Operation and maintenance information security management method and system based on artificial intelligence

Abstract

The invention relates to the technical field of operation and maintenance management, in particular to an operation and maintenance information security management method and system based on artificial intelligence. The invention discloses an operation and maintenance information security management method based on artificial intelligence. The method comprises the following steps: S1, obtaining project metadata, project associated resource information and temporary account attribute information; s2, processing the project metadata and the project associated resource information by using a natural language processing technology to obtain project task data and project task associated resource data; and S3, based on the project task data, the project task associated resource data and the temporary account attribute information, constructing a project task associated resource allocation sequence. According to the method, the allocation time of the resources can be dynamically adjusted according to the actual starting and ending time of the project tasks by constructing the project task associated resource allocation sequence, so that resource allocation is closely matched with the actual progress of the project. And refined dynamic resource management is realized.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of operation and maintenance, and particularly relates to an operation and maintenance information security management method and system based on artificial intelligence. BACKGROUND

[0002] In modern large enterprises or IT operation and maintenance scenarios, a large number of temporary accounts are often opened to support inter-enterprise collaboration, project temporary access requirements and external consultant or technical personnel decision-making. However, after the project ends, these accounts cannot be identified and canceled in time, becoming potential security loopholes, such as being used by hackers as an entry point for intrusion, causing abuse of authority, or leading to compliance risks. This phenomenon is common in fields such as finance, the Internet, and government affairs, which have high requirements for information security. At present, the common method mainly relies on manual management, and the operation and maintenance personnel register and clean up the accounts. However, this method has obvious limitations: first, manual operation is prone to omissions, especially in environments with a large number of accounts and frequent project changes; second, it lacks the ability to perceive and infer the actual progress of the project, user behavior dynamic context information, and it is difficult to provide real-time and accurate risk assessment and decision support. Therefore, there is an urgent need for an operation and maintenance information security management method and system based on artificial intelligence, which can automatically and intelligently manage the life cycle of temporary accounts and conduct risk monitoring to assist operation and maintenance personnel in managing temporary accounts. SUMMARY

[0003] In order to overcome the shortcomings of the prior art that it is difficult to detect the risk of temporary accounts, the present application provides an operation and maintenance information security management method and system based on artificial intelligence.

[0004] The technical implementation scheme of the present application is: an operation and maintenance information security management method based on artificial intelligence, comprising the following steps: S1: obtaining project metadata, project associated resource information and temporary account attribute information; S2: processing the project metadata and the project associated resource information using natural language processing technology to obtain project task data and project task associated resource data; S3: based on the project task data, project task associated resource data and the temporary account attribute information, constructing a project task associated resource allocation sequence; S4: monitoring the project progress and temporary account access data in real time, allocating resources to the temporary accounts based on the project progress and the project task associated resource allocation sequence, and detecting information security risks based on the project progress, allocated resources and temporary account access data; S5: assisting the administrator in decision-making according to the project progress and information security risks.

[0005] Preferably, the obtaining the project metadata, the project associated resource information and the temporary account attribute information comprises: the project metadata comprises a project identifier, a project task description and a scheduled time node; the project associated resource information comprises resource sensitivity, resource type and resource task label; and the temporary account attribute information comprises a temporary account subject project role and a task.

[0006] Preferably, the processing the project metadata and the project associated resource information by using the natural language processing technology to obtain project task data and project task associated resource data comprises: processing the project metadata and the project associated resource information by using a knowledge extraction technology to extract entities and relationships in the project identifier, the project task description, the scheduled time node, the resource type and the resource task label; and establishing a corresponding relationship among a task entity, a time entity and a resource entity by using a semantic recognition technology, and generating the project task data containing the project task and the task scheduled start and end time and the project task associated resource data containing the task required resource according to the corresponding relationship.

[0007] Preferably, the constructing the project task associated resource allocation sequence based on the project task data, the project task associated resource data and the temporary account attribute information comprises: matching the corresponding project task, the task scheduled start and end time and the task required resource from the project task data and the project task associated resource data according to the temporary account subject project role and the task; calculating a resource scheduled allocation time based on the task scheduled start and end time and the task required resource; and constructing the project task associated resource allocation sequence for the temporary account based on the project task, the task required resource and the resource scheduled allocation time.

