Computer information security protection system and method

Abstract

The invention relates to the technical field of computer information security protection, and discloses a computer information security protection system and method. The system comprises the following steps: constructing a security entity network topology by extracting a behavior link in a security entity operation state mirror image; performing behavior simulation on entities in the topology, identifying a potential abnormal behavior mode and mapping the potential abnormal behavior mode into a security threat evolution path with a timestamp; according to the path, generating a security protection strategy chain executed in sequence, loading the security protection strategy chain to a topology to trigger a corresponding protection action, and synchronously collecting result data; and finally, associating the data with the threat path, and segmenting and storing the data and the threat path in different physical units. According to the system, a dynamic collaborative defense network can be constructed from entity behavior association, a complete threat path is deduced to realize predictive ordered protection, and meanwhile, safe storage and traceability of data in the protection process are guaranteed.

Description

Technical Field

[0001] This invention relates to the field of computer information security protection technology, specifically to computer information security protection systems and methods. Background Technology

[0002] Existing computer security systems, such as antivirus software, intrusion detection systems, or security information and event management platforms, primarily rely on predefined rule bases or known threat signatures for matching and detection, as well as real-time monitoring and alerting of network traffic and system logs. These technical solutions treat security entities as isolated individuals, and their protection logic is based on static policy configurations or the analysis of discrete events. The interaction between security devices and protected entities usually requires manual pre-setting or is limited to simple alarm reporting, lacking automated collaborative defense mechanisms based on the inherent behavioral relationships between entities.

[0003] At the threat identification and response level, existing technologies focus on capturing fragments of attack behavior that have already occurred or conform to specific patterns. These technologies struggle to depict the complete evolution of a threat within a system, from initial intrusion and lateral movement to achieving its goal. Detection results are often fragmented alert events, unable to reconstruct the temporal logic and contextual relationships of the attack chain. As a result, defensive actions are often delayed and reactive, only able to be remedied after the threat becomes explicit, unable to provide predictive intervention in the early or middle stages of threat evolution.

[0004] This invention addresses the problem of how to automatically discover dynamic behavioral relationships between security entities from the system's operational status, and how to construct a collaborative protection network based on this. Simultaneously, it addresses how to proactively deduce the complete development path of potential threats, providing a basis for precise and orderly pre-deployment before threats cause actual damage. Summary of the Invention

[0005] The purpose of this invention is to provide a computer information security protection system and method to solve the problems mentioned in the background art.

[0006] To achieve the above objectives, the present invention provides a computer information security protection system, the system comprising: The security entity network topology construction module is used to obtain the operational status image of all security entities in the computer information system, extract the behavioral links related to security protection from the operational status image, and generate a security entity network topology composed of multiple interconnected security entities based on the behavioral links. The security threat behavior simulation module is used to simulate the operational status image of each security entity in the security entity network topology, identify potential abnormal behavior patterns of each security entity, and map the potential abnormal behavior patterns into security threat evolution paths with timestamps. The security protection strategy chain generation module is used to receive and parse the security threat evolution path, and generate a security protection strategy chain containing multiple sequentially executed protection actions based on the temporal relationship of potential abnormal behavior patterns in the security threat evolution path. The security policy execution and data scheduling module is used to load the security protection policy chain onto the security entity network topology, so that the security protection policy chain sequentially triggers protection actions on the corresponding security entities, and synchronously collects the protection result data generated during the execution of the protection actions; The security information distributed storage module is used to receive protection result data, associate and mark the protection result data with the security threat evolution path, divide the protection result data that has completed association and marking into multiple data blocks, and schedule multiple data blocks to different physical storage units for storage.

[0007] Preferably, the specific process of extracting the behavior links associated with security protection from the running state image is as follows: Analyze the network connection request sequence and system call sequence of each security entity recorded in the running status image, filter out the connection records pointing to preset key service ports from the network connection request sequence, and filter out the operation records involving preset sensitive files or registry entries from the system call sequence; The selected connection records and operation records are cross-arranged and merged according to timestamp order to form a behavior sequence containing mixed events of network connection and system operation; In the behavior sequence, a network connection request is taken as the starting event. Subsequent system operation events that have logical dependencies on it within a preset time window are searched. All starting events with logical dependencies are connected with subsequent events to form an independent behavior chain.

[0008] Preferably, the specific process of generating a security entity network topology composed of multiple interconnected security entities based on behavioral links is as follows: Treat all security entities appearing in each behavioral link as network nodes; The behavioral dependencies between security entities in the behavioral chain are defined as directed edges connecting the corresponding network nodes, with the direction of the directed edges pointing from the security entity initiating the behavior to the security entity receiving the behavior. By statistically analyzing the network nodes and directed edges in all behavioral links, and aggregating all network nodes and directed edges, a mesh structure reflecting the behavioral interaction relationships between security entities is drawn. This mesh structure is the security entity network topology.

[0009] Preferably, the specific process of simulating the operational state mirrors of each security entity in the security entity network topology is as follows: Obtain historical normal behavior samples of the target security entity in the network topology of the security entity, wherein the historical normal behavior samples include the baseline patterns of the target security entity in terms of network communication and system resource access. At the current point in time, inject a runtime image of the target security entity into an isolated sandbox environment; Drive the target security entity in the sandbox environment to run, and simulate stimuli to the target security entity according to a variety of predefined attack behavior templates in the security threat signature library, and record the operational feedback generated by the target security entity under various stimuli; The operational feedback of the target security entity is compared with the corresponding historical normal behavior sample. If the operational feedback deviates from the historical normal behavior sample by more than a preset deviation threshold, the simulated stimulus and the resulting operational feedback combination are recorded as a potential abnormal behavior pattern.

