Information security control method and system for large-scale network environment

Abstract

The invention discloses an information security control method and system oriented to a large-scale network environment, and relates to the technical field of information security, and the method comprises the steps: collecting multi-source threat data in real time, constructing a dynamic vector, and carrying out the matching and comparison with a preset vector library, thereby achieving the early prediction and threat analysis of a security risk, and improving the safety of a system. And then hierarchical response is triggered automatically, and an intelligent closed-loop defense system integrating monitoring, analysis and protection is formed. According to the invention, through vectorized real-time data and cosine similarity matching, quantitative early warning of early abnormal behaviors of attacks is realized, and a defense precedent is preempted; in combination with risk threshold classification and an adaptive screening mechanism, known threat types can be accurately identified, the evolution trend of unknown attacks can be perceived, and an evolution basis is provided for a knowledge base; finally, automatic response is triggered through threat value grading, an intelligent closed loop from detection, study and judgment to disposal is formed, and the automation level and the active defense capability of safe operation in a large-scale network environment are improved.

Description

Technical Field

[0001] This invention relates to the field of information security technology, specifically to an information security control method and system for large-scale network environments. Background Technology

[0002] In a large-scale network environment, information leakage can trigger a chain reaction of systemic damage, so it is imperative to take precautions. Once core intellectual property rights, trade secrets, or customer data are leaked, companies will fall into a vicious cycle of losing competitive advantage, huge compliance fines, brand reputation collapse, and even survival crisis. Therefore, avoiding information leakage is not only the bottom line of technical defense, but also a strategic cornerstone for maintaining the trust system of the digital economy and ensuring national economic security and social stability.

[0003] However, existing technologies have shortcomings in cybersecurity risk management: they are not only difficult to accurately determine the malicious intent and ultimate goal in the early stages of an attack, but also cannot predict how it will evolve into a specific type of information risk. This ambiguity and lag in identifying the early stages of the attack chain means that the protection system can only respond clearly when the attack has progressed to the middle or late stages, such as the data leakage or destruction stage. As a result, critical defense windows are missed, causing irreparable losses. Summary of the Invention

[0004] Technical problems to be solved To address the shortcomings of existing technologies, this invention provides an information security control method and system for large-scale network environments, solving the problem that due to insufficient early intent recognition capabilities, existing network security protections often only respond in the later stages of an attack, missing critical defense windows and causing losses.

[0005] To achieve the above objectives, the present invention provides the following technical solution: an information security control method for large-scale network environments, comprising the following specific steps: Step 1: Real-time collection of abnormal information type data, including data on various information threat types, and preprocessing; Step 2: Construction of real-time information vectors based on the preprocessed abnormal information type data, and similarity matching with reference vectors in a preset reference vector database to predict the type of information security risk. Simultaneously, the ratio of the magnitude of the real-time information vector to the magnitude of the reference vector is calculated to analyze the degree of threat; Step 3: If it is predicted that information security is threatened, preventive control is implemented according to the degree of threat, and the process returns to Step 1; if it is predicted that information security is not threatened, the process ends.

[0006] Furthermore, the construction method of the real-time information vector in step two is as follows: according to the data of each information threat type, the first dimension of the vector, the second dimension of the vector, ... the Nth dimension of the vector are set in sequence to obtain a dimension group, wherein the number of dimensions is equal to the number of information threat types. The real-time information vector is constructed according to each dimension of the dimension group, and different isolation weights are set for different dimensions.

[0007] Furthermore, the dimension of the vector is set by weighting and summing the values ​​of each information threat type, and then normalizing them to obtain the dimension of the vector.

[0008] Furthermore, the specific method for predicting information security risk types is as follows: real-time information vectors are matched sequentially with reference vectors using a cosine similarity algorithm to obtain similarity values. A risk type threshold and a normal threshold are preset. The similarity value is compared with the normal threshold. If the similarity value is within the normal threshold range, it indicates that information security is not threatened. If the similarity value is not within the normal threshold range, the similarity value is compared sequentially with the risk type threshold. If the similarity value is within a certain risk type threshold, it indicates that information security is threatened. If the similarity value is not within any of the risk type thresholds, the most suitable risk type is selected.