[0008] Preferably, the real-time monitoring the project progress and the temporary account access data, and allocating resources for the temporary account based on the project progress and the project task associated resource allocation sequence comprises: obtaining a project task actual start and end time and a resource non-recovery time length according to the project progress; dynamically adjusting the resource scheduled allocation time based on the project task actual start and end time to obtain a resource actual allocation time; and allocating corresponding resources for the temporary account based on the project task associated resource allocation sequence and the resource actual allocation time.

[0009] Preferably, the detecting an information security risk based on the project progress, the allocated resources and access data comprises: calculating an information security risk score based on the project progress, the allocated resources and the access data in a preset period; and detecting the information security risk by comparing the information security risk score with a preset threshold, wherein the access data comprises access abnormal times, total access times and actual access resource quantity.

[0010] Preferably, the information security risk score is calculated based on the project progress, allocated resources and temporary account access data within a preset period, comprising: obtaining the required resource quantity, allocated resource quantity and resource sensitivity according to the project progress and allocated resources, and calculating the information security risk score by an information security risk score formula after normalization of the resource non-recovery duration, access abnormality times, total access times and actual access resource quantity, the information security risk score formula being: ; In the formula, is the information security risk score, is the resource sensitivity, is the allocated resource quantity, is the actual access resource quantity, is the required resource quantity, is the access abnormality times, is the total access times, is the resource non-recovery duration, 、 and are weight coefficients, is a duration adjustment coefficient.

[0011] Preferably, the information security risk score is compared with a preset threshold to detect the information security risk, comprising: if the information security risk score is greater than or equal to the preset threshold, there is an information security risk, and if the information security risk score is less than the preset threshold, it is normal.

[0012] Preferably, the information security risk score is compared with a preset threshold to detect the information security risk, comprising: if the information security risk score is greater than or equal to the preset threshold, there is an information security risk, and if the information security risk score is less than the preset threshold, it is normal.

[0013] An operation and maintenance information security management system based on artificial intelligence, comprising: a data acquisition module: obtaining project metadata, project associated resource information and temporary account attribute information; a data processing module: processing the project metadata and the project associated resource information by using natural language processing technology to obtain project task data and project task associated resource data; an allocation sequence construction module: constructing a project task associated resource allocation sequence based on the project task data, project task associated resource data and the temporary account attribute information; A security risk monitoring module: monitoring a project process and temporary account access data in real time, allocating resources for a temporary account based on the project process and a project task associated resource allocation sequence, and detecting information security risks based on the project process, allocated resources and temporary account access data; An auxiliary decision-making module: assisting an administrator in decision-making according to the project process and information security risks.

[0014] The present application has the following advantages: The present application analyzes project metadata through natural language processing technology, accurately associates temporary accounts, project tasks and required resources, and dynamically adjusts resource allocation strategies based on real-time project processes. After the project is completed, the administrator is reminded to perform the account cancellation or permission recovery process, avoiding the security risks caused by account residues due to manual management lag or forgetfulness, and improving the management efficiency.

[0015] The present application can accurately and real-timely evaluate the risk level of each temporary account by comprehensively quantifying information security risks. The administrator is timely warned, active early warning and intelligent decision support for information security risks are realized, and scientific and intuitive data support is provided for security management decisions. BRIEF DESCRIPTION OF DRAWINGS

[0016] Figure 1 The present application is based on an artificial intelligence-based operation and maintenance information security management method flowchart; Figure 2 The present application is based on an artificial intelligence-based operation and maintenance information security management system structure diagram. DETAILED DESCRIPTION

[0017] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0018] Embodiment 1: an artificial intelligence-based operation and maintenance information security management method, as shown in Figure 1 The method comprises the following steps: S1: obtaining project metadata, project associated resource information and temporary account attribute information; The project metadata comprises a project identifier, a project task description and a scheduled time node. The project associated resource information comprises resource sensitivity, resource type and resource task label. The temporary account attribute information comprises a temporary account subject project role and a task.