[0010] Preferably, the process of mapping potential abnormal behavior patterns to security threat evolution paths with timestamps is as follows: Extract the occurrence time of the simulated stimulus in the potential abnormal behavior pattern and use it as the initial timestamp of the potential abnormal behavior pattern; Analyze the network topology of security entities to locate the security entities involved in the potential abnormal behavior patterns within the network; Starting from the potential abnormal behavior pattern, based on the directed edge connection relationship in the security entity network topology, the timing process of the potential abnormal behavior pattern propagating to adjacent security entities is simulated, and the delay time required for the behavior pattern to propagate to each adjacent security entity is estimated. By combining the initial timestamp and the estimated delay time, a simulated timestamp is assigned to each node in the behavior pattern propagation path, thereby generating a security threat evolution path that describes the possible propagation path and time nodes of potential abnormal behavior patterns in the secure entity network topology.

[0011] Preferably, the process of generating a security protection strategy chain containing multiple sequentially executed protective actions based on the temporal relationship of potential abnormal behavior patterns in the security threat evolution path is as follows: Analyze the evolution path of security threats and obtain multiple potential abnormal behavior pattern nodes sorted by simulated timestamps; For the node with the highest potential abnormal behavior pattern, a blocking and isolation action that matches the behavior characteristics of the node with the highest potential abnormal behavior pattern is called from the protection action library as the starting protection action of the security protection strategy chain. For each subsequent node with a potential abnormal behavior pattern, a detection and containment action matching the behavior characteristics of the node is called from the protection action library. The execution trigger condition of the detection and containment action is set to the completion of the previous protection action and the reporting of a specific status signal. This allows multiple protection actions to be linked sequentially in reverse order according to the evolution path of the security threat, forming a security protection strategy chain.

[0012] Preferably, the process of loading the security protection policy chain into the security entity network topology is as follows: The initial protection actions of the security protection strategy chain are sent to the actual security entities corresponding to the nodes of the most likely abnormal behavior patterns in the security threat evolution path. The initial protection action is executed on the actual security entity. After the initial protection action is completed and a status completion report is generated, the status completion report is matched with the triggering condition of the next protection action in the security protection strategy chain. If a match is successful, the next protection action in the security protection strategy chain will be sent to the actual security entity corresponding to the next protection action, and all protection actions in the security protection strategy chain will be triggered in sequence according to this process.

[0013] Preferably, the process of synchronously collecting the protection result data generated during the execution of the protection action is as follows: When each protective action is issued to the corresponding actual security entity, a data probe is deployed on the actual security entity. The data probe captures in real time the system log change records, network traffic filtering records, and process status snapshots of the actual security entity during the execution of protection actions. All captured system log change records, network traffic filtering records, and process state snapshots are packaged to generate a protection result data packet corresponding to the protection actions.

[0014] Preferably, the system further includes: The storage strategy optimization module manages multiple physical storage units and optimizes the data block scheduling strategy of the security information distributed storage module. The specific process is as follows: Periodically poll the current storage pressure index and health status indicators of each physical storage unit; Receive a data block storage request from the security information distributed storage module, wherein the data block storage request contains the data feature identifier of the data block to be stored; Based on the data feature identifier of the data block to be stored, the system matches the historical storage mode and combines the current storage pressure index and health status index of each physical storage unit to calculate an optimal target physical storage unit identifier for the current data block to be stored, and returns the target physical storage unit identifier to the security information distributed storage module.

[0015] Preferably, the present invention also includes a computer information security protection method, the method comprising all the modules and method flow of the computer information security protection system described above.

[0016] Compared with the prior art, the beneficial effects of the present invention are: By acquiring the operational state image of all security entities and extracting their behavioral links, a security entity network topology is generated based on these behavioral relationships. This approach moves beyond the traditional view of assets as independent nodes, revealing the dynamic connections that may form between entities due to normal business interactions or potential attacks. The protection system can be organized based on the real behavioral dependencies between entities, enabling defensive actions to be transmitted and coordinated along behavioral links. This changes the previous situation where each security component operated in isolation, forming a dynamic defense surface based on entity relationships.

[0017] Behavioral simulations are performed on the operational state mirrors of each entity in the constructed secure entity network topology to identify potential anomalous behavioral patterns. These patterns are then mapped to timestamped security threat evolution paths. This technique simulates the possible development trajectories of threats within identified interconnected networks, stringing together discrete anomalous indicators into a logically and temporally sequential continuous attack storyline. Defense strategies can therefore be designed based on the complete context and key time nodes of threat evolution, ensuring that the triggering sequence of protective actions matches the stages of threat progression. This achieves a shift from responding to already occurred events to intervening in potential, coherent attack chains. Attached Figure Description

[0018] Figure 1 This is a schematic diagram of the working principle of the computer information security protection system described in this invention; Figure 2 A flowchart for generating a secure entity network topology based on behavioral links; Figure 3 A flowchart for mapping potential anomalous behavior patterns to timestamped security threat evolution paths; Figure 4 A chart showing the completion rate of the protection strategy execution sequence; Figure 5 A comparison chart of multi-dimensional performance indicators before and after storage strategy optimization. Detailed Implementation

[0019] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0020] Please see Figure 1 This invention provides a computer information security protection system, comprising: a security entity network topology construction module that captures the state of all security entities in the computer information system and obtains their operational state images; then, it deeply analyzes and extracts behavioral sequences closely related to security protection from these images, especially complex behavioral links intertwined with network connections and system calls; based on these behavioral links, the system can depict a dynamic network topology diagram based on actual behavioral dependencies between security entities. A security threat behavior simulation module operates on this topology. It injects and drives the images of security entities in a controlled sandbox environment and simulates stimuli using preset attack behavior templates, thereby identifying potential abnormal behavioral patterns that each security entity may exhibit when subjected to different stimuli, deviating from its historical normal baseline; these patterns are further mapped onto the previously constructed network topology, simulating the temporal process of their diffusion along the inter-entity connection relationships, thus forming a security threat evolution path with simulated timestamps, which predicts the possible development direction and key time nodes of the threat.

