Data security protection capability intelligent evaluation method and device, and medium

Abstract

The invention discloses a data security protection capability intelligent evaluation method and device and a medium, and relates to the technical field of industrial internet security, and the method comprises the steps: building a state and action space based on a security data set through employing terminal behaviors, network communication and historical security events, a deep reinforcement learning model constructed by an Actor-Critic network structure and trained by a PPO reinforcement learning algorithm is adopted to carry out continuous learning and adaptive strategy optimization on the security protection behavior, and an optimized security protection strategy is generated; performing simulation execution on the optimized security protection strategy, and performing comprehensive evaluation based on the success rate, the false alarm rate and the execution time to generate a security evaluation report; and carrying out encryption, Hash signature and uplink storage on the security event data acquired by the security assessment report and real-time monitoring by using an encryption storage method, and generating a security event data record. According to the method, through efficient data preprocessing, the accuracy and consistency of data in the deep reinforcement learning model training process are ensured.

Description

Technical Field

[0001] This invention relates to the field of industrial internet security technology, and in particular to an intelligent assessment method, device and medium for data security protection capabilities. Background Technology

[0002] In the field of modern data management and information security, ensuring data security has become an increasingly important issue. Traditional data security protection methods usually rely on static rules and manual configuration to take pre-set protective measures against potential threats, such as using firewalls and intrusion detection systems (IDS) to monitor and defend against risks such as data leakage and network attacks. They are relatively stable and effective in dealing with known threats, and can identify specific patterns through rule bases or specific algorithms and react to threats. With the continuous development of information technology, more and more systems need to cope with the Industrial Internet and diversified attack forms, requiring protection strategies to be flexible and adaptive to cope with dynamically changing security threats. In scenarios such as the Industrial Internet and the Internet of Things, there are many types of devices and different communication protocols, and they need to operate continuously 24 / 7, which puts forward higher requirements for the real-time performance, adaptability and reliability of security protection.

[0003] However, existing traditional methods exhibit certain limitations in addressing rapidly changing threat environments. First, they rely heavily on static rules or pre-set protective measures, failing to adapt and optimize in a timely manner based on real-time security shifts. Second, because the formulation of protective strategies often depends on human experience and rule base updates, they suffer from significant blind spots and lags in responding to unknown attacks. Consequently, existing methods struggle to achieve comprehensive dynamic adaptation and are even less capable of handling highly complex security events. The execution and evaluation of protective strategies typically rely on static data analysis, making it difficult to reflect new security threats and risks in real time. Summary of the Invention

[0004] In view of the aforementioned existing problems, the present invention is proposed.

[0005] Therefore, this invention provides an intelligent assessment method for data security protection capabilities, which solves the problems of insufficient ability to respond to new attacks and insufficient data storage security.

[0006] To solve the above-mentioned technical problems, the present invention provides the following technical solution:

[0007] In a first aspect, this invention provides an intelligent assessment method for data security protection capabilities, comprising: real-time acquisition of multi-source heterogeneous data streams; data cleaning, denoising, and formatting to generate a security dataset; based on the security dataset, constructing a state and action space using terminal behavior, network communication, and historical security events; employing an Actor-Critic network structure and a deep reinforcement learning model trained by the PPO reinforcement learning algorithm to continuously learn and adaptively optimize security protection behaviors, generating an optimized security protection strategy; simulating the execution of the optimized security protection strategy and conducting a comprehensive evaluation based on success rate, false alarm rate, and execution time to generate a security assessment report; using an encrypted storage method to encrypt, hash-sign, and store the security assessment report and real-time monitored security event data on the blockchain to generate security event data records; and based on the security event data records, identifying the effectiveness and weaknesses of existing security protection capabilities through pattern mining and inductive analysis, generating executable security optimization decisions.

[0008] As a preferred embodiment of the intelligent assessment method for data security protection capabilities described in this invention, the specific steps for generating the security dataset are as follows: Collect terminal operating status, network communication behavior and access records to form a multi-source heterogeneous data stream; Noise filtering and data cleaning are performed on multi-source heterogeneous data streams to generate a processed dataset. The processed datasets are uniformly converted into the JSON standard format and transmitted in encrypted form. Data integrity is verified through hash check to generate a secure dataset.

[0009] As a preferred embodiment of the intelligent evaluation method for data security protection capabilities described in this invention, the specific steps for generating the post-trained deep reinforcement learning model are as follows: Based on terminal behavior, network communication, and historical security events, a multi-dimensional state space is constructed, and a set of security response actions including isolation, blocking, alarm, and rate limiting operations is defined to form a state and action space. Extract terminal state changes and network traffic anomalies from the security dataset as security state features, and match them with protection actions in historical security response records to construct security protection behaviors. Based on attack identification accuracy, defense response effectiveness, and false alarm rate metrics, a dynamic reward function is designed, and an initial deep reinforcement learning model is constructed using an Actor-Critic network structure. The Actor network is responsible for outputting action policies, while the Critic network is responsible for evaluating state value. The PPO reinforcement learning algorithm is adopted. The initial deep reinforcement learning model is trained in multiple rounds using a security dataset as samples. The security protection behavior of the initial deep reinforcement learning model is optimized by adjusting the dynamic reward function. After training, it is deployed to the actual environment and the parameters are updated online based on the real-time security dataset to generate the trained deep reinforcement learning model.

[0010] As a preferred embodiment of the intelligent assessment method for data security protection capabilities described in this invention, the specific steps for generating the optimized security protection strategy are as follows: The security status features are input into the trained deep reinforcement learning model, and the Actor network is used to evaluate and learn policies in the state and action space to generate a set of protection decision actions. The action is executed in the protection decision action set, the state result after the action is executed is observed in the interactive environment, and the state result is calculated using a dynamic reward function to obtain the strategy benefit; Based on the policy benefits, the parameters of the Actor network and Critic network are updated through gradient backpropagation to generate adjustment data; Based on the adjusted data, the parameters of the Actor network are updated and the logic is reconstructed to generate an optimized security protection strategy.