[0019] It needs to be further explained that in the specific implementation of step S1, the necessary information data is obtained from multiple data sources within the enterprise. These data sources include project management platforms, configuration management databases CMDB, and identity access management systems. The obtained project metadata specifically includes project identifiers for uniquely distinguishing different projects, project task descriptions detailing the specific work content of the projects, and estimated time nodes of key activities determined by project plans. At the same time, the obtained project-related resource information covers the attributes of various resources in the enterprise IT environment, including resource sensitivity indicating the importance and confidentiality level of the resources, resource types distinguishing the forms and functions of the resources, and resource task tags identifying which specific project tasks the resources are assigned to. The attributes of temporary accounts created for the project are obtained, and these temporary account attribute information explicitly records the project roles assumed by each temporary account in the project and the specific tasks authorized to be completed.

[0020] S2: processing the project metadata and the project-related resource information using natural language processing technology to obtain project task data and project task-related resource data; The knowledge extraction technology is used to process the project metadata and the project-related resource information, extract entities and relationships in the project identifier, project task description, estimated time node, resource type, and resource task tag, use semantic recognition technology to establish the corresponding relationship between task entities, time entities, and resource entities, and generate project task data containing project tasks and task estimated start and end times and project task-related resource data containing resources required by the tasks.

[0021] It needs to be further explained that in the specific implementation of step S2, the knowledge extraction technology is used to analyze the original text information, and the processing objects cover the project identifier, project task description, estimated time node in the project metadata, and resource type and resource task tag in the project-related resource information. Through entity recognition and relationship extraction algorithms, key entities and semantic relationships between entities are accurately extracted from these unstructured texts. For example, specific task entities are identified from project task descriptions, time entities are parsed from estimated time nodes, and resource entities are associated from resource task tags. Then, semantic recognition technology is used to perform deeper semantic analysis and association on the extracted entities. By analyzing the meanings of entities in the context and their dependency relationships, accurate corresponding relationships between task entities, time entities, and resource entities are established. For example, a specific task entity is bound to start and end time entities, and the task entity is associated with one or more supporting resource entities.

[0022] According to the correspondence between the entities established in the above steps, two kinds of structured output data are automatically generated. One is project task data, which clearly contains each project task identified and the expected start and end time of each task determined through semantic analysis. The other is project task associated resource data, which lists in detail the necessary resources required for completing each specific project task. This process realizes the transformation from unstructured or semi-structured raw project information to structured data for computer accurate processing and decision-making, providing a core basis for subsequent construction of resource allocation sequence.

[0023] S3: Based on the project task data, project task associated resource data and the temporary account attribute information, a project task associated resource allocation sequence is constructed. According to the temporary account subject project role and task, the corresponding project task, task expected start and end time and task required resources are matched from the project task data and the project task associated resource data, the resource expected allocation time is calculated based on the task expected start and end time and the task required resources, and the project task associated resource allocation sequence is constructed for the temporary account based on the project task, task required resources and resource expected allocation time.

[0024] It needs to be further explained that in the specific implementation of step S3, the key operation of constructing the project task associated resource allocation sequence is performed. Based on the project task data and project task associated resource data generated in step S2, and integrating the temporary account attribute information obtained in step S1 as input. Analyze the temporary account attribute information, extract the explicitly specified temporary account subject project role and task, and this information is used as the core matching basis. Then, the above role and task are compared and mapped with each project task recorded in the project task data, so as to match one or more corresponding project tasks that the temporary account should participate in. After successfully matching the corresponding project task, two data extraction operations are performed: first, the task expected start and end time planned in advance for these project tasks is obtained from the project task data; second, according to the determined project task, the task required resources necessary for completing each task are retrieved and obtained from the project task associated resource data, and the resource information usually includes resource identification and attributes. After obtaining the above information, based on the task expected start and end time and combined with the characteristics of the task required resources and the security policy requirements, a resource expected allocation time is calculated. The resource expected allocation time is usually set to a reasonable advance amount before the task expected start time, to ensure that the permissions are ready before the task starts. Using the results obtained by the foregoing steps, a complete and structured project task associated resource allocation sequence is constructed for the temporary account. Specifically, it contains three core elements: the matched and confirmed project task, the task required resource list corresponding to the project task, and the calculated resource expected allocation time. Through the construction of this sequence, the account, task, resource and time point are accurately associated and automatically arranged, which lays a solid foundation for dynamic resource allocation and risk monitoring in the subsequent steps.