[0021] The security protection strategy chain generation module receives and parses this path. Based on the simulated temporal relationship of potential abnormal behavior patterns in the path, it intelligently matches and strings together a series of protection actions from the protection action library. These actions are organized in reverse order of threat evolution, generating a logically interlocking and sequentially triggerable security protection strategy chain. After generating the strategy chain, the security policy execution and data scheduling module is responsible for loading and deploying it into the real security entity network topology. This module accurately sends each protection action in the strategy chain to its corresponding target security entity and controls them to execute sequentially according to preset trigger conditions. During this process, the module synchronously collects various protection result data generated during the execution of each protection action through deployed data probes. The security information distributed storage module is responsible for processing this result data. It associates and marks the collected protection result data with the security threat evolution path that initially triggered this protection decision, establishing a complete causal tracing chain. The module divides this associated data into multiple data blocks and intelligently schedules these data blocks to different physical storage units for distributed storage based on the real-time storage resource status.

[0022] Example 1: See Figure 2 In its implementation, the secure entity network topology construction module follows a rigorous data processing procedure when processing the runtime state image of all secure entities in the computer information system. The runtime state image, a snapshot containing the memory, processes, network connections, and system calls of a secure entity at a specific moment, forms the basis for behavioral analysis. The secure entity network topology construction module analyzes the network connection request sequences and system call sequences recorded in the runtime state image for each secure entity. The network connection request sequences record all network communication events initiated or received by the secure entity, including source address, destination address, port, and timestamp. The system call sequences record all resource access requests initiated by the secure entity to the operating system kernel, such as file read / write and process creation. The secure entity network topology construction module filters connection records pointing to preset critical service ports from the network connection request sequences. These preset critical service ports are predefined by the security administrator and typically include default database ports, remote management protocol ports, and ports for critical business applications. The secure entity network topology construction module filters out operation records involving preset sensitive files or registry entries from the system call sequence. These preset sensitive files or registry entries are also predefined by policies and cover system password files, security configuration directories, and startup item registry paths.

[0023] In practical implementation, the secure entity network topology construction module merges the selected connection records and operation records to build a unified event timeline. This module cross-sorts and merges the selected connection records pointing to preset critical service ports and operation records involving preset sensitive files or registry entries according to their timestamps, forming a single behavioral sequence. This behavioral sequence is a strictly timestamped list of events, where network connection events and system operation events appear alternately or consecutively. Within this sequence, the module uses a network connection request to a preset critical service port as the starting event and searches for subsequent system operation events that have a logical dependency on it within a preset time window. The preset time window is a configurable time length parameter used to limit the timeliness of event associations. The determination of logical dependencies is based on the process identifier, thread identifier, and inheritance relationship of accessed resources. For example, it determines whether a file access event occurring after a network connection event within the same process context is a subsequent behavior triggered by that connection. The secure entity network topology construction module connects all logically dependent initial network connection events with a series of subsequent system operation events to form an independent behavioral chain. Each behavioral chain depicts a potential attack chain from external network probing to internal system actions.

[0024] In practical implementation, the secure entity network topology construction module constructs a mesh topology reflecting the interaction relationships between secure entities based on the extracted set of behavioral links. This module treats all secure entities appearing in each behavioral link as network nodes. A network node is the basic unit of the topology, representing an independently identifiable secure entity within a computer information system. The module defines the behavioral dependencies between secure entities in the behavioral links as directed edges connecting the corresponding network nodes. Directed edges have a clear direction, pointing from the secure entity node initiating the behavior to the secure entity node receiving the behavior, reflecting the direction of the behavior. The module then statistically analyzes the network nodes and directed edges in all behavioral links, aggregating them to draw a mesh structure reflecting the behavioral interaction relationships between secure entities. The aggregation process merges duplicate network nodes corresponding to the same secure entity and merges or superimposes directed edges that connect the same node pairs in the same direction. The final mesh structure drawn is the secure entity network topology. The secure entity network topology is a graph structure with secure entities as nodes and behavioral dependencies as directed edges. It is abstracted from actual network and system interactions and serves as the basic framework for subsequent threat simulation and analysis.

[0025] Example 2: See Figure 3 In practical implementation, the security threat behavior simulation module simulates the operational state images of each security entity in the security entity network topology. The module acquires historical normal behavior samples of the target security entity in the network topology, including baseline patterns of network communication and system resource access. The baseline network communication pattern includes the set of destination addresses, ports, connection frequency, and data traffic characteristics of network connections established by the target security entity within the historical observation period. The baseline system resource access pattern includes the set of system functions called, file paths accessed, and registry entries read by the target security entity within the historical observation period, along with their call timing and frequency characteristics. At the current point in time, the security threat behavior simulation module injects the operational state image of the target security entity into an isolated sandbox environment. The isolated sandbox environment is a virtualization container logically isolated from the production network and possessing complete operating system interface simulation. Injecting the operational state image of the target security entity means completely restoring the target security entity's memory state, process context, open file handles, and network socket state to a corresponding virtual instance within the sandbox environment. The security threat behavior simulation module drives the target security entity to run in the sandbox environment. The driving process involves restoring the execution thread of the target security entity and simulating the basic environmental input required for its operation, so that the target security entity enters an active state in the sandbox that can respond to external events.