[0011] As a preferred embodiment of the intelligent assessment method for data security protection capabilities described in this invention, the specific steps for generating the security assessment report are as follows: By utilizing the simulation capabilities of the trained deep reinforcement learning model, the optimized security protection strategy is taken as input, and the execution process under different attack scenarios and environmental conditions is simulated in combination with the state and action space to generate execution feedback data. Success rate, false alarm rate, and execution time are extracted from execution feedback data and integrated to generate evaluation input data; By evaluating the input data, the success rate, false alarm rate, and execution time in different attack scenarios are calculated, and the effectiveness of the optimized security protection strategy is evaluated to generate security protection effectiveness evaluation data. Based on the security protection effectiveness assessment data, the overall protection capability of the optimized security protection strategy is comprehensively judged, security assessment result data is generated, and then summarized and organized to generate a security assessment report.

[0012] As a preferred embodiment of the intelligent assessment method for data security protection capabilities described in this invention, the security event data collected in real-time monitoring is obtained by continuously monitoring and dynamically capturing the operating status of various terminals, network communication behavior, access control logs, and abnormal event records in the industrial internet environment.

[0013] As a preferred embodiment of the intelligent assessment method for data security protection capabilities described in this invention, the specific steps for generating security event data records are as follows: The security assessment report and security event data collected by real-time monitoring are input into the encrypted storage method, and the data is encrypted and hashed to generate encrypted storage data. The encrypted stored data is timestamped, hash digests are generated, and integrity is verified. A block structure is constructed and written into the blockchain to generate security event data records, which include event level, handling results, response time, and triggering rules.

[0014] As a preferred embodiment of the intelligent assessment method for data security protection capabilities described in this invention, the specific steps for generating executable security optimization decisions are as follows: Extract security-related behavioral patterns and historical response results from security incident data records, and identify existing security protection capabilities through inductive analysis; A strategy simulation evaluation method using a post-trained deep reinforcement learning model is adopted to construct typical attack scenarios and simulate the strategy response process. The existing security protection capabilities are subjected to simulated stress tests and comprehensive evaluations, and an optimization decision report is generated. The optimization decision report includes the protection capability analysis results, risk response performance, and the basis for improvement suggestions. Based on the optimized decision-making report, identify the weak links in the current security protection, and based on the event level and handling results in the security incident data record, analyze the degree of risk impact and response capability, and propose protective measures and improvement suggestions; The protective measures, improvement suggestions, and the results of the protective capability analysis in the optimization decision report are integrated and processed to generate actionable security optimization decisions.

[0015] In a second aspect, the present invention provides a computer device, including a memory and a processor, wherein the memory stores a computer program, wherein when the computer program is executed by the processor, it implements any step of the intelligent assessment method for data security protection capabilities as described in the first aspect of the present invention.

[0016] Thirdly, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein: when the computer program is executed by a processor, it implements any step of the intelligent assessment method for data security protection capabilities as described in the first aspect of the present invention.

[0017] The beneficial effects of this invention are as follows: by collecting multi-source heterogeneous data streams in real time and performing data cleaning, denoising and formatting to generate a security dataset, it is possible to obtain real-time and high-quality security data from multiple data sources. After processing, it provides an accurate training foundation for subsequent deep reinforcement learning models. Through efficient data preprocessing, the accuracy and consistency of data during the training process of deep reinforcement learning models are ensured, thereby enhancing the effectiveness and real-time adaptability of security protection strategies. Attached Figure Description

[0018] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 A flowchart for an intelligent assessment method for data security protection capabilities.

[0020] Figure 2 A flowchart generated for a secure dataset.

[0021] Figure 3 This is a flowchart for generating a deep reinforcement learning model after training.

[0022] Figure 4 A flowchart generated for safety optimization decisions. Detailed Implementation

[0023] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0024] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0025] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in different places in this specification does not necessarily refer to the same embodiment, nor is it a single or selective embodiment that is mutually exclusive with other embodiments.

[0026] Reference Figures 1-4 As one embodiment of the present invention, this embodiment provides an intelligent assessment method for data security protection capabilities, including the following steps: S1. Real-time acquisition of multi-source heterogeneous data streams, data cleaning, noise reduction and formatting, generating secure datasets.

[0027] S1.1 Collect terminal operating status, network communication behavior and access records to form a multi-source heterogeneous data stream.

[0028] Specifically, the system collects real-time data from the terminal through sensors and monitoring, recording various indicators of the terminal during operation, including status information such as temperature, pressure, current, and speed; monitors network communication behavior, recording network communication data including data packet transmission, communication protocols, and network topology to ensure the security and effectiveness of network transmission; collects access records, including access logs, user operation behavior, access frequency, and source IP address information, to track the access patterns of the terminal and the network; and summarizes the collected terminal operating status, network communication behavior, and access records to form a multi-source heterogeneous data stream.

[0029] S1.2 Perform noise filtering and data cleaning on the multi-source heterogeneous data stream to generate a processed dataset.

[0030] Specifically, median filtering is used to remove noise from multi-source heterogeneous data streams, filtering out erroneous, invalid, or abnormal data that occurred during the acquisition process to ensure data accuracy and validity. This includes removing distorted data caused by sensor malfunctions or communication interruptions, as well as filtering out useless data irrelevant to the target analysis. The filtered multi-source heterogeneous data streams are then formatted, transforming them from different sources into a unified format, such as JSON or CSV, for subsequent analysis and processing. During formatting, the multi-source heterogeneous data streams need to be standardized to ensure that various types of data have a consistent structure, facilitating further processing and integration. Simultaneously, real-time monitoring is performed to continuously track and analyze data flow, ensuring the timeliness and integrity of the multi-source heterogeneous data streams, and generating a processed dataset.

