission data; in an embodiment of the present application, the complexity of the combination mode is equal to the product value of the complexity of all initial encryption strategies in the combination.

[0024] In S230, the predicted threat level of the transmission data sent by the data provider to the data center platform is determined based on V2, wherein the value range of the predicted threat level is 0 to 1.

[0025] In summary, the transmission attribute information list of the transmission data in the current time window W0 is obtained, the predicted threat level of the transmission data leakage of the data provider is determined based on the transmission attribute information list in W0, the data provider is warned through the AI model based on the predicted threat level of the transmission data leakage of the data provider, wherein the product value of the normalized data update period, the transmission risk value, the preset weight factor C0 and the transmission abnormal value is taken as the first threat amount V1, the security attenuation value phi(E0) is determined based on the complexity value E0 of the encryption strategy of the transmission data, and the product value of phi(E0) and V1 is taken as the second threat amount V2, and the predicted threat level of the transmission data leakage of the data provider is determined based on V2. The present application determines the threat level of the transmission data leakage more accurately through multiple dimensions such as the transmission data update period and the data size.

[0026] Specifically, S200 further includes the following steps after determining the predicted threat level of the transmission data leakage of the data provider: S201, the real threat level of the transmission data leakage of the data provider is obtained, and the value range of the real threat level is 0 to 1. In an embodiment of the present application, the real threat level of the transmission data leakage of the data provider is determined through expert opinions.

[0027] S202, construct a cross-entropy loss function based on the predicted threat level and the real threat level, and update preset parameters by minimizing the cross-entropy loss function, wherein the preset parameters at least include: a preset weight factor, a preset leakage probability, a preset attenuation coefficient, and a preset adjustment factor.

[0028] Further, after determining the predicted threat level of the transmission data leakage of the data provider within W0, the method further comprises: If the predicted threat level of the transmission data leakage of the data provider within W0 is greater than the preset threat threshold, and the predicted threat levels corresponding to the transmission data sent by the data provider to the data center platform in the y adjacent time windows before W0 are all greater than the preset threat threshold, the length of the time window is updated to obtain the length of the new time window.

[0029] Further, the length of the new time window is equal to the quotient of the length of the current time window divided by the preset proportion value, and the preset proportion value is equal to the sum of 1 and η times y, and the time proportion value η is equal to the quotient of the length of the current time window divided by T0. It can be understood that when the predicted threat levels of y+1 adjacent time windows are all greater than the preset threat threshold, it is considered that the threat level of the current transmission data leakage is high, and therefore the length of the observation time window is shortened for close observation.

[0030] Further, the preset threat threshold is obtained by the following steps: S010, obtain a historical data attribute list set of historical data, wherein the historical data attribute list set includes a plurality of historical data attribute information lists of historical data sent by a data provider to a data center platform in a historical time window, and each historical data attribute information list includes a plurality of historical data attribute information of a batch of historical data, and the historical data attribute information at least includes: a data update period T1 of the historical data, a size S1 of the historical data, and an encryption strategy of the historical data; and the length of the historical time window is equal to the length of W0. T1 is the time interval between two consecutive times of sending historical data by the data provider to the data center platform.

[0031] S020, for a historical time window, obtain a product value of the normalized data update period T1, lg(S1+1), the preset weight factor, and the historical anomaly value as a historical threat amount Z1; the historical anomaly value is the sum of 1 and a historical abnormal behavior value A1, and A1 is the sum of preset scores corresponding to each abnormal behavior of the historical data in the historical time window.

[0032] Specifically, Z1=ST1×lg(S1+1)×C0×(A1+1), and ST1 is the normalized data update period.

[0033] S030, determining a security attenuation value φ(E1) based on the complexity E1 of the encryption strategy of the historical data for a historical time window, and obtaining a product value of φ(E1) and the historical threat amount as a specified threat amount, φ(E1) being inversely proportional to E1. -p +a, p=b*Y, P=(E1) γ It can be understood that the method of calculating φ(E1) is the same as that of calculating φ(E0).

[0034] S040, determining a historical threat level of the historical data leakage based on the specified threat amount for a historical time window, wherein the historical threat level ranges from 0 to 1. Specifically, the method of determining the historical threat level of the historical data leakage based on the specified threat amount is the same as the method of determining the predicted threat level of the transmission data leakage based on the second threat amount.

[0035] S050, determining a preset threat threshold based on the mean and standard deviation of the historical threat levels corresponding to all historical time windows.

[0036] Specifically, the preset threat threshold is equal to the sum of the mean of the historical threat levels corresponding to all historical time windows, β times the standard deviation of the historical threat levels corresponding to all historical time windows, and α times the exponential smoothing value, wherein β is a preset sensitivity, α is a preset weight coefficient, and the exponential smoothing value is a weighted sum of the transmission abnormal behavior value of the historical time window and the transmission abnormal behavior value of the previous time window of the historical time window.

[0037] Further, the weight of the transmission abnormal behavior value of the historical time window is 0.2.