[0026] In its implementation, the security threat behavior simulation module simulates stimuli applied to a target security entity according to various predefined attack behavior templates in the security threat signature database. The security threat signature database is a dataset containing structured attack behavior descriptions; each attack behavior template defines a specific attack method, such as "executing arbitrary code using a buffer overflow vulnerability," "delivering malicious payloads via phishing email attachments," or "attempting brute-force attacks using weak passwords." The process of simulating stimulus application involves the security threat behavior simulation module sending network packets conforming to the attack behavior template definitions to a virtual instance of the target security entity in a sandbox network environment, or performing modification operations conforming to the attack behavior template definitions on the process memory or file system of the target security entity's virtual instance in the sandbox system environment. The security threat behavior simulation module records the operational feedback generated by the target security entity under various stimuli. This operational feedback consists of all observable behavioral changes exhibited by the target security entity's virtual instance in the sandbox environment after being subjected to simulated stimuli, including changes in newly created network connections, newly started processes, read / write operation sequences on the sandbox file system, modification operation sequences on the sandbox registry, and system call sequences relative to the baseline pattern. The security threat behavior simulation module compares the operational feedback of the target security entity with corresponding historical normal behavior samples. This comparison involves calculating the distance or difference between the operational feedback and historical normal behavior samples in a multi-dimensional feature space. The module presets a deviation threshold, a numerical value used to determine whether the behavioral deviation is significant. If the operational feedback deviates from the historical normal behavior samples by more than the preset deviation threshold, the module records the simulated stimulus and the resulting operational feedback as a potential abnormal behavior pattern. This potential abnormal behavior pattern is a record containing a description of the applied simulated stimulus and the specific operational feedback data of the target security entity exceeding the deviation threshold.

[0027] In some embodiments, the security threat behavior simulation module can incorporate a quantitative evaluation model to calculate the degree to which the operational feedback deviates from historical normal behavior samples. This quantitative evaluation model can be calculated using a dissimilarity function based on multivariate statistics. One form of the dissimilarity function is as follows:

[0028] in: This represents the operational feedback feature vector of the target security entity collected from a simulation. This represents the feature set of corresponding historical normal behavior samples. Each dimension in the feature vector... It represents a behavioral characteristic, such as the frequency of a particular system call or the number of bytes in a particular network connection. It is the running feedback feature vector In the Values ​​on the dimensional features. It is a feature set of historical normal behavior samples In the The arithmetic mean of all historical values ​​of the feature. It is a feature set of historical normal behavior samples In the The standard deviation of all historical values ​​for the feature. This is the first The weighting coefficients assigned to the dimensional features can be set based on the sensitivity of the feature to anomaly indications. This is the total number of dimensions of the selected behavioral features. (Function) The calculation result is the quantified difference value. The security threat behavior simulation module will use the calculated difference value... By comparing the difference value with a preset deviation threshold, the calculation of the difference value achieves an objective measurement of the degree of deviation.

[0029] In its implementation, the security threat behavior simulation module maps identified potential anomalous behavior patterns into timestamped security threat evolution paths. The module extracts the occurrence time of simulated stimuli within the potential anomalous behavior patterns as their initial timestamps. The occurrence time of the simulated stimuli is the precise moment the module triggers the attack behavior template in the sandbox environment. The module analyzes the network topology of security entities to locate the positions of the security entities involved in the potential anomalous behavior patterns within the network. This location operation involves finding the network node corresponding to the virtual instance of the security entity exhibiting the potential anomalous behavior pattern in the mesh graph of the network topology and determining which other network nodes this node is connected to via directed edges. Starting from the potential anomalous behavior pattern, the module simulates the temporal process of its propagation to adjacent security entities based on the directed edge connections in the network topology. This propagation simulation is a logical deduction; the module assumes that the anomalous behavior observed in the potential anomalous behavior pattern may affect other directly connected security entities through existing network connections or inter-process communication channels. The security threat behavior simulation module estimates the latency required for a behavior pattern to propagate to each adjacent security entity. This estimation is based on the types of edges in the network topology, the lateral movement speed of similar threats in historical attack data, and the basic configuration information of adjacent security entities. Essentially, the module combines the initial timestamp with the estimated latency to assign a simulated timestamp to each node along the behavior pattern propagation path. The rule for assigning simulated timestamps is that the timestamp of the first node (the starting point) is the initial timestamp, and the simulated timestamp of each subsequent node is equal to the simulated timestamp of its predecessor node plus the estimated latency from the predecessor node to the current node. This generates a security threat evolution path describing the possible propagation path and time nodes of a potential anomalous behavior pattern in the security entity network topology. The security threat evolution path is a sequence of nodes with temporal information; each node in the sequence contains a security entity identifier and a simulated timestamp, and the connections between nodes reflect the logical direction of threat propagation.

[0030] Example 3: In specific implementation, the security protection strategy chain generation module generates a security protection strategy chain containing multiple sequentially executed protective actions based on the temporal relationship of potential abnormal behavior patterns in the security threat evolution path. The security protection strategy chain generation module receives and parses the security threat evolution path. The parsing process involves reading the data structure of the security threat evolution path, which is a list of nodes sorted by simulation timestamps. The security protection strategy chain generation module obtains multiple potential abnormal behavior pattern nodes sorted by simulation timestamps. These potential abnormal behavior pattern nodes represent a series of key steps from the occurrence to the spread of the threat in the simulation. Each potential abnormal behavior pattern node contains a security entity identifier, a simulation timestamp, and a specific description of abnormal behavior characteristics. For the first potential abnormal behavior pattern node in the sequence, the security protection strategy chain generation module calls a blocking and isolation action from the protection action library that matches the behavioral characteristics of the potential abnormal behavior pattern node, as the starting protective action of the security protection strategy chain. The protection action library is a predefined, structured set of action rules, where each rule is associated with an executable protective operation. Blocking and isolating actions are a type of action in the protection action library, designed to quickly interrupt suspicious behavior or isolate suspicious entities, such as "blocking all inbound connections from source IP address X" or "moving host Y into an isolated network area." The matching process involves the security protection policy chain generation module comparing the behavioral characteristics described in potential abnormal behavior pattern nodes, such as "abnormal writing to sensitive registry keys HKLM\SAM," with the trigger conditions defined in each rule in the protection action library, selecting the blocking and isolating action rule whose trigger conditions best match the behavioral characteristics. In practice, the selected blocking and isolating action and its parameters are extracted and used as the first logical unit of the security protection policy chain.