[0009] Furthermore, the specific method for selecting the most suitable risk type is as follows: a detection time period is preset, and similarity values ​​are arranged from largest to smallest using a fast sorting algorithm. Within the detection time period, the minimum similarity value is subjected to monotonicity analysis. If the analysis shows that the minimum similarity value is increasing, the risk type is determined by the corresponding risk type threshold. If the analysis shows that the minimum similarity value is not increasing, it also indicates that information security is threatened, and that the risk type corresponding to this similarity value has not been recorded in the reference vector database. Log files are then generated for backtracking.

[0010] Furthermore, the specific method for performing monotonicity analysis on the minimum similarity value within the detection time period is as follows: In the detection time series, the difference between the minimum similarity value at the next moment and the minimum similarity value at the previous moment is calculated to obtain the similarity difference value. The similarity difference value is compared with zero, and the number of similarity differences greater than zero and the number of similarity differences less than or equal to zero are counted respectively, and the proportions are calculated respectively. When the proportion of similarity differences greater than zero is greater than the proportion of similarity differences less than or equal to zero, it indicates an increase; otherwise, it indicates no increase.

[0011] Furthermore, the method for calculating the proportions separately is as follows: add the number of similarity differences greater than zero to the number of similarity differences less than or equal to zero to obtain the total number; calculate the ratio of the number of similarity differences greater than zero to the total number to obtain the proportion of similarity differences greater than zero; and calculate the ratio of the number of similarity differences less than or equal to zero to the total number to obtain the proportion of similarity differences less than or equal to zero.

[0012] Furthermore, the specific method for analyzing the degree of threat is as follows: when predicting the type of information security risk, the ratio of the magnitude of the real-time information vector to the magnitude of the reference vector is calculated to obtain the threat value. The threat value is compared with 1. If the threat value is greater than 1, it indicates a serious threat; if the threat value is equal to 1, it indicates a general threat; if the threat value is less than 1, it indicates a weak threat.

[0013] Furthermore, the specific methods for prevention and control based on the degree of threat are as follows: if the threat is severe, the connection will be automatically terminated and the user will be blacklisted, while deep forensics will be initiated; if the threat is general, access permissions will be automatically reduced and the system will switch to enhanced monitoring and auditing mode; if the threat is minor, the session will be maintained but real-time alerts will be issued.

[0014] An information security control system for large-scale network environments includes the following specific modules: a data acquisition module, an information risk analysis module, and an access blocking module. The data acquisition module collects abnormal information type data in real time, including data on various information threat types, and performs preprocessing. The information risk analysis module constructs real-time information vectors based on the preprocessed abnormal information type data and performs similarity matching with reference vectors in a preset reference vector database to predict the type of information security risk. Simultaneously, it calculates the ratio of the magnitude of the real-time information vector to the magnitude of the reference vector to analyze the threat level. The access blocking module, if it predicts that information security is threatened, performs preventative control based on the threat level and returns the data to the data acquisition module; if it predicts that information security is not threatened, the process ends.

[0015] Beneficial effects Compared with the prior art, the embodiments of the present invention have at least the following advantages or beneficial effects: 1. By converting real-time collected multidimensional threat data into feature vectors and performing cosine similarity matching with a preset reference vector database, this invention can quantify behavioral anomalies in the early stages of the attack chain, thereby identifying potential risks that deviate from the normal baseline. This method overcomes the lag of traditional methods that rely on signature or rule bases when dealing with new and variant attacks, and effectively seizes the critical defense window.

[0016] 2. This invention not only determines whether a threat exists, but also accurately classifies threats through preset risk type thresholds, and innovatively designs the most suitable type screening mechanism for unknown threats. At the same time, it quantifies and grades the degree of risk by calculating threat values ​​and triggers corresponding automated response strategies, realizing intelligent management from detection to handling.

[0017] 3. By introducing monotonicity analysis of minimum similarity values, this invention can perceive the evolution trend of new attack patterns that have not yet been entered into the knowledge base. When a behavior pattern is detected to be continuously approaching a known threat type, an early warning can be given. When it is confirmed to be a completely new pattern, detailed logs can be recorded for source tracing analysis, thereby providing a data foundation for the continuous evolution of the security knowledge base and enabling the system to have good scalability and self-learning potential.