[0031] S1.3. Convert the processed dataset into the standard JSON format and transmit it encrypted. Verify the data integrity through hash check to generate a secure dataset.

[0032] Specifically, the processed dataset undergoes format standardization, converting all data entries into the JSON standard format. The converted JSON dataset is then encrypted using a symmetric encryption algorithm (e.g., AES) or an asymmetric encryption algorithm (e.g., RSA) to generate encrypted JSON data. This encrypted JSON data is transmitted via a secure network communication protocol. After transmission, the received encrypted JSON data is decrypted, restoring the processed dataset to its original JSON standard format. A hash value is calculated for this JSON standard format dataset using a hash algorithm (e.g., SHA-256), and this hash value is compared with the hash value calculated and saved before transmission. The integrity of the JSON standard format processed dataset throughout the entire transmission and reception process is verified by comparing the two hash values. Finally, the integrity-verified and JSON standard format processed dataset is organized and packaged to generate a secure dataset.

[0033] S2. Based on the security dataset, a state and action space is constructed using terminal behavior, network communication, and historical security events. A deep reinforcement learning model, constructed using the Actor-Critic network structure and trained by the PPO reinforcement learning algorithm, is used to continuously learn and adaptively optimize security protection behaviors, generating optimized security protection strategies.

[0034] It should be noted that the post-trained deep reinforcement learning model refers to the deep reinforcement learning model obtained by constructing a state and action space based on terminal behavior, network communication, and historical security events, building an initial model using an Actor-Critic network structure, and then performing multiple rounds of iterative training and online updates using the PPO reinforcement learning algorithm.

[0035] S2.1 Based on terminal behavior, network communication and historical security events, construct a multi-dimensional state space and define a set of security response actions including isolation, blocking, alarm and rate limiting operations to form a state and action space.

[0036] Specifically, terminal behavior is extracted from multi-source heterogeneous data streams, including terminal operation logs, behavior patterns, and abnormal event records. Network communication is collected, including analysis of network behaviors such as data packet transmission, protocol types, and communication frequencies, to ensure a comprehensive reflection of network security status. Historical security events are collected, including records of historical attack events, intrusion detection results, and response measures. By integrating terminal behavior, network communication, and historical security events, a multi-dimensional state space is constructed, fully considering the impact of each data dimension on security protection. A set of security response actions corresponding to each state is defined, including operations such as isolation, blocking, alarming, and rate limiting, to address different security threats. By integrating states and actions, a state and action space is formed.

[0037] S2.2 Extract terminal state changes and network traffic anomaly features from the security dataset as security state features, and match them with the protection actions in the historical security response records to construct security protection behaviors.

[0038] Specifically, information such as operational status, network communication behavior, and access records are obtained from security datasets. Status features related to security protection are extracted, including changes in terminal status, abnormal fluctuations in network traffic, and triggering of access control policies. Response measures associated with specific security protection statuses are extracted from historical security response records, such as isolation, communication restriction, or alarm issuance when abnormal behavior is detected. By correlating security status features with historical security responses, security protection behaviors are constructed.

[0039] It should also be noted that historical security response refers to the protective measures and response actions taken against different types of attacks or abnormal behaviors in past security incidents. These typically include operations such as isolating the attack source, limiting network traffic, blocking abnormal behaviors, and issuing security alerts. Historical security response records the effective security measures taken and the results of their implementation when a specific attack or threat occurred.

[0040] S2.3. Based on the attack identification accuracy, protection response effect and false alarm rate indicators, a dynamic reward function is designed, and an Actor-Critic network structure is adopted to construct an initial deep reinforcement learning model, in which the Actor network is responsible for outputting action policies and the Critic network is responsible for evaluating state value.

[0041] Specifically, based on attack identification accuracy, protection response effectiveness, and false alarm control, a dynamic reward function is defined. Attack identification accuracy serves as a key reward dimension, ensuring that improving accuracy is prioritized. Protection response effectiveness serves as another reward dimension, ensuring that security measures are not only effective but also respond quickly to attacks. False alarm control acts as a penalty, minimizing false alarms and improving the accuracy of security measures. An Actor-Critic structure is employed to optimize security measures in the state and action space. The Actor part selects an action based on the current state, determining the appropriate security measure. The Critic part evaluates the effectiveness of the action selection based on the current state and the action, outputting a value assessment indicating the action's performance. Based on the Critic structure... The feedback from the criterion (C) component allows the Actor component to adjust security protection behaviors. By continuously trying different actions and optimizing the selection mechanism, the effectiveness of security protection behaviors is gradually improved. The Actor and Critic form a two-way update through the feedback mechanism. The Actor continuously adjusts security protection behaviors to maximize rewards, while the Critic regulates the updates of security protection behaviors through evaluation until the optimal security protection behavior is generated. Through repeated optimization processes, a deep reinforcement learning model that can automatically adjust according to dynamic environmental changes is built, ensuring the ability to cope with unknown attacks and constantly changing security threats. For example, the input feature dimension of the deep reinforcement learning model is X, the action space dimension is Y, the learning rate is 0.001, the discount factor is 0.9, and it is trained using the PPO algorithm.

[0042] S2.4. The PPO reinforcement learning algorithm is adopted. The initial deep reinforcement learning model is trained in multiple rounds using the security dataset as samples. The security protection behavior of the initial deep reinforcement learning model is optimized by adjusting the dynamic reward function. After training, it is deployed to the actual environment and the parameters are updated online based on the real-time security dataset to generate the trained deep reinforcement learning model.