[0031] In practical implementation, the security protection strategy chain generation module, for each subsequent potential abnormal behavior pattern node, calls detection and containment actions from the protection action library that match the behavioral characteristics of the potential abnormal behavior pattern node. Each subsequent potential abnormal behavior pattern node refers to all nodes in the security threat evolution path that are ordered after the starting node. Detection and containment actions are another type of action in the protection action library. These actions focus on monitoring, recording, or restricting existing or ongoing suspicious activities. Their execution intensity is usually lower than complete blocking and isolation, such as "enabling deep behavioral monitoring of process A on host Z" or "temporarily freezing the login permissions of user account U". The matching process also compares the behavioral characteristics of the potential abnormal behavior pattern node with the conditions of the rules in the protection action library. The security protection strategy chain generation module sets the execution trigger condition of the detection and containment action to the completion of the previous protection action and the reporting of a specific status signal. The execution trigger condition is a logical judgment statement that defines the prerequisite for the current protection action to be initiated and executed. The previous protection action refers to the protection action defined before the current protection action in the security protection strategy chain. A specific status signal is a clear status code or message returned by the executor after the previous protective action has been completed, such as "isolation successful" or "blocking rule has taken effect." Through this setup, multiple protective actions are linked sequentially in reverse order according to the security threat evolution path, forming a security protection strategy chain. It can be understood that the security threat evolution path describes the simulated sequence of threat spread from early nodes to later nodes, while the linking order of the security protection strategy chain is reversed. That is, it starts with actions addressing the latest simulated threat node, progressively setting its triggering based on the completion status of actions addressing earlier threat nodes, ultimately chaining towards the blocking and isolation action addressing the initial threat node. The overall logic of the security protection strategy chain is that only after a protective action against an early threat is successfully executed and a specific status is returned will protective actions against subsequent derived threats be triggered sequentially, thus forming an automated response chain that reverses the spread of threats.

[0032] In some embodiments, when organizing multiple protection actions, the security protection strategy chain generation module can introduce a dynamic priority weight calculation model to select from multiple matchable detection and containment actions, or optimize the execution order of actions in complex chains. This model can consider the severity of threat nodes, the execution cost of actions, and the expected suppression effect of actions. A method for calculating candidate detection and containment actions is also provided. For threat nodes Overall fit score The formula is as follows:

[0033] in: This indicates nodes selected from the protective action library that match potential abnormal behavior patterns. The behavioral characteristics are matched with a candidate detection and containment action based on the underlying logic. This represents a potential abnormal behavior pattern node that is ordered after the starting node in the security threat evolution path. Indicates action With nodes The behavioral feature matching score is calculated based on the semantic similarity or rule matching degree between the action triggering condition and the node behavioral feature, and the value ranges from 0 to 1. Indicates the execution of an action The normalized value of the estimated cost can include the impact on system performance, the required authorization level, or the execution time. After normalization, this value is between 0 and 1; a higher value indicates a higher cost. Therefore, it is used in the formula. This indicates a preference for low-cost actions. Indicates action The expected suppression effect score, given by historical execution data or expert rules, assesses the effectiveness of the action in curbing similar threatening behaviors, with a value ranging from 0 to 1. , , These are weighting coefficients, used to adjust the relative importance of the three factors—matching degree, cost, and suppression effect—in the final score. These weighting coefficients are configured by the system administrator based on the emphasis of the actual protection strategy. The security protection strategy chain generation module generates a chain for each threat node. Calculate all candidate actions Value, and select the action with the highest score. Add to the security protection strategy chain.

[0034] Example 4: In specific implementation, the security policy execution and data scheduling module loads the security protection policy chain into the security entity network topology. The loading process begins with mapping and distribution. The security policy execution and data scheduling module distributes the initial protection action of the security protection policy chain to the actual security entity corresponding to the highest-ranking potential abnormal behavior pattern node in the security threat evolution path. The highest-ranking potential abnormal behavior pattern node refers to the node described by the earliest simulated timestamp in the data structure of the security threat evolution path. The actual security entity is a physical or virtual computing device running in a real production environment that matches the security entity identifier identified in the potential abnormal behavior pattern node. The distribution action is the specific operation instructions and parameters of the initial protection action sent by the security policy execution and data scheduling module to the agent program running on the target actual security entity through the security management channel. On the actual security entity, the agent program receives and executes the initial protection action. The execution of the initial protection action may include calling the local firewall interface to add rules, executing an isolation script, or modifying system configuration. Once the initial protective action is completed, the agent program on the actual security entity generates a status completion report and submits it to the security policy execution and data scheduling module. The status completion report is a structured message containing the action execution result code, a list of affected objects, and a timestamp. The security policy execution and data scheduling module matches the received status completion report with the triggering conditions of the next protective action in the security protection policy chain. The triggering conditions of the next protective action in the security protection policy chain are pre-defined logical judgment statements when the chain is generated. The matching process involves the security policy execution and data scheduling module parsing the content of the status completion report and checking whether it meets all the logical conditions defined for the triggering conditions of the next protective action.

[0035] In practice, if the status completion report matches the triggering condition of the next protective action, the security policy execution and data scheduling module will issue the next protective action in the security protection policy chain to the actual security entity corresponding to the next protective action. The actual security entity corresponding to the next protective action is determined by the definition of the action in the security protection policy chain. It may be the same entity as the actual security entity that executed the initial protective action, or it may be another entity in the security entity network topology. The issuance process is consistent with the process of executing the initial protective action, involving instruction transmission, proxy execution, and status reporting. The security policy execution and data scheduling module triggers all protective actions in the security protection policy chain sequentially according to this process. This process is a cyclical logic: the security policy execution and data scheduling module issues an action, waits for and receives the status completion report after the action is executed, matches the report with the triggering condition of the next action defined in the chain, and if the match is successful, it continues to issue and trigger the next action until all protective actions defined in the security protection policy chain have been sequentially triggered and executed.