[0025] S4: Real-time monitoring of project progress and temporary account access data, allocating resources for temporary accounts based on the project progress and the project task associated resource allocation sequence, detecting information security risks based on the project progress, allocated resources and temporary account access data; According to the project progress, the project task actual start and end time and the resource unrecycled time length are obtained, the resource expected allocation time is dynamically adjusted based on the project task actual start and end time, the resource actual allocation time is obtained, and the corresponding resources are allocated for the temporary account based on the project task associated resource allocation sequence and the resource actual allocation time.

[0026] Based on the project progress, allocated resources and access data in a preset period, an information security risk score is calculated, the information security risk score is compared with a preset threshold to detect information security risks, and the access data includes access exception times, total access times and actual access resource quantity.

[0027] According to the project process and the allocated resources, the required resource quantity of the current task, the allocated resource quantity and the resource sensitivity are obtained, and the information security risk score is calculated through the information security risk score formula after normalization of the resource non-recovery duration, the access abnormality times, the total access times and the actual access resource quantity. ; In the formula, is the information security risk score, is the resource sensitivity, is the allocated resource quantity, is the actual access resource quantity, is the required resource quantity of the current task, is the access abnormality times, is the total access times, is the resource non-recovery duration, , and are weight coefficients, is a duration adjustment coefficient.

[0028] If the information security risk score is greater than or equal to a preset threshold, there is an information security risk, and if the information security risk score is less than the preset threshold, it is normal.

[0029] It should be further explained that in the specific implementation of step S4, two core data sources are monitored in real time: one is the real-time project process data obtained from the project management tool or the workflow engine; and the other is the temporary account access data collected from various servers, application systems and security logs.

[0030] According to the real-time monitoring of the project progress, two key time information are obtained: the actual start and end time of the project task and the resource unrecovered duration. The actual start and end time of the project task reflects the real start and end time of the task. The resource unrecovered duration is calculated by continuously comparing the actual end time of the project task with the current time to obtain the duration of the completed project task, and the maximum project task duration of the unrecovered resources in the completed project task is taken as the resource unrecovered duration, which represents the duration of the related resources not being recovered in time after the task is completed. Then, the actual start and end time of the project task is used to dynamically calibrate and adjust the resource allocation time calculated in step S3. If the actual start time of the project task is delayed, the resource allocation time is also delayed correspondingly to ensure that the permission allocation and the task start time are consistent. If the actual start time of the project task is ahead of schedule, the resource allocation time is also advanced correspondingly. After the adjustment calculation, the final actual allocation time of the resource is output. This adjustment process aims to keep the resource allocation time point synchronized with the actual progress of the project task. The application programming interface of the identity management and access control system is called to allocate the required resources to the temporary account according to the actual allocation time of the resource, realizing the accurate matching of resource supply and project real progress.

[0031] At the same time of completing the resource allocation, information security risk detection is performed in parallel. Based on a preset period, such as every hour, the project progress, allocated resources and access data collected in the period are integrated and analyzed. First, according to the real-time project progress and the allocated resources, a plurality of key input variables for risk quantification are obtained, including the number of resources required for the current task, the number of allocated resources allocated to the account and the resource sensitivity of these resources. Then, the information security risk score is calculated in combination with the resource unrecovered duration, the number of access exceptions, the total number of accesses and the actual number of accessed resources. The number of access exceptions is the number of access behaviors with abnormal access time, abnormal IP address and multiple failed logins. These heterogeneous raw data are normalized to eliminate the dimension effect. The processed data are substituted into a specially designed information security risk score formula for calculation. The weight coefficient and time adjustment coefficient in the formula can be set according to the actual needs of the enterprise. After calculating the information security risk score, it is compared with a preset security threshold. The preset threshold is obtained through historical data or expert experience and can be manually adjusted according to the enterprise security policy and compliance requirements. If the calculated information security risk score is greater than or equal to the preset threshold, it is determined that there is an information security risk at present. Otherwise, if the information security risk score is less than the preset threshold, it is determined that the current state is normal. This determination mechanism realizes the quantitative identification and automatic diagnosis of potential risks in the use process of the temporary account, providing accurate basis for subsequent decision-making.