[0043] Specifically, the PPO reinforcement learning algorithm is employed, using a security dataset as samples. For example, a real-time dataset of 5000 samples is collected from a real-world industrial internet environment for multi-round interactive learning. This multi-round interactive learning simulates mixed threat scenarios that may be encountered in the industrial internet, such as ransomware propagation, vulnerability exploitation, and denial-of-service attacks. In each round of learning, the deep reinforcement learning model adjusts its security protection behavior based on feedback provided by the simulation environment (e.g., protection effectiveness, attack identification accuracy, and false positives), gradually optimizing the security protection strategy. By continuously selecting actions and receiving rewards or penalties, the deep reinforcement learning model optimizes the security protection strategy, gradually improving attack identification accuracy and response efficiency. After multiple rounds of training, such as hundreds to thousands of interactions, the deep reinforcement learning model is further refined after each interaction. The learning models fine-tune security protection behaviors based on reward functions (such as attack identification accuracy, protection response effectiveness, and false alarm control), gradually optimizing these behaviors. The deep reinforcement learning model continuously adjusts and optimizes security protection behaviors in the simulation environment, eventually converging to the optimal security protection behavior. After training, the trained deep reinforcement learning model is deployed to the actual operating environment and updated online based on real-time security datasets. In the actual operating environment, the deep reinforcement learning model continues to adjust and optimize based on real-time collected security datasets, ensuring that the deep reinforcement learning model can cope with new attacks and constantly changing security threats in the real environment, generating a post-trained deep reinforcement learning model that ensures automatic optimization and real-time adjustment capabilities, continuously improving security protection effectiveness.

[0044] It should also be noted that a real-time security dataset refers to a data set that is dynamically updated and formed by continuously monitoring and collecting various terminal behaviors, network communications, and security events in the industrial internet environment, reflecting the current security status and potential threats. The optimal security protection behavior is a protection strategy that can achieve high attack identification accuracy, low false alarm rate and short execution time in different attack scenarios.

[0045] S2.5 Input the security status features into the trained deep reinforcement learning model, and use the Actor network to evaluate and learn policies in the state and action space to generate a set of protection decision actions.

[0046] Specifically, security state features are extracted from the security dataset and input into the trained deep reinforcement learning model. Policy evaluation is then performed based on these input security state features. Within the state and action space, the trained deep reinforcement learning model uses an Actor network to learn different protective behaviors and continuously adjusts these behaviors to maximize attack identification accuracy, protection response effectiveness, and false alarm control in the reward function. In each learning round, the Actor part selects the appropriate protective action based on the current state, while the Critic part evaluates the effectiveness of the current action and provides feedback to optimize the strategy. After multiple rounds of optimization, such as hundreds to thousands of interactions, the trained deep reinforcement learning model gradually generates a set of protection decision actions, including protective measures to be taken under different security states, such as isolating attack sources and restricting communication traffic, thereby ensuring that security protection behaviors can effectively respond to various security threats.

[0047] S2.6 Execute actions in the protection decision action set, observe the state results after the actions are executed in the interactive environment, and use the dynamic reward function to calculate the state results to obtain the strategy benefits.

[0048] Specifically, the system executes the specified protective actions in the protection decision action set. Immediately after the action is completed, the new security state of the interactive environment is observed; this new security state is the post-action result. The post-action result is compared with the security state before the action, extracting multi-dimensional performance indicators, including whether the attack was intercepted, response delay, and whether false alarms occurred. These extracted performance indicators are then used as input to a dynamic reward function for calculation. The dynamic reward function, based on preset reward and penalty rules, quantifies and weights the performance indicators, outputting a scalar value, which represents the strategy benefit. The strategy benefit characterizes the comprehensive evaluation value of the effectiveness of the executed protective action in the interactive environment.

[0049] It should also be noted that the preset reward and punishment rules are derived from the core business objectives of industrial internet security protection, including three key performance indicators: attack identification accuracy, protection response effectiveness, and false alarm control. The rules prioritize attack identification accuracy, giving positive rewards for successful threat identification. They also take protection response effectiveness as the basis, adjusting rewards according to the actual interception effectiveness and efficiency of the measures. At the same time, false alarm control is used as an important punishment basis, applying negative rewards for erroneous intervention in normal behavior. This quantifies the security objectives of "accuracy, effectiveness, and reliability" into calculable mathematical signals, driving the deep reinforcement learning model to continuously optimize through a dynamic reward function.

[0050] S2.7. Based on the policy benefits, update the parameters of the Actor network and the Critic network through gradient backpropagation to generate adjustment data.

[0051] Specifically, the policy reward is input into the gradient backpropagation algorithm, which uses the policy reward to calculate the policy gradient of the Actor network and the loss gradient of the value function of the Critic network. The gradient backpropagation algorithm propagates backward along the computational graphs of the Actor and Critic networks, calculating the update amount of the Actor and Critic network parameters relative to their respective gradients. According to a predetermined learning rate, the update amount is applied to the current Actor and Critic network parameters, completing the numerical update of the Actor and Critic network parameters. The specific numerical changes of the Actor and Critic network parameters caused by the update are recorded and packaged as adjustment data.

[0052] It should also be noted that the predetermined learning rate is usually determined based on empirical values ​​(e.g., set to 0.001) or through hyperparameter tuning (e.g., grid search) to balance convergence speed and stability during training, so as to avoid training divergence due to excessively large update step size, or convergence that is too slow due to excessively small step size.

[0053] S2.8. Based on the adjusted data, update the parameters and reconstruct the logic of the Actor network to generate an optimized security protection strategy.

[0054] Specifically, the parameter changes recorded in the data are adjusted and applied to the current parameters of the Actor network according to a predetermined learning rate, thus updating the Actor network parameters. The update of the Actor network parameters directly changes the mathematical mapping relationship between the input security state features and the output protection action probability within the Actor network, thereby realizing the logical reconstruction of the Actor network. The logically reconstructed Actor network can output an optimized new protection decision action probability distribution based on real-time security state features. The optimized new protection decision action mapping relationship is defined as the optimized security protection strategy.