[0036] In practice, the security policy execution and data scheduling modules synchronously collect protection result data generated during the execution of protection actions. The collection process is tightly coupled with the action execution process. When each protection action is issued to the corresponding actual security entity, the security policy execution and data scheduling modules deploy a data probe on the target actual security entity. The data probe is a lightweight software data collector whose lifecycle is bound to the execution cycle of a single protection action. The data probe captures system log change records, network traffic filtering records, and process state snapshots in real time during the execution of protection actions by the actual security entity. System log change records refer to new entries related to the protection action added to the target actual security entity's operating system security logs and application logs within a certain period before and after the protection action is executed. Network traffic filtering records refer to the logs of new network data packets intercepted or allowed due to the execution of protection actions (such as adding firewall rules). Process state snapshots capture the memory usage, open handles, thread lists, and other status information of relevant processes on the target actual security entity at key nodes in the execution of protection actions. The data probe packages all captured system log change records, network traffic filtering records, and process state snapshots to generate a protection result data package corresponding to the protection action. The packaging process includes timestamp alignment, format standardization, compression, and digital signature of the data. The protection result data package is a self-contained data file used to record the execution traces and effectiveness evidence of a single protection action.

[0037] In some embodiments, the security policy enforcement and data scheduling module can dynamically adjust the data probe capture configuration based on the type of protection action. The security policy enforcement and data scheduling module maintains a mapping table between action types and data acquisition configurations. See Table 1 for a sample of this mapping.

[0038] Table 1: Mapping Table of Protective Action Types and Data Probe Acquisition Configurations

[0039] In practical implementation, when deploying data probes, the security policy execution and data scheduling module queries this mapping table based on the currently issued protection action type to load the corresponding data collection configuration for the data probes, achieving dynamic adaptation of the collection scope and granularity. Optionally, the security policy execution and data scheduling module can verify the integrity and authenticity of the protection result data packet. One verification method is to calculate the cryptographic hash value of the data packet and compare it with a trusted value. After generating the protection result data packet, the security policy execution and data scheduling module can calculate its hash value. The hash value can be calculated using the following formula:

[0040] in: This indicates the output of the calculated hash value. This represents a cryptographic hash function, such as SHA-256. This represents the core data payload in the protection result data packet, namely a collection of system log change records, network traffic filtering records, and process state snapshots. This represents a high-precision timestamp to prevent replay attacks. This represents a key shared solely by the security policy enforcement and data scheduling module and the data verification party. (Symbol) This indicates a data concatenation operation. The security policy enforcement and data scheduling module will use the calculated hash value... Attached to the metadata of the protection result data packet.

[0041] See Figure 4 The analysis of the completion rate of protection strategy execution sequence shows the changing trends of the completion rates of four types of protection actions—"network blocking," "process termination," "file isolation," and "user session logout"—at different execution time nodes. Specifically, the horizontal axis represents the execution time node, and the vertical axis represents the execution completion rate (%). The completion rates of the four types of protection actions exhibit differentiated fluctuation characteristics with time nodes: the completion rates of "network blocking" and "user session logout" remain consistently high (85%-95%), with "network blocking" reaching its peak at node 3 (approximately 95%); the completion rate of "process termination" shows a gradual upward trend, increasing from 65% at node 1 to 90% at node 9; and the completion rate of "file isolation" is generally within the 70%-85% range, with relatively gentle fluctuations. At the data characteristic level, the differences in completion rates among the four types of protection actions are directly related to the execution complexity and resource consumption of the actions: "Network blocking" and "user session logout" have relatively lightweight execution logic, so their completion rates remain high; "process termination" involves complex operations such as process resource reclamation, and its completion rate gradually increases as the execution process progresses; "file isolation" is affected by factors such as file locks and access control, resulting in smaller fluctuations in the completion rate, but the overall level is relatively low. In terms of parameter dimensions, the time granularity of this analysis matches the execution cycle of the protection strategy chain, and the completion rate is statistically defined as the proportion of protection actions completed and valid status reports generated.

[0042] Example 5: In specific implementation, the storage strategy optimization module periodically monitors the status of multiple physical storage units and makes data scheduling decisions. The storage strategy optimization module manages multiple physical storage units and maintains a registry containing information on all available physical storage units. Each physical storage unit's information includes its network address, storage capacity, storage type, and access interface protocol. Management operations cover physical storage unit registration, status monitoring, health checks, and removing faulty units from the availability list. The storage strategy optimization module optimizes the data block scheduling strategy of the security information distributed storage module. The data block scheduling strategy determines which specific physical storage unit each data block to be stored should be allocated to. The optimization goal is to achieve balanced storage load, improved access efficiency, and reliable data storage. In specific implementation, the storage strategy optimization module periodically polls the current storage pressure index and health status indicators of each physical storage unit. The polling operation is executed automatically at fixed time intervals, and the storage strategy optimization module sends a status query request to each registered physical storage unit. The current storage pressure index is a comprehensive numerical indicator that reflects the storage load of physical storage units at the time of query. It can be calculated based on operating parameters such as storage space utilization, current I / O throughput, and request response latency. The health status index is another numerical value or status enumeration that reflects the operational health of the physical storage unit itself. Health status indicators can be obtained by querying the physical storage unit's self-test status report, checking network connectivity, or analyzing the frequency of historical storage errors.