[0032] S5: assisting the administrator to make decisions according to the project process and information security risks.

[0033] If there is an information security risk, an alarm is given and a temporary account is submitted to the administrator for processing, and the administrator is reminded to process the expired temporary account according to the project process.

[0034] It should be further explained that in the specific implementation of step S5, according to the project process obtained by continuous monitoring and the information security risk result determined in step S4, the final decision assistance function is executed to provide accurate operation guidance for the administrator. If it is determined that there is an information security risk based on the comparison result of the information security risk score, an alarm process is started. By integrating the enterprise internal communication platform, the security administrator is sent information containing risk details. At the same time, the identity information of the high-risk temporary account and the associated risk context data are automatically generated into a processing work order and submitted to the administrator for processing, and the processing suggestions include freezing the account, forced offline or initiating permission audit. According to the real-time project process data, the status of each temporary account and the associated project is automatically tracked. By comparing the actual start and end time of the project task or the expected time node of the project plan, those expired temporary accounts associated with projects that have ended or tasks that have been completed are intelligently identified. For these expired temporary accounts, clear management reminder information is generated, and the administrator is reminded to process through a pre-defined operation process interface. The processing method usually includes notifying the account responsible person to confirm the permission status or executing the automatic cancellation process. Through the above two core operations, the closed-loop intelligent management of the temporary account life cycle is realized, which liberates the administrator from tedious manual review and tracking work, and improves the pre-warning ability and post-processing efficiency of enterprise information security management.

[0035] Embodiment 2: Based on embodiment 1, an operation and maintenance information security management system based on artificial intelligence, as shown in Figure 2 , comprises: a data collection module for obtaining project metadata, project associated resource information and temporary account attribute information; a data processing module for processing the project metadata and the project associated resource information using natural language processing technology to obtain project task data and project task associated resource data; an allocation sequence construction module for constructing a project task associated resource allocation sequence based on the project task data, the project task associated resource data and the temporary account attribute information; a security risk monitoring module for monitoring the project process and the temporary account access data in real time, allocating resources to the temporary account based on the project process and the project task associated resource allocation sequence, and detecting information security risks based on the project process, the allocated resources and the temporary account access data; Assistant decision module: assisting the administrator to make decisions according to the project process and information security risks.

[0036] Finally, it should be noted that the above only for the preferred embodiments of the present application, and is not intended to limit the present application, although the foregoing embodiments of the present application has been described in detail, for those skilled in the art, the foregoing embodiments of the technical solutions recorded can be modified, or the equivalent replacement of part of the technical features, within the spirit and principles of the present application, any modification, equivalent replacement, improvement, etc., should be included within the scope of the present application.

Claims

1. An artificial intelligence-based operation and maintenance information security management method, characterized in that, The method comprises the following steps: S1: obtaining project metadata, project associated resource information and temporary account attribute information; S2: processing the project metadata and the project associated resource information by using natural language processing technology to obtain project task data and project task associated resource data; S3: constructing a project task associated resource allocation sequence based on the project task data, the project task associated resource data and the temporary account attribute information; S4: monitoring a project progress and temporary account access data in real time, allocating resources for the temporary account based on the project progress and the project task associated resource allocation sequence, and detecting information security risks based on the project progress, the allocated resources and the temporary account access data; S5: assisting an administrator in decision-making according to the project progress and the information security risks.