[0055] It should be noted that the continuous learning capability of the deep reinforcement learning model enables the adjustment of protection strategies. Unlike traditional static rule-driven protection, the deep reinforcement learning model can dynamically learn based on real-time collected security data, attack patterns, and feedback, thereby continuously optimizing security protection strategies to cope with new and unknown attack methods. It not only achieves automated optimization of strategies but also adjusts protection behavior according to real-time threats, avoiding the limitations of relying on manual intervention and fixed rules in the traditional approach.

[0056] S3. Simulate the execution of the optimized security protection strategy, and conduct a comprehensive evaluation based on the success rate, false alarm rate and execution time to generate a security assessment report.

[0057] S3.1 Utilize the simulation function of the trained deep reinforcement learning model, take the optimized security protection strategy as input, and combine the state and action space to simulate the execution process under different attack scenarios and environmental states, and generate execution feedback data.

[0058] Specifically, utilizing the simulation capabilities of the trained deep reinforcement learning model, the optimized security protection strategy is taken as input and, combined with the state and action space, the deep reinforcement learning model simulates the execution process of the optimized security protection strategy in common scenarios in the industrial internet environment, such as APT attacks, botnet attacks, and tampering of critical control commands. By evaluating changes in the environment and security threats, the model executes corresponding protective behaviors and generates feedback data. During the simulation, the trained deep reinforcement learning model selects protection strategies based on factors such as attack type, network status, and operational status, and generates execution feedback data, such as the attack identification accuracy (required to be greater than 95%), protection response time (required to be less than 3 seconds), and false alarm rate (required to be less than 5%) of the protection strategy under different attack scenarios.

[0059] S3.2 Extract success rate, false alarm rate and execution time from the execution feedback data, and integrate them to generate evaluation input data.

[0060] Specifically, based on the execution results of each protective action, the success rate (the proportion of attacks successfully intercepted by the protective measures), the false alarm rate (the proportion of normal behavior incorrectly identified as an attack by the protective measures), and the execution time (the time required from identifying an attack to taking protective measures) are extracted. During the extraction process, the execution effect of each protective action under different attack scenarios is recorded, and the success rate, false alarm rate, and execution time are integrated to generate evaluation input data.

[0061] S3.3 By evaluating the input data, calculate the success rate, false alarm rate and execution time in different attack scenarios, and evaluate the execution effect of the optimized security protection strategy to generate security protection effect evaluation data.

[0062] Specifically, the evaluation input data is provided to the trained deep reinforcement learning model. The trained deep reinforcement learning model then simulates the execution process of the optimized security protection strategy based on the evaluation input data. During the simulation, the trained deep reinforcement learning model analyzes the execution of each protective action and calculates various performance indicators, such as execution time, success rate, and false alarm rate. The expression for calculating the execution time is: ; in, For execution time, The time when the protective measures are completed. The time when protective measures begin to be implemented; The expression for calculating the success rate is: ; in, For the success rate, The number of times the protection strategy successfully blocked an attack. Total number of attacks that the protection strategy attempted to block; The expression for calculating the false alarm rate is: ; in, For false alarm rate, This is the number of times a trained deep reinforcement learning model incorrectly identifies normal behavior as an attack. The total number of alerts issued for the protection strategy; By calculating execution time, success rate, and false alarm rate, the trained deep reinforcement learning model analyzes the performance of the optimized security protection strategy under different security threats. Execution time reflects the response speed of the optimized security protection strategy, success rate indicates the effectiveness of the optimized security protection strategy in practical applications, and false alarm rate measures the accuracy of the optimized security protection strategy, generating security protection effect evaluation data.

[0063] S3.4 Based on the security protection effect assessment data, comprehensively determine the overall protection capability of the optimized security protection strategy, generate security assessment result data, summarize and organize it, and generate a security assessment report.

[0064] Specifically, based on security protection effectiveness assessment data, execution time, success rate, and false alarm rate are collected and organized to form a description of the performance of the optimized security protection strategy under different security threats. This reflects the response speed, effectiveness, and accuracy of the protection strategy in the face of various attack types. Combined with the execution status of the optimized security protection strategy, execution time, success rate, and false alarm rate are collected to organize the performance of the protection strategy under different attack scenarios. Based on the response speed, effectiveness, and accuracy of the protection strategy under various attack methods, its adaptability under different attack types is examined, generating security assessment result data. The security assessment result data is summarized and organized to ensure data integrity and consistency, and finally compiled into a security assessment report. The security assessment report records in detail the execution effect and protection capability of the optimized security protection strategy under various security threats, providing strong support for subsequent security strategy adjustments, optimizations, and decision-making.

[0065] S4. Using encrypted storage methods, the security assessment report and the security event data collected by real-time monitoring are encrypted, hashed, signed, and stored on the blockchain to generate security event data records.

[0066] S4.1 The security event data collected in real time is obtained by continuously monitoring and dynamically capturing the operating status of various terminals, network communication behavior, access control logs and abnormal event records in the industrial Internet environment.

[0067] Specifically, the system monitors the terminal's operational status, continuously tracking changes in its working status, including information such as device startup, shutdown, errors, and malfunctions; monitors network communication behavior, recording network behaviors such as data packet transmission, protocol type, and traffic volume, and detecting any abnormal or illegal communication; collects access control logs in real time, recording information such as user login, access permission verification, and access duration to analyze user behavior patterns; captures abnormal event records in real time, promptly recording potential security issues or attack events, such as intrusion detection, access anomalies, and other anomalies; and generates real-time security event data through continuous monitoring and dynamic capture of terminal operational status, network communication behavior, access control logs, and abnormal event records, providing a foundation for real-time security protection. Security event data recording refers to the data that records and encrypts all security events, including information such as event type, level, and response results.