[0043] In practice, the storage strategy optimization module receives data block storage requests from the security information distributed storage module. After completing the association and marking of protection result data with the security threat evolution path, the security information distributed storage module sends a data block storage request to the storage strategy optimization module before or after dividing the associated and marked protection result data into multiple data blocks. The data block storage request includes data feature identifiers for the data blocks to be stored. The data feature identifier is a structured data object whose fields may include data block size, data block type, expected data block retention period, data block security level, threat event identifier associated with the data block, and expected access mode of the data block. Based on the data feature identifiers of the data blocks to be stored, the storage strategy optimization module matches historical storage patterns. Historical storage patterns are a database that records the decision records when data blocks with similar data feature identifiers were stored in the past and their subsequent access effect evaluations. The matching process involves the storage strategy optimization module searching the historical storage pattern database for historical storage records that are similar to the current data block to be stored in key fields. The storage strategy optimization module combines the current storage pressure index and health status indicators of each physical storage unit to calculate an optimal target physical storage unit identifier for the data block to be stored. This calculation process is a multi-objective decision-making process. The storage strategy optimization module returns the target physical storage unit identifier to the security information distributed storage module. Based on the received target physical storage unit identifier, the security information distributed storage module schedules the corresponding data block to be stored to the physical storage unit specified by the identifier for storage.

[0044] In some embodiments, the storage policy optimization module can define an evaluation function for calculating the optimal target physical storage unit identifier. For each candidate physical storage unit... The storage strategy optimization module can calculate a comprehensive suitability score. The physical storage unit with the highest score will be selected as the target. An example of an evaluation function is as follows:

[0045] in: This indicates the number of participants currently in the evaluation. One candidate physical storage unit. This indicates the data block to be stored and its data characteristic identifier. Indicates candidate physical memory units The normalized value of the current storage pressure index, which is between 0 and 1. A higher value indicates greater storage pressure, therefore it is used in the formula. This indicates a preference for low-load units. Indicates candidate physical memory units The normalized value of the current health status indicator, which is between 0 and 1, with a higher value indicating a better health status. Represents data block With physical storage units The historical storage pattern matching score is calculated based on the similarity between the data feature identifier and the historical storage record, and the value ranges from 0 to 1. , , These are weighting coefficients, used to adjust the relative importance of storage pressure, health status, and historical pattern matching in the overall suitability score. These weighting coefficients are set by the system administrator based on the overall storage strategy objectives. The storage strategy optimization module optimizes each available physical storage unit. Calculate its The value will be the highest-scoring physical storage unit. The identifier is returned as the optimal target.

[0046] Optionally, the updating and maintenance of the historical storage pattern database by the storage strategy optimization module also constitutes part of its functionality. After completing the storage scheduling of each data block, the storage strategy optimization module continuously collects storage performance metrics for that data block on the target physical storage unit in subsequent cycles, such as write speed, read latency, and error rate during storage. The storage strategy optimization module associates the collected performance metrics with the records of that storage decision, forming a feedback record, which is then stored in the historical storage pattern database. These feedback records are used for subsequent matching of historical storage patterns and calculation of matching scores. This provides a data foundation, enabling storage scheduling strategies to learn and optimize themselves. By introducing a feedback mechanism, the storage strategy optimization module allows data block scheduling decisions to continuously adapt to changes in the physical storage environment and long-term performance, thereby continuously optimizing the overall storage performance and reliability of the security information distributed storage module. The storage strategy optimization module can also set rules to automatically mark physical storage units that are consistently under high storage pressure or have low health indicators as "not recommended," temporarily excluding them from the candidate list until their status returns to normal. This helps prevent data blocks from being written to unstable storage units, improving the security of data persistence.

[0047] See Figure 5In verifying the effectiveness of storage strategy optimization, the results of comparing multi-dimensional storage performance indicators before and after optimization are presented. Specifically, the figure covers four core indicators: storage load balancing, access response latency (ms), data write success rate (%), and storage error rate (‰). Regarding storage load balancing, the value was 0.6 before optimization and improved to 0.9 after optimization, reflecting an improvement in the balance of storage resource allocation. Regarding access response latency, it reached 185.0ms before optimization and decreased to 78.0ms after optimization, demonstrating a significant improvement in the access efficiency of the storage system. Regarding data write success rate, it was 94.5% before optimization and improved to 99.2% after optimization, indicating enhanced data write reliability. Regarding storage error rate, it was 8.2‰ before optimization and decreased to 1.5‰ after optimization, highlighting a significant improvement in the stability of the storage system. These changes in indicators directly verify the significant effectiveness of storage strategy optimization in balancing storage load, improving access efficiency, and enhancing data reliability and system stability.

[0048] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0049] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A computer information security protection system, characterized by, The system comprises: a security entity network topology construction module, configured to acquire running state images of all security entities in a computer information system, extract behavior links associated with security protection from the running state images, and generate a security entity network topology composed of a plurality of interrelated security entities according to the behavior links; a security threat behavior simulation module, configured to simulate behaviors of the running state images of the security entities in the security entity network topology, identify potential abnormal behavior patterns of the security entities, and map the potential abnormal behavior patterns into security threat evolution paths with timestamps; a security protection strategy chain generation module, configured to receive and analyze the security threat evolution paths, generate a security protection strategy chain containing a plurality of sequentially executed protection actions according to the time sequence of the potential abnormal behavior patterns in the security threat evolution paths; a security policy execution and data scheduling module, configured to load the security protection strategy chain to the security entity network topology, sequentially trigger the protection actions on the corresponding security entities, and synchronously collect protection result data generated in the execution of the protection actions; a security information distributed storage module, configured to receive the protection result data, associate and mark the protection result data with the security threat evolution paths, split the protection result data after the association and marking into a plurality of data blocks, and schedule the data blocks to different physical storage units for storage.