[0038] In summary, the historical data attribute list set of the historical data is obtained, for a historical time window, a product value of the normalized data update period T1, lg(S1+1), a preset weight factor, and a historical abnormal behavior value is obtained as a historical threat amount Z1, for a historical time window, a security attenuation value φ(E1) is determined based on the complexity of the encryption strategy of the historical data, and a product value of φ(E1) and the historical threat amount is obtained as a specified threat amount Z2, for a historical time window, a historical threat level of the historical data leakage is determined based on the specified threat amount, and a preset threat threshold is determined based on the mean and standard deviation of the historical threat levels corresponding to all historical time windows, and the preset threat level is more accurately determined by the average and standard deviation of the specified threat amount of the historical data.

[0039] Further, after S200, it further includes: obtaining a predicted threat level corresponding to the transmission data sent by the data provider to the data center platform, and determining a target threat level corresponding to the transmission data sent by the data provider to the data center platform based on the vulnerability information list.

[0040] Further, the vulnerability information list is determined by the following steps: S001, performing vulnerability scanning on the data center platform to obtain a vulnerability information list of the data center platform, the vulnerability information list including vulnerability information of a plurality of vulnerabilities, the vulnerability information at least including: vulnerability type, vulnerability severity score, vulnerability impact score, and vulnerability threat score; the data center platform receives transmission data sent by a data provider; the vulnerability severity score is a base score baceScore normalized in a CVSS system, the vulnerability impact score is an impact score impactScore normalized in the CVSS system, and the vulnerability threat score is calculated by using an EPSS prediction score system.

[0041] Specifically, the vulnerability threat score R = 1 / (1+e -L ), the linear regression technique is used to evaluate the possibility of vulnerability exploitation, L = -θ0+θ1×vend+θ2×tag+θ3×exp+θ4×ref; θ0 is a preset base offset, θ1 is a first dynamic regression coefficient, θ2 is a second dynamic regression coefficient, θ3 is a third dynamic regression coefficient, θ4 is a fourth dynamic regression coefficient, θ1, θ2, θ3, and θ4 are dynamically given based on the EPSS, vend is a vendor feature related to the vulnerability, tag is a classification label of the vulnerability, exp is a feature of whether the vulnerability is public, and ref is a reference material quantity feature. The specific calculation can be referred to patent CN115396156B.

[0042] S002, determining a preset correlation parameter list affected by the vulnerability to the data center platform based on the vulnerability type, the preset correlation parameter list including a plurality of preset correlation parameters.

[0043] Specifically, the correlation parameters corresponding to the vulnerability types are preset in advance, for example, the correlation parameters corresponding to the application layer vulnerability include: session timeout time, request rate limit, and input verification rule; the correlation parameters corresponding to the network layer vulnerability include: IP blacklist refresh frequency and TCP connection timeout time.

[0044] S003, generating a plurality of optimization parameter values for each preset correlation parameter in the preset correlation parameter list, thereby obtaining a combination list of all optimization parameter values, the combination list including a plurality of combinations, each combination including a plurality of optimization parameter values corresponding to the preset correlation parameter values.

[0045] S004, determining a security risk value of the data center platform under each combination based on the combination list of the optimization parameter values, wherein the security risk value is equal to a product value of a CVSS system base score of the vulnerability of the data center platform under the current combination, a preset threat weight, and a reciprocal of the repair urgency, and the repair urgency is determined based on an impact of the vulnerability of the data center platform under the current combination on the business.

[0046] S005, optimizing the data center platform using the combination corresponding to the minimum security risk value.

[0047] In summary, the data center platform is scanned for vulnerabilities to obtain a vulnerability information list of the data center platform, a preset correlation parameter list corresponding to the vulnerabilities affecting the data center platform is determined, a plurality of optimization parameter values are generated for each preset correlation parameter in the preset correlation parameter list, thereby obtaining a combination list of all optimization parameter values, a security risk value of the data center platform under each combination is determined based on the combination list of the optimization parameter values, and the data center platform is optimized using the combination corresponding to the minimum security risk value, so that the impact of the vulnerabilities is efficiently reduced by optimizing the preset correlation parameters.

[0048] Embodiments of the present application also provide a non-transitory computer readable storage medium, which can be arranged in an electronic device to save a computer program related to a method in the method embodiments, and the computer program is loaded and executed by the processor to implement the method provided by the above embodiments.

[0049] Embodiments of the present application also provide an electronic device, comprising a processor, a memory, and a computer program stored on the memory and executable on the processor, and the processor implements the method provided by the above embodiments when executing the computer program.

[0050] Embodiments of the present application also provide a computer program product comprising program code for causing an electronic device to perform the steps of the method according to the various exemplary embodiments of the present application described above when the program product is executed on the electronic device.

[0051] Although some specific embodiments of the present application have been described in detail above, those skilled in the art should understand that the above examples are only for illustration, but not for limiting the scope of the present application. Those skilled in the art should also understand that various modifications can be made to the embodiments without departing from the scope and spirit of the present application.