[0068] S4.2 Input the security assessment report and security event data collected by real-time monitoring into the encrypted storage method, perform data encryption and hash signature processing, and generate encrypted storage data.

[0069] Specifically, the security assessment report and security incident data collected through real-time monitoring are organized into a format suitable for blockchain storage. This includes structuring text and log data to ensure they meet blockchain storage requirements; using symmetric or asymmetric encryption algorithms to encrypt the stored data, ensuring it is not leaked or tampered with during storage; during encryption, the stored data is converted into a format that only authorized parties holding the key can decrypt; a hash signature is then performed on the encrypted data to calculate a unique hash value; the hash value is a fixed-length representation of the encrypted data, and any minor modification will result in a change in the hash value, ensuring the integrity and immutability of the encrypted data; the encrypted data and hash signature are packaged together and stored in the blockchain using encrypted storage methods, ensuring that the security assessment report and security incident data can be permanently preserved and their authenticity and integrity can be verified at any time, generating encrypted storage data.

[0070] It should also be noted that the encrypted storage method refers to the process of encrypting and distributing security assessment reports and security event data collected by real-time monitoring using blockchain. In this process, the security assessment reports and security event data collected by real-time monitoring are first encrypted to ensure that the content cannot be accessed or modified by unauthorized personnel during storage. The encrypted data is then used to generate a unique hash value through the SHA-256 hash algorithm. This hash value is used to ensure data integrity; any modification to the security assessment reports and security event data collected by real-time monitoring will cause a change in the hash value, thus enabling the detection of data tampering. The security assessment reports and security event data collected by real-time monitoring are divided into blocks and stored through the blockchain network. Each data block is connected to the previous data block, forming a continuous and immutable chain.

[0071] S4.3. Timestamp, generate hash digests and verify integrity of encrypted stored data, construct block structure and write it into the blockchain to generate security event data records, which include event level, handling results, response time and triggering rules.

[0072] Specifically, the encrypted storage data is timestamped to record the creation and update times, ensuring chronological order and immutability. A hash algorithm is used to generate a hash digest of the encrypted storage data, producing a fixed-length hash value to ensure integrity and quickly verify any changes to the data during storage. Integrity checks ensure that the data has not been modified or corrupted during encrypted storage. The encrypted storage data, timestamps, and hash values ​​are combined to construct a block structure. Each block contains the encrypted storage data, hash digest, timestamp, and related metadata, such as event level, handling result, response duration, and triggering rules. The constructed blocks are written to the blockchain to generate secure event data records, ensuring immutability, traceability, and security.

[0073] It should also be noted that the incident level refers to the classification of incidents based on their severity and scope of impact, typically divided into high, medium, and low levels, to indicate the urgency and priority of the incident; the handling result refers to the response measures and their effectiveness for a specific security incident, such as whether the incident has been successfully isolated and whether the attack has been prevented; the response time refers to the time taken from when a security incident is triggered to when protective measures begin to be implemented, used to measure the response speed and real-time performance of protective measures; the triggering rule refers to the rule or algorithm that activates protective measures under specific conditions, including specific behavioral patterns, values ​​when abnormal events occur, or other security policy conditions, to ensure that protective policies can be activated at the appropriate time and respond to potential threats.

[0074] It should be noted that by combining encrypted storage methods with secure data storage, the immutability and decentralization of blockchain ensure that the stored data cannot be tampered with or forged, thus providing high credibility and transparency in data storage. Traditional security event data storage usually relies on centralized databases, which are vulnerable to external attacks or internal tampering during the storage process. In particular, once security event records are tampered with, it can lead to misjudgments or omissions in the protection capabilities.

[0075] S5. Based on security incident data records, identify the effectiveness and weaknesses of existing security protection capabilities through pattern mining and inductive analysis, and generate actionable security optimization decisions.

[0076] S5.1 Extract security-related behavioral patterns and historical response results from security incident data records, and identify existing security protection capabilities through inductive analysis.

[0077] Specifically, based on the event types, behavioral patterns, and historical response information recorded in security incident data, the protective measures and response actions taken under different security incident conditions are identified. Protective behaviors corresponding to each type of security incident, including blocking, isolation, and alarm measures, are extracted from historical response results. By summarizing and analyzing behavioral patterns and historical response results, a summary of protective measures and response methods is formed, clarifying the effectiveness and adaptability of each protective behavior under different attack scenarios, identifying existing security protection capabilities, and revealing the effectiveness and limitations of current protective measures in dealing with different attack types and behavioral patterns, providing a basis for subsequent optimization of protection strategies.

[0078] S5.2. Employ a strategy simulation evaluation method using a post-trained deep reinforcement learning model to construct typical attack scenarios and simulate the strategy response process. Conduct simulated stress tests and comprehensive evaluations of existing security protection capabilities, and generate an optimization decision report. The optimization decision report includes the analysis results of protection capabilities, risk response performance, and the basis for improvement suggestions.

[0079] Specifically, a strategy simulation evaluation method using a post-trained deep reinforcement learning model is employed to construct typical attack scenarios, simulate different types of security threats, and combine these typical attack scenarios with optimized security protection strategies to evaluate the strategies' response processes to different attacks. During the simulation, the deep reinforcement learning model adjusts different steps in strategy execution to simulate the implementation of security protection strategies, recording the effectiveness of each strategy's response. Using the simulation results, existing security protection capabilities are subjected to simulated stress tests and comprehensive evaluations. The performance of protection strategies in response to different attack scenarios is analyzed, including indicators such as strategy effectiveness, response speed, and false alarm rate. An optimization decision report is generated, which includes the analysis results of protection capabilities, risk response performance, and the basis for improvement suggestions. Specific recommendations are provided, such as strengthening the ability to identify new attack patterns, optimizing the response time of protection rules, and reducing the false alarm rate, in order to optimize existing protection strategies and improve overall security protection capabilities.