2. The computer information security protection system of claim 1, wherein, The specific process of extracting the behavior links associated with security protection from the running state images comprises: analyzing network connection request sequences and system call sequences of the security entities recorded in the running state images, screening connection records pointing to preset key service ports from the network connection request sequences, and screening operation records involving preset sensitive files or registry entries from the system call sequences; crossing and merging the screened connection records and operation records in the order of timestamps to form a behavior sequence containing mixed events of network connection and system operation; in the behavior sequence, taking a network connection request as a starting event, finding subsequent system operation events having a logical dependency relationship with the starting event within a preset time window, connecting all starting events and subsequent events having the logical dependency relationship to form an independent behavior link.

3. The computer information security protection system of claim 2, wherein, The specific process of generating the security entity network topology composed of a plurality of interrelated security entities according to the behavior links comprises: taking all the security entities appearing in each behavior link as network nodes; defining the behavior dependency relationship between the security entities in the behavior link as a directed edge connecting the corresponding network nodes, and the direction of the directed edge being from the security entity initiating the behavior to the security entity receiving the behavior; counting the network nodes and directed edges in all the behavior links, aggregating all the network nodes and directed edges, and drawing a mesh structure reflecting the behavior interaction relationship between the security entities, which is the security entity network topology.

4. The computer information security protection system of claim 3, wherein, The specific process of simulating behaviors of the running state images of the security entities in the security entity network topology comprises: Acquiring a historical normal behavior sample of a target security entity in a security entity network topology, the historical normal behavior sample including a baseline mode of the target security entity in terms of network communication and system resource access; Injecting a running state mirror of the target security entity into an isolated sandbox environment at a current time point; Driving the target security entity to run in the sandbox environment, and simulating application of stimuli to the target security entity according to a plurality of attack behavior templates predefined in a security threat feature library, and recording running feedback of the target security entity generated under various stimuli; Comparing the running feedback of the target security entity with the corresponding historical normal behavior sample, and if the running feedback deviates from the historical normal behavior sample by more than a preset deviation threshold, then recording the simulated stimuli and the generated running feedback as a potential abnormal behavior mode.

5. The computer information security protection system of claim 4, wherein, The potential abnormal behavior mode is mapped to a security threat evolution path with a time stamp, and the specific process is as follows: Extracting a time point of occurrence of the simulated stimuli in the potential abnormal behavior mode as an initial time stamp of the potential abnormal behavior mode; Analyzing the security entity network topology to locate positions of security entities involved in the potential abnormal behavior mode in the network; Taking the potential abnormal behavior mode as a starting point, simulating a time sequence process of propagation of the potential abnormal behavior mode to adjacent security entities according to a directed edge connection relationship in the security entity network topology, and estimating a delay time required for the behavior mode to propagate to each adjacent security entity; Combining the initial time stamp and the estimated delay time to give each node on the behavior mode propagation path a simulated time stamp, thereby generating a security threat evolution path describing a possible diffusion path and time node of the potential abnormal behavior mode in the security entity network topology.

6. The computer information security protection system of claim 1, wherein, According to the time sequence relationship of the potential abnormal behavior mode in the security threat evolution path, a security protection strategy chain including a plurality of sequentially executed protection actions is generated, and the specific process is as follows: Analyzing the security threat evolution path to obtain a plurality of potential abnormal behavior mode nodes sorted by simulated time stamps; For the potential abnormal behavior mode node sorted at the front, calling a blocking and isolation action matching the behavior characteristics of the potential abnormal behavior mode node from a protection action library as a starting protection action of the security protection strategy chain; For each subsequent potential abnormal behavior mode node, calling a detection and containment action matching the behavior characteristics of the potential abnormal behavior mode node from the protection action library, and setting an execution trigger condition of the detection and containment action as execution completion of the previous protection action and reporting of a specific state signal, so that the plurality of protection actions are sequentially linked in reverse according to the time sequence of the security threat evolution path, forming the security protection strategy chain.

7. The computer information security protection system of claim 6, wherein, The security protection strategy chain is loaded to the security entity network topology, and the specific process is as follows: The starting protection action of the security protection strategy chain is delivered to an actual security entity corresponding to the potential abnormal behavior mode node sorted at the front in the security threat evolution path. The starting protection action is executed on the actual security entity, and when the starting protection action is executed and a state completion report is generated, the state completion report is matched with a trigger condition of a next protection action in the security protection policy chain; If the matching is successful, the next protection action in the security protection policy chain is issued to the actual security entity corresponding to the next protection action, and all protection actions in the security protection policy chain are triggered in sequence.

8. The computer information security protection system of claim 7, wherein, The protection result data generated in the execution process of the synchronous collection protection action is collected, and the specific process is as follows: A data probe is deployed on the actual security entity when each protection action is issued to the corresponding actual security entity. The data probe captures system log change records, network traffic filtering records and process state snapshots in real time in the execution process of the protection action. All captured system log change records, network traffic filtering records and process state snapshots are packaged to generate a protection result data packet corresponding to the protection action.

9. The computer information security protection system of claim 1, wherein, Further comprising: A storage strategy optimization module is configured to manage a plurality of physical storage units and optimize the data block scheduling strategy of the security information distributed storage module, and the specific process is as follows: Periodically poll the current storage pressure index and health state index of each physical storage unit; Receive a data block storage request sent by the security information distributed storage module, wherein the data block storage request contains a data feature identifier of a to-be-stored data block; According to the data feature identifier of the to-be-stored data block, the historical storage mode is matched, and the current storage pressure index and health state index of each physical storage unit are combined to calculate an optimal target physical storage unit identifier for the current to-be-stored data block, and the target physical storage unit identifier is returned to the security information distributed storage module.

10. A computer information security protection method, characterized by, All modules and method processes of the computer information security protection system according to any one of claims 1 to 9 are included.

Images