Claims

1. A threat early warning method, characterized in that, The method includes the following steps: Obtain a list of transmission attribute information for the data sent by the data provider to the data center platform within the current time window W0. The list of transmission attribute information includes several transmission attribute information for a batch of transmission data. The transmission attribute information includes at least: the data update period T0 of the transmission data, the size S0 of the transmission data, and the encryption strategy of the transmission data; T0 is the time interval between two consecutive transmission data sent by the data provider to the data center platform. Based on the list of transmission attribute information, determine the predicted threat level of the transmission data sent by the data provider to the data center platform. The higher the predicted threat level, the greater the risk of the corresponding transmission data being leaked. Based on the predicted threat level, AI models are used to issue early warnings to data providers; Specifically, based on the list of transmission attribute information, the predicted threat level corresponding to the transmission data sent by the data provider to the data center platform is determined, including: Obtain the product of the normalized data update period, lg(S0+1), transmission anomaly value and preset weight factor as the first threat quantity V1; the transmission anomaly value is the sum of 1 and the transmission anomaly behavior value A0, where A0 is the sum of the preset scores corresponding to each anomaly behavior of all transmitted data within W0, and lg() is the logarithmic function. The security attenuation value φ(E0) is determined based on the complexity value E0 of the encryption strategy for transmitted data, and the product of φ(E0) and V1 is obtained as the second threat value V2, where φ(E0) and E0 are inversely proportional. Based on V2, the predicted threat level of the transmitted data sent by the data provider to the data center platform is determined, where the value of the predicted threat level ranges from 0 to 1.

2. The threat early warning method according to claim 1, characterized in that, φ(E0) is equal to the sum of the decay exponent and the preset leakage probability; The attenuation index is the negative x power of the natural constant e, where x is the product of the preset attenuation coefficient and the specified value; the specified value is E0 to the power of γ, where γ is the preset adjustment factor.

3. The threat early warning method according to claim 2, characterized in that, After determining the predicted threat level of data leakage from the data provider's transmission, the following is also included: Obtain the true threat level of the data provider's transmitted data leakage. The true threat level ranges from 0 to 1. A cross-entropy loss function is constructed based on the predicted threat level and the actual threat level. The preset parameters are updated by minimizing the cross-entropy loss function. The preset parameters include at least: a preset weighting factor, a preset leakage probability, a preset decay coefficient, and a preset adjustment factor.

4. The threat early warning method according to claim 1, characterized in that, After determining the predicted threat level of data leakage from the data provider within W0, the following is also included: If the predicted threat level of the data provider's transmitted data leakage within W0 is greater than the preset threat threshold, and the predicted threat level of the transmitted data sent by the data provider to the data center platform within the y adjacent time windows before W0 is greater than the preset threat threshold, the length of the time window is updated to obtain the new length of the time window.

5. The threat early warning method according to claim 4, characterized in that, The length of the new time window is equal to the quotient of the length of the current time window divided by a preset ratio value, where the preset ratio value is equal to the sum of 1 and η times y, and the time ratio value η is equal to the quotient of the length of the current time window divided by T0.

6. The threat early warning method according to claim 4, characterized in that, Obtain the preset threat threshold by following these steps: Obtain a list of historical data attributes, which includes a list of historical data attribute information sent by the data provider to the data center platform under several historical time windows. The list of historical data attribute information includes several historical data attribute information of a batch of historical data. The historical data attribute information includes at least: the data update period T1 of the historical data, the size S1 of the historical data, and the encryption strategy of the historical data; the length of the historical time window is equal to the length of W0; and T1 is the time interval between two consecutive historical data transmissions from the data provider to the data center platform. For a historical time window, the product of the normalized data update period T1, lg(S1+1), preset weight factor and historical outlier is obtained as the historical threat quantity; the historical outlier is the sum of 1 and the historical outlier behavior value A1, where A1 is the sum of the preset scores corresponding to each outlier behavior in the historical data within the historical time window. For a given historical time window, the security attenuation value φ(E1) is determined based on the complexity E1 of the encryption strategy for historical data, and the product of φ(E1) and the historical threat level is obtained as the specified threat level. φ(E1) and E1 are inversely proportional. For a given historical time window, the historical threat level of historical data breaches is determined based on a specified threat level, where the value of the historical threat level ranges from 0 to 1. The preset threat threshold is determined based on the mean and standard deviation of the historical threat levels corresponding to all historical time windows.

7. The threat early warning method according to claim 6, characterized in that, The preset threat threshold is equal to the sum of the mean of the historical threat levels corresponding to all historical time windows, β times the standard deviation of the historical threat levels corresponding to all historical time windows, and α times the exponential smoothing value, where β is the preset sensitivity, α is the preset weighting coefficient, and the exponential smoothing value is the weighted sum of the transmission anomaly behavior values ​​of the historical time window and the transmission anomaly behavior values ​​of the previous time window.

8. The threat early warning method according to claim 7, characterized in that, The weight of the transmission anomaly value in the historical time window is 0.

2.

9. A non-transitory computer-readable storage medium, characterized in that, The storage medium stores a computer program, which is loaded and executed by a processor to implement the threat warning method as described in any one of claims 1-8.

10. An electronic device, comprising: A processor, a memory, and a computer program stored in the memory and executable on the processor, characterized in that, when the processor executes the computer program, it implements the threat warning method as described in any one of claims 1-8.

Images