[0080] It should also be noted that the strategy simulation evaluation method refers to constructing various attack scenarios to simulate the response process of security protection strategies under different security threats in order to evaluate the effectiveness of the protection strategies; using deep reinforcement learning models to simulate the execution of strategies in different environments, and analyzing their performance in responding to attacks, including indicators such as response time, success rate, and false alarm rate; through repeated simulation and evaluation, the advantages and disadvantages of existing security protection strategies can be identified, and data support can be provided to optimize the protection strategies. The protection capability analysis results summarize the performance of the optimized security protection strategy under different security threats. It typically includes indicators such as the effectiveness, response speed, and adaptability of the protection strategy in various attack scenarios. This provides a clear understanding of the strategy's performance in practical applications and identifies its strengths and weaknesses. Risk response performance describes the effectiveness of the protection strategy in responding to various risks, specifically including response time, success rate, and false alarm rate. This reflects the strategy's real-time response capability and accuracy in the face of different attacks. Improvement recommendations are based on the protection capability analysis results and risk response performance, proposing improvements and optimization suggestions for the existing protection strategy to enhance its overall effectiveness. This provides guidance for subsequent optimization and adjustment of the protection strategy, ensuring that protection measures can more accurately address future security threats.

[0081] S5.3 Based on the optimization decision report, identify the weak links in the current security protection, and based on the event level and handling results in the security incident data record, analyze the degree of risk impact and response capability, and propose protective measures and improvement suggestions.

[0082] Specifically, based on the optimization decision report, the protection results of various security incidents are extracted from the existing security protection strategies to determine whether security protection measures have failed to effectively prevent attacks or have been slow to respond. Based on the incident level and handling results in the security incident data records, the impact of each incident and the response effectiveness of the protection measures are further subdivided, recording the processing time, handling results, and impact on overall security for each incident. Based on the incident level, handling results, and response time in the security incident data records, the risk level of different incident types and the execution capability of protection measures are determined to ensure that the protection strategies adopted in each situation can respond quickly and effectively. This is achieved by analyzing the severity of each security incident and the measures already taken. The effectiveness and response time of protective measures are assessed to determine the resilience of protection strategies under different attack scenarios, ensuring timely activation and adaptation to various security threats. Recommendations for protection measures and improvements are proposed, such as: adding multi-factor authentication to strengthen access control for terminals and users; optimizing traffic analysis to enhance real-time monitoring of abnormal network behavior and improve intrusion detection accuracy; adjusting the response time of protection strategies to ensure timely activation of protective measures and reduce potential losses; and improving false alarm rate control to reduce the probability of normal operations being misjudged as attacks and lower unnecessary alarms. The aim is to strengthen protection against high-risk events, improve response speed and accuracy, and thereby optimize overall security capabilities.

[0083] S5.4 Integrate the protective measures, improvement suggestions, and the results of the protective capability analysis in the optimization decision report to generate an executable security optimization decision.

[0084] Specifically, the analysis results of protection capabilities in the optimization decision report are combined with the proposed protection measures and improvement suggestions to ensure that each improvement measure corresponds to the weaknesses mentioned in the protection capability analysis results. The protection measures and improvement suggestions are matched with specific security incidents and attack scenarios to ensure that each improvement suggestion can effectively improve the protection effect in practical applications. The protection capability analysis results, protection measures and improvement suggestions in the optimization decision report are integrated to generate executable security optimization decisions, so that each decision is based on the protection capability analysis results and actual security needs, and ensures that the improved protection strategy can quickly and accurately respond to future security threats.

[0085] It is important to note that the intelligent assessment method and optimization decision generation process provided by this invention are specifically designed for industrial internet security scenarios. "Terminals" encompass industrial field devices such as PLCs, DCSs, and intelligent sensors; "network communication" includes industrial protocols such as MODBUS / TCP and OPC UA; and "security events" specifically refer to threats such as scanning and detection of industrial control systems, abnormal command injection, and tampering with process parameters. By connecting to the multi-source heterogeneous data streams unique to the industrial environment and utilizing deep reinforcement learning models to adaptively optimize strategies and perform stress tests on typical industrial attack chains in a simulation environment, the "executable security optimization decisions" can be directly used to strengthen the defense-in-depth system of industrial control networks, improve the real-time response and recovery capabilities against emerging threats such as APT attacks and ransomware, and effectively meet the stringent requirements of industrial production for high reliability, strong real-time performance, and continuity in security protection.

[0086] This embodiment also provides a computer device applicable to the intelligent assessment method for data security protection capabilities, including: a memory and a processor; the memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions to implement the intelligent assessment method for data security protection capabilities proposed in the above embodiment.

[0087] The computer device can be a terminal, comprising a processor, memory, communication interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, carrier networks, NFC (Near Field Communication), or other technologies. The display screen can be an LCD screen or an e-ink screen. The input devices can be a touch layer covering the display screen, buttons, a trackball, or a touchpad on the computer device's casing, or an external keyboard, touchpad, or mouse.

[0088] This embodiment also provides a storage medium storing a computer program. When executed by a processor, the program implements the intelligent assessment method for data security protection capabilities as proposed in the above embodiments. The storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read Only Memory (EPROM), Programmable Red-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0089] In summary, this invention, through the steps of real-time acquisition of multi-source heterogeneous data streams and data cleaning, denoising, and formatting to generate a security dataset, can obtain real-time and high-quality security data from multiple data sources. After processing, it provides an accurate training foundation for subsequent deep reinforcement learning models. Through efficient data preprocessing, it ensures the accuracy and consistency of data during the training process of deep reinforcement learning models, thereby enhancing the effectiveness and real-time adaptability of security protection strategies.