[0018] 4. By integrating data collection, vectorized analysis, similarity matching, threat assessment, and response control into a coherent process, and through efficient algorithms and automated decision-making logic, the processing speed and operational efficiency of security incidents in large-scale network environments are significantly improved. This reduces the reliance on repetitive work by security analysts, enables the protection system to achieve dynamic and proactive defense throughout the entire process, and improves the overall maturity of security operations and maintenance.

[0019] Of course, any product implementing this invention does not necessarily need to achieve all of the advantages described above at the same time. Attached Figure Description

[0020] Figure 1 This is a flowchart of the information security control method of the present invention.

[0021] Figure 2 This is a structural diagram of the information security control system of the present invention. Detailed Implementation

[0022] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0023] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus.

[0024] Example 1: like Figure 1 As shown, this embodiment of the invention provides an information security control method for large-scale network environments, including the following specific steps: Step 1: Real-time collection of abnormal information type data. This data includes various threat types, such as identity access risk data, network traffic risk data, and ransomware risk data. Identity access risk data includes the number of failed login attempts, the number of successful logins from unusual locations or times, and the number of account lockouts. Network traffic risk data includes the frequency of malicious IP access attempts, the number of connections rejected, and the frequency of communication on unusual ports. Ransomware risk data includes the number of system restore points deleted, the number of shadow copies cleared, and the number of times specific file extensions have been changed. Data cleaning is performed on abnormal information types to remove redundant values, thereby ensuring that the real-time information vectors constructed subsequently can accurately reflect the nature of the threat.

[0025] Step Two: Construct real-time information vectors based on the cleaned and processed anomaly information type data, and perform similarity matching with reference vectors in a pre-set reference vector database. The reference vectors include threat vectors and normal vectors. Threat vectors represent vectors constructed from anomaly information type data under threat, while normal vectors represent vectors constructed from anomaly information type data under normal circumstances. The reference vector database is constructed and updated as follows: It collects historical anomaly information type data under threat and anomaly information type data under normal circumstances (i.e., manually labeled normal behavior samples); it uses a clustering algorithm to train the above data, generating threat vectors and normal vectors respectively; and it stores the generated vectors in the database. It is regularly iterated and updated to continuously improve the ability to identify unknown attacks, thereby predicting the types of information security risks. At the same time, the ratio of the magnitude of the real-time information vector to the magnitude of the reference vector is calculated to analyze the degree of threat. First, cosine similarity matching is used to identify the threat type that is closest to the real-time information vector in the reference vector database, thus identifying what kind of threat it is. Then, based on the determination of the threat type, the ratio of the magnitude of the real-time information vector to the magnitude of the reference vector corresponding to this type of threat is calculated to reflect the strength of the current threat activity relative to the historical benchmark of this type of threat. If the ratio is greater than 1, it indicates that the activity or intensity of this attack exceeds the historical average level, and the threat is more serious; otherwise, it is weaker.

[0026] Step 3: If it is predicted that information security is threatened, take preventive and control measures according to the degree of threat, and return to Step 1; if it is predicted that information security is not threatened, then end.

[0027] Example 2 differs from Example 1 in that: The real-time information vector is constructed as follows: Based on the data for each information threat type, the first dimension, the second dimension, ..., the Nth dimension of the vector are sequentially set to obtain a dimension group. The number of dimensions does not necessarily equal the number of information threat types; that is, even if the number of information threat types differs each time, zeros are used to padded the vector to ensure the same number of dimensions. A real-time information vector is then constructed based on each dimension of the dimension group. ,in, Represents a real-time information vector. This represents the first dimension of the vector. Represents the second dimension of the vector. The Nth dimension of the vector represents a predefined threat type and dimension mapping table. Each information threat type corresponds to a different dimension, and different dimensions are stored at different addresses. Therefore, the order in which they are accessed by the computer is different, thus ensuring that the constructed real-time information vector has a unified and repeatable fixed dimension structure regardless of how the order in which the information threat type data is acquired changes. Different isolation weights are set for different dimensions to reduce the probability of different dimensions having the same value, thereby avoiding the inability to distinguish threat types. Therefore, different dimensions are represented by different numerical ranges.