2. The operation and maintenance information security management method based on artificial intelligence according to claim 1, characterized in that, The project metadata comprises a project identifier, a project task description and a scheduled time node, the project associated resource information comprises resource sensitivity, resource type and resource task label, and the temporary account attribute information comprises a temporary account subject project role and a task. 3.The method of claim 1, wherein, The project metadata and the project associated resource information are processed by using knowledge extraction technology to extract entities and relationships in the project identifier, the project task description, the scheduled time node, the resource type and the resource task label, semantic recognition technology is used to establish a corresponding relationship among task entities, time entities and resource entities, and the corresponding relationship is used to generate project task data containing project tasks and task scheduled start and end times and project task associated resource data containing task required resources.

4. The operation and maintenance information security management method based on artificial intelligence according to claim 1, characterized in that, The project task data, the project task associated resource data and the temporary account attribute information are used to construct a project task associated resource allocation sequence, which comprises matching corresponding project tasks, task scheduled start and end times and task required resources from the project task data and the project task associated resource data according to the temporary account subject project role and the task, calculating resource scheduled allocation time based on the task scheduled start and end times and the task required resources, and constructing a project task associated resource allocation sequence for the temporary account based on the project tasks, the task required resources and the resource scheduled allocation time.

5. The operation and maintenance information security management method based on artificial intelligence according to claim 1, characterized in that, The project progress and the temporary account access data are monitored in real time, and resources are allocated for the temporary account based on the project progress and the project task associated resource allocation sequence, which comprises obtaining project task actual start and end times and resource unrecovered time length according to the project progress, dynamically adjusting the resource scheduled allocation time based on the project task actual start and end times to obtain resource actual allocation time, and allocating corresponding resources for the temporary account based on the project task associated resource allocation sequence and the resource actual allocation time.

6. The operation and maintenance information security management method based on artificial intelligence according to claim 1, characterized in that, The information security risk is detected based on the project process, the allocated resources and the access data, including: calculating an information security risk score based on the project process, the allocated resources and the access data in a preset period, comparing the information security risk score with a preset threshold to detect the information security risk, and the access data including the number of access anomalies, the total number of accesses and the number of actually accessed resources.

7. The operation and maintenance information security management method based on artificial intelligence according to claim 6, characterized in that, The information security risk score is calculated based on the project process, the allocated resources and the temporary account access data in the preset period, including: obtaining the number of resources required for the current task, the number of allocated resources and the resource sensitivity according to the project process and the allocated resources, and calculating the information security risk score through an information security risk score formula after normalization of the resource unrecovered duration, the number of access anomalies, the total number of accesses and the number of actually accessed resources, and the information security risk score formula being: ； In the formula, is the information security risk score, is the resource sensitivity, is the allocated resource quantity, is the actual accessed resource quantity, is the required resource quantity for the current task, is the number of access exceptions, is the total number of accesses, is the resource non-recovery duration, , and is the weight coefficient, is the duration adjustment coefficient.

8. The operation and maintenance information security management method based on artificial intelligence according to claim 6, characterized in that, The information security risk score is compared with the preset threshold to detect the information security risk, including: if the information security risk score is greater than or equal to the preset threshold, there is an information security risk, and if the information security risk score is less than the preset threshold, it is normal.

9. The operation and maintenance information security management method based on artificial intelligence according to claim 8, characterized in that, The administrator is assisted in decision-making according to the project process and the information security risk, including: if there is an information security risk, an alarm is given and the temporary account is submitted to the administrator for processing, and the administrator is reminded to process the expired temporary account according to the project process.

10. An artificial intelligence-based operation and maintenance information security management system for implementing the artificial intelligence-based operation and maintenance information security management method of any one of claims 1-9. Including: The data acquisition module acquires project metadata, project associated resource information and temporary account attribute information; The data processing module processes the project metadata and the project associated resource information using natural language processing technology to obtain project task data and project task associated resource data; The allocation sequence construction module constructs a project task associated resource allocation sequence based on the project task data, the project task associated resource data and the temporary account attribute information; The security risk monitoring module monitors the project process and the temporary account access data in real time, allocates resources to the temporary account based on the project process and the project task associated resource allocation sequence, and detects the information security risk based on the project process, the allocated resources and the temporary account access data; The auxiliary decision-making module assists the administrator in decision-making according to the project process and the information security risk.

Images