[0090] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A method for intelligently assessing data security protection capabilities, characterized in that: include, Real-time acquisition of multi-source heterogeneous data streams, data cleaning, noise reduction and formatting, generating secure datasets; Based on a security dataset, a state and action space is constructed using terminal behavior, network communication, and historical security events. A deep reinforcement learning model is then built using an Actor-Critic network structure and trained using the PPO reinforcement learning algorithm. The specific steps are as follows. Based on terminal behavior, network communication, and historical security events, a multi-dimensional state space is constructed, and a set of security response actions including isolation, blocking, alarm, and rate limiting operations is defined to form a state and action space. Extract terminal state changes and network traffic anomalies from the security dataset as security state features, and match them with protection actions in historical security response records to construct security protection behaviors. Based on attack identification accuracy, defense response effectiveness, and false alarm rate metrics, a dynamic reward function is designed, and an initial deep reinforcement learning model is constructed using an Actor-Critic network structure. The Actor network is responsible for outputting action policies, while the Critic network is responsible for evaluating state value. The PPO reinforcement learning algorithm is adopted. The initial deep reinforcement learning model is trained in multiple rounds using a security dataset as a sample. The security protection behavior of the initial deep reinforcement learning model is optimized by adjusting the dynamic reward function. After training, it is deployed to the actual environment and the parameters are updated online based on the real-time security dataset to generate the trained deep reinforcement learning model. Continuously learn and adaptively optimize security protection behaviors to generate optimized security protection strategies; The optimized security protection strategy is simulated and executed, and a comprehensive evaluation is conducted based on the success rate, false alarm rate and execution time to generate a security assessment report; By using encrypted storage methods, security assessment reports and security event data collected by real-time monitoring are encrypted, hash-signed, and stored on the blockchain to generate security event data records. Based on security incident data records, pattern mining and inductive analysis are used to identify the effectiveness and weaknesses of existing security protection capabilities, and generate actionable security optimization decisions.

2. The intelligent assessment method for data security protection capabilities as described in claim 1, characterized in that: The specific steps for generating the secure dataset are as follows: Collect terminal operating status, network communication behavior and access records to form a multi-source heterogeneous data stream; Noise filtering and data cleaning are performed on multi-source heterogeneous data streams to generate a processed dataset. The processed datasets are uniformly converted into the JSON standard format and transmitted in encrypted form. Data integrity is verified through hash check to generate a secure dataset.

3. The intelligent assessment method for data security protection capabilities as described in claim 1, characterized in that: The specific steps for generating the optimized security protection strategy are as follows: The security status features are input into the trained deep reinforcement learning model, and the Actor network is used to evaluate and learn policies in the state and action space to generate a set of protection decision actions. The action is executed in the protection decision action set, the state result after the action is executed is observed in the interactive environment, and the state result is calculated using a dynamic reward function to obtain the strategy benefit; Based on the policy benefits, the parameters of the Actor network and Critic network are updated through gradient backpropagation to generate adjustment data; Based on the adjusted data, the parameters of the Actor network are updated and the logic is reconstructed to generate an optimized security protection strategy.

4. The intelligent assessment method for data security protection capabilities as described in claim 3, characterized in that: The specific steps for generating the security assessment report are as follows: By utilizing the simulation capabilities of the trained deep reinforcement learning model, the optimized security protection strategy is taken as input, and the execution process under different attack scenarios and environmental conditions is simulated in combination with the state and action space to generate execution feedback data. Success rate, false alarm rate, and execution time are extracted from execution feedback data and integrated to generate evaluation input data; By evaluating the input data, the success rate, false alarm rate, and execution time in different attack scenarios are calculated, and the effectiveness of the optimized security protection strategy is evaluated to generate security protection effectiveness evaluation data. Based on the security protection effectiveness assessment data, the overall protection capability of the optimized security protection strategy is comprehensively judged, security assessment result data is generated, and then summarized and organized to generate a security assessment report.

5. The intelligent assessment method for data security protection capabilities as described in claim 1, characterized in that: The security event data collected in real-time monitoring is obtained by continuously monitoring and dynamically capturing the operating status of various terminals, network communication behavior, access control logs, and abnormal event records in the industrial internet environment.

6. The intelligent assessment method for data security protection capabilities as described in claim 1, characterized in that: The specific steps for generating security event data records are as follows: The security assessment report and security event data collected by real-time monitoring are input into the encrypted storage method, and the data is encrypted and hashed to generate encrypted storage data. The encrypted stored data is timestamped, hash digests are generated, and integrity is verified. A block structure is constructed and written into the blockchain to generate security event data records, which include event level, handling results, response time, and triggering rules.

7. The intelligent assessment method for data security protection capabilities as described in claim 1, characterized in that: The specific steps for generating executable security optimization decisions are as follows: Extract security-related behavioral patterns and historical response results from security incident data records, and identify existing security protection capabilities through inductive analysis; A strategy simulation evaluation method using a post-trained deep reinforcement learning model is adopted to construct typical attack scenarios and simulate the strategy response process. The existing security protection capabilities are subjected to simulated stress tests and comprehensive evaluations, and an optimization decision report is generated. The optimization decision report includes the protection capability analysis results, risk response performance, and the basis for improvement suggestions. Based on the optimized decision-making report, identify the weak links in the current security protection, and based on the event level and handling results in the security incident data record, analyze the degree of risk impact and response capability, and propose protective measures and improvement suggestions; The protective measures, improvement suggestions, and the results of the protective capability analysis in the optimization decision report are integrated and processed to generate actionable security optimization decisions.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, it implements the steps of the intelligent evaluation method for data security protection capabilities as described in any one of claims 1 to 7.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by the processor, it implements the steps of the intelligent evaluation method for data security protection capabilities as described in any one of claims 1 to 7.

Images