[0028] The dimensions of a vector are set as follows: The values ​​for each information threat type are weighted and summed. By assigning different weights to the values ​​of different information threat types, the actual situation is reflected more accurately. At the same time, normalization is performed to eliminate the difference in dimensions and transform the values ​​of different orders of magnitude into a unified numerical range, thus obtaining the dimension of the vector.

[0029] The specific methods for predicting information security risk types are as follows: The real-time information vector is matched sequentially with the reference vector using the cosine similarity algorithm to obtain similarity values. ;in, This indicates a similarity value, and it is between -1 and 1. Represents a real-time information vector. Represents the reference vector. The modulus of the real-time information vector. The modulus of the reference vector is represented; a risk type threshold and a normal threshold are preset. The normal threshold is set as the range of similarity values ​​of a large number of normal behavior samples. Similarly, the risk type threshold is set as the range of similarity values ​​of a large number of historically threatened abnormal information data. The similarity value is compared with the normal threshold. If the similarity value is within the normal threshold range, it means that the information security is not threatened. If the similarity value is not within the normal threshold range, the similarity value is compared with the risk type threshold in turn. If the similarity value is within a certain risk type threshold, it means that the information security is threatened. If the similarity value is not within the risk type threshold, the most suitable risk type is selected. By using cosine similarity to transform complex real-time behavioral data into quantifiable matching values, and by using preset normal thresholds and risk type thresholds to achieve rapid initial screening and accurate classification, this method not only seamlessly connects the three stages of detection, identification, and classification, but also ensures that reasonable judgment results can still be given for new or hybrid threats by selecting the most suitable risk type as a fallback logic. Thus, while pursuing automated response, it also takes into account the robustness of the system when dealing with unknown threats.

[0030] The specific method for selecting the most suitable risk type is as follows: The system presets a detection time period, such as 1 minute or 3 minutes, and uses a quicksort algorithm to sort similarity values ​​from largest to smallest. The quicksort algorithm ensures efficient sorting, meeting the needs of real-time or near-real-time detection. Sorting similarity values ​​from largest to smallest is for identifying the most similar potential threats. Within the detection time period, the minimum similarity value is analyzed for monotonicity. If the analysis shows an increasing minimum similarity value, the risk type is determined using the corresponding risk type threshold, indicating suspicious activity that is gradually evolving or approaching a known attack pattern. This allows for early warning and classification before reaching the absolute threshold. If the analysis shows no increasing minimum similarity value, it also indicates a threat to information security, and that the risk type corresponding to this similarity value has not been entered into the reference vector database. A log file is then generated for backtracking. In other words, when a behavioral pattern neither conforms to any known type nor shows a trend towards evolving towards a known type, the system determines it as a new, unknown type of threat. By generating detailed logs, the system not only completes the current alert but, more importantly, provides security analysts with raw data for post-event analysis and tracing, and provides samples for future updates and enrichment of the reference vector database, thus enabling continuous system evolution.

[0031] The specific method for performing monotonicity analysis on the minimum similarity value within the detection time period is as follows: In the detection time series, the difference between the smallest similarity value at the next moment and the smallest similarity value at the previous moment is calculated to obtain the similarity difference. The similarity difference is compared with zero, and the number of similarity differences greater than zero and the number of similarity differences less than or equal to zero are counted respectively, and the proportions are calculated. When the proportion of similarity differences greater than zero is greater than the proportion of similarity differences less than or equal to zero, it indicates an increase; otherwise, it indicates no increase. By dynamically tracking the changing trend of the minimum similarity value, early perception and intelligent judgment of potential new threats can be achieved. It can not only capture signs of behavioral patterns gradually evolving into known threat types, thus issuing early warnings before the attack is fully formed; it can also identify completely unknown attack patterns, mark them as new threats and record the full log, providing key samples for the continuous evolution of the security knowledge base, enabling the system to have the adaptive evolutionary capability from recognizing the known to perceiving the unknown.

[0032] The methods for calculating the percentages are as follows: Add the number of similarity differences greater than zero to the number of similarity differences less than or equal to zero to get the total number. Calculate the ratio of the number of similarity differences greater than zero to the total number to get the percentage of similarity differences greater than zero. Calculate the ratio of the number of similarity differences less than or equal to zero to the total number to get the percentage of similarity differences less than or equal to zero. It provides a robust quantitative basis for trend determination, avoiding misjudgment due to single or accidental fluctuations, such as a slight drop in similarity value at the next moment. Instead, it is based on the statistical advantage of the direction of change throughout the entire detection period, i.e. whether it is increasing most of the time, to make a robust conclusion of whether it is increasing or not.

[0033] The specific methods for analyzing the level of threat are as follows: When predicting the type of information security risk, the ratio of the magnitude of the real-time information vector to the magnitude of the reference vector is calculated to obtain the threat value. The threat value is then compared with 1. If the threat value is greater than 1, it indicates a serious threat; if the threat value is equal to 1, it indicates a general threat; and if the threat value is less than 1, it indicates a weak threat. By comparing the threat value with 1, a clear, objective, and operable basis for subsequent differentiated and precise automated response decisions is provided, effectively avoiding misjudgment or inappropriate response caused by ambiguity in traditional responses.

[0034] The specific methods for prevention and control based on the level of threat are as follows: If the threat is severe, the connection will be automatically terminated and the system will be blacklisted. At the same time, deep forensics will be initiated. This is a circuit breaker response for high-confidence, high-destructive, and immediate attacks to curb the spread of damage and support judicial tracing or attack review. If the threat is mild, access permissions will be automatically reduced. The core principle is to dynamically adjust permissions based on the least privilege. It does not immediately interrupt business but limits the potential scope of damage by reducing permissions and switches to enhanced monitoring and auditing mode. If the threat is minor, the session will be maintained but real-time alerts will be issued. This avoids overreaction and automation fatigue. The system will only issue alerts and will not take any automatic action.

[0035] Example 3: like Figure 2 As shown: An information security control system for large-scale network environments includes the following specific modules: a data acquisition module, an information risk analysis module, and an access blocking module are physically interconnected via an enterprise intranet. On this basis, each module uses an application layer interface based on the TCP / IP protocol for logical connection and data interaction. Massive amounts of real-time logs and event stream data are asynchronously transmitted through message queues, such as RabbitMQ. All of the above communications are encrypted using the HTTPS protocol to ensure the security of data transmission. Data acquisition module: collects abnormal information type data in real time, including data on various information threat types, and performs preprocessing; Information Risk Analysis Module: This module is deployed on multiple high-performance servers, all of which are configured with Intel Xeon Silver series CPUs. It constructs real-time information vectors based on pre-processed abnormal information type data and performs similarity matching with reference vectors in a preset reference vector database. The reference vector database is a MySQL relational database. This helps to predict the type of information security risk. At the same time, it calculates the ratio between the modulus of the real-time information vector and the modulus of the reference vector to analyze the degree of threat. Access blocking module: If it is predicted that information security is threatened, preventive control measures will be implemented according to the degree of threat, and the data collection module will be returned; if it is predicted that information security is not threatened, the process will end.

[0036] The preferred embodiments of the present invention disclosed above are merely illustrative of the invention. These preferred embodiments do not exhaustively describe all details, nor do they limit the invention to the specific implementations described. Clearly, many modifications and variations can be made based on the content of this specification. This specification selects and specifically describes these embodiments to better explain the principles and practical applications of the invention, thereby enabling those skilled in the art to better understand and utilize the invention. The invention is limited only by the claims and their full scope and equivalents.

Claims

1. An information security control method for large-scale network environments, characterized in that: The specific steps include the following: Step 1: Collect abnormal information type data in real time, including data on various information threat types, and preprocess the data; Step 2: Construct a real-time information vector based on the preprocessed abnormal information type data, and perform similarity matching with the reference vector in the preset reference vector database to predict the type of information security risk. At the same time, calculate the ratio between the magnitude of the real-time information vector and the magnitude of the reference vector to analyze the degree of threat. Step 3: If it is predicted that information security is threatened, take preventive and control measures according to the degree of threat, and return to Step 1; if it is predicted that information security is not threatened, then end.

2. The information security control method for large-scale network environments according to claim 1, characterized in that: The method for constructing the real-time information vector in step two is as follows: Based on the data of each information threat type, the first dimension, the second dimension, ... the Nth dimension of the vector are set sequentially to obtain a dimension group, where the number of dimensions is equal to the number of information threat types. Real-time information vectors are constructed based on each dimension of the dimension group, and different isolation weights are set for different dimensions.

3. The information security control method for large-scale network environments according to claim 2, characterized in that: The dimension of the vector is set as follows: The values ​​for each information threat type are weighted and summed, and then normalized to obtain the dimension of the vector.

4. The information security control method for large-scale network environments according to claim 3, characterized in that: The specific method for predicting information security risk types is as follows: The real-time information vector is matched sequentially with the reference vector using a cosine similarity algorithm to obtain similarity values. Preset risk type thresholds and normal thresholds are used to compare the similarity values ​​with the normal thresholds. If the similarity value is within the normal threshold range, it means that information security is not threatened. If the similarity value is not within the normal threshold range, the similarity value is compared sequentially with the risk type threshold. If the similarity value is within a certain risk type threshold, it means that information security is threatened. If the similarity value is not within any risk type threshold, the most suitable risk type is selected.

5. The information security control method for large-scale network environments according to claim 4, characterized in that: The specific method for selecting the most suitable risk type is as follows: A preset detection time period is set, and similarity values ​​are arranged from largest to smallest using a fast sorting algorithm. Within the detection time period, the minimum similarity value is analyzed for monotonicity. If the analysis shows that the minimum similarity value is increasing, the risk type is determined by the corresponding risk type threshold. If the analysis shows that the smallest similarity value is not increasing, it also indicates that information security is threatened, and that the risk type corresponding to this similarity value has not been recorded in the reference vector database, thus generating a log file for backtracking.

6. The information security control method for large-scale network environments according to claim 5, characterized in that: The specific method for performing monotonicity analysis on the minimum similarity value within the detection time period is as follows: In the detection time series, the difference between the smallest similarity value at the next moment and the smallest similarity value at the previous moment is calculated to obtain the similarity difference value. The similarity difference value is compared with zero, and the number of similarity differences greater than zero and the number of similarity differences less than or equal to zero are counted separately, and the proportions are calculated separately. When the proportion of similarity differences greater than zero is greater than the proportion of similarity differences less than or equal to zero, it indicates an increase; otherwise, it indicates no increase.

7. The information security control method for large-scale network environments according to claim 6, characterized in that: The method for calculating the proportions separately is as follows: Add the number of similarity differences greater than zero to the number of similarity differences less than or equal to zero to get the total number. Calculate the ratio of the number of similarity differences greater than zero to the total number to get the percentage of similarity differences greater than zero. Calculate the ratio of the number of similarity differences less than or equal to zero to the total number to get the percentage of similarity differences less than or equal to zero.

8. The information security control method for large-scale network environments according to claim 7, characterized in that: The specific method for analyzing the level of threat is as follows: When predicting the type of information security risk, the ratio of the magnitude of the real-time information vector to the magnitude of the reference vector is calculated to obtain the threat value. The threat value is then compared with 1. If the threat value is greater than 1, it indicates a serious threat; if the threat value is equal to 1, it indicates a general threat; and if the threat value is less than 1, it indicates a weak threat.

9. The information security control method for large-scale network environments according to claim 8, characterized in that: The specific methods for prevention and control based on the degree of threat are as follows: If the threat is severe, the connection will be automatically terminated and the user will be blacklisted, while initiating deep forensics; if the threat is minor, access permissions will be automatically reduced and the system will switch to enhanced monitoring and auditing mode; if the threat is minor, the session will be maintained but real-time alerts will be issued.

10. An information security control system for large-scale network environments, used to implement the information security control method for large-scale network environments as described in any one of claims 1-9, characterized in that, The information security control system for large-scale network environments includes: a data acquisition module, an information risk analysis module, and an access blocking module. The data acquisition module: collects abnormal information type data in real time, including data on various information threat types, and performs preprocessing. The information risk analysis module constructs a real-time information vector based on the pre-processed abnormal information type data, and performs similarity matching with the reference vector in the preset reference vector database to predict the type of information security risk. At the same time, it calculates the ratio between the magnitude of the real-time information vector and the magnitude of the reference vector to analyze the degree of threat. The access blocking module: if it predicts that information security is threatened, it will implement preventive control measures according to the degree of threat and return to the data acquisition module; if it predicts that information security is not threatened, it will end the process.

Images