A data security threat dynamic monitoring method and system

Abstract

The present application relates to the technical field of data security, and more particularly to a data security threat dynamic monitoring method and system, comprising the following steps: constructing a normal data structure model, performing structure consistency detection and semantic threat probability calculation on the data to be detected; when the abnormal condition is met, performing multi-layer recursive decoding analysis; extracting risk features and calculating a comprehensive risk score; performing state migration based on the risk state machine and conducting risk propagation analysis; performing byte-level positioning and stripping processing on the threat segment, and performing risk access control, state rollback and weight adaptive update according to the score change. By constructing a normal data structure model, performing structure deviation detection, semantic threat calculation and recursive decoding analysis on the data to be detected, extracting risk features and calculating a comprehensive risk score, combining the risk state machine and the access correlation graph for risk propagation analysis, positioning and stripping the threat segment, and performing risk control and weight update according to the score change.

Description

Technical Field

[0001] This invention relates to the field of data security technology, and in particular to a method and system for dynamic monitoring of data security threats. Background Technology

[0002] With the widespread application of information systems, cloud computing platforms, and cross-domain data exchange systems, the transmission, parsing, and access of various business data in the network environment are becoming increasingly complex. During transmission, data often undergoes protocol encapsulation, encoding, and multi-layered nested structure organization, accompanied by numerous user access behaviors and system interactions, resulting in highly dynamic and complex data structures, semantic content, and access relationships. To ensure the security of data transmission and usage, existing systems typically deploy security detection mechanisms at data entry points or transmission nodes to identify threats and monitor risks in data content, preventing malicious data, abnormal access, or potential attacks from impacting system operation and data assets.

[0003] Traditional data security threat monitoring relies solely on single-rule matching or single-stage anomaly detection methods, lacking multi-dimensional feature joint analysis and dynamic risk control mechanisms, resulting in insufficient threat identification capabilities in complex data environments. Summary of the Invention

[0004] To overcome the above shortcomings, this invention provides a method and system for dynamic monitoring of data security threats, aiming to improve the problem that traditional data security threat monitoring mostly adopts single rule matching or single-stage anomaly detection methods, which easily leads to insufficient threat identification capabilities in complex data environments.

[0005] In a first aspect, the present invention provides the following technical solution: a method for dynamic monitoring of data security threats, comprising the following steps:

[0006] S1. Construct a normal data structure model based on standard protocol specifications and historical compliant data samples; obtain the data to be detected, and perform structural consistency deviation detection and semantic threat probability calculation on the data to be detected;

[0007] S2. When the structural consistency deviation detection or semantic threat probability calculation result meets the preset abnormal triggering condition, multi-layer recursive decoding analysis with a maximum depth threshold limit is started on the data to be detected.

[0008] S3. Extract the risk features corresponding to the structural consistency deviation detection, semantic threat probability calculation and multi-layer recursive decoding analysis results. After normalizing the risk features, calculate the comprehensive risk score of the data to be detected and construct the risk feature vector.

[0009] S4. Construct a risk state machine model, and drive the risk state machine model to perform state transitions based on the comprehensive risk score; construct an access association graph by combining the subject access association data corresponding to the data to be detected, and perform risk propagation path analysis and propagation impact quantification.

[0010] S5. Combining the structural consistency deviation detection, semantic threat probability calculation and multi-layer recursive decoding analysis results, perform byte-level positioning of threat fragments in the data to be detected, and perform stripping processing on the located threat fragments to generate security data.

[0011] S6. Based on the temporal changes of the comprehensive risk score and the state transition results of the risk state machine model, perform risk access control, risk state rollback that meets the preset rollback conditions, and adaptive update of the calculated weights corresponding to the risk features.

[0012] By adopting the above technical solution, a normal data structure model is constructed, and structural consistency deviation detection, semantic threat probability calculation, and multi-layer recursive decoding analysis are performed on the data to be detected. Risk features are extracted and a comprehensive risk score is calculated. Then, a risk state machine model is used to perform state transition and risk propagation path analysis is performed in conjunction with the access association graph. At the same time, threat fragments are located and stripped at the byte level to generate security data. Based on the changes in risk score, risk access control, risk state rollback, and adaptive update of feature weights are performed. This improves the problem that traditional data security threat monitoring relies only on single rule matching or single-stage anomaly detection methods, lacks multi-dimensional feature joint analysis and dynamic risk control mechanisms, and has insufficient threat identification capabilities in complex data environments.

[0013] Furthermore, in S1, the step of constructing a normal data structure model based on standard protocol specifications and historical compliance data samples includes:

[0014] Parse the field definitions, field order rules, and nesting structure rules in the standard protocol specification to generate a protocol structure template;

[0015] Collect historical compliance data samples and classify them according to the agreement type;

[0016] Structural features are extracted from historical compliance data samples, including the number of fields, field nesting level, field order features, field length distribution, and coding identifiers.

[0017] Based on the extracted structural features, a structural feature vector is constructed, and statistical calculations are performed on the structural feature vector to obtain the structural feature statistical parameters;

[0018] Generate a normal data structure model based on the protocol structure template and statistical parameters of structural features.

[0019] Furthermore, in S1, the step of performing structural consistency deviation detection and semantic threat probability calculation on the data to be detected includes:

[0020] The protocol is parsed on the data to be detected to extract the structural features of the data and construct the structural feature vector of the data to be detected.

[0021] The structural consistency deviation value is calculated based on the structural feature statistical parameters corresponding to the structural feature vector of the structure to be detected and the normal data structure model.

[0022] Semantic features are extracted from the data to be detected, including data payload content features, parameter combination features, and encoding features.

[0023] The semantic threat probability value corresponding to the data to be detected is calculated based on the semantic features and the pre-built threat probability model.

[0024] Output structural consistency deviation value and semantic threat probability value.

[0025] Further, in S2, the step of initiating multi-layer recursive decoding analysis with a maximum depth threshold limit on the data to be detected includes:

[0026] Perform a coding feature scan on the data to be tested to identify the coding identifier;

[0027] Initialize the recursive depth count and set the maximum depth threshold when the encoded identifier is detected;

[0028] According to the encoding type corresponding to the encoding identifier, the data to be detected is decoded to obtain decoded data, and the recursion depth count is updated on the decoded data and the encoding feature scan is performed;

[0029] When the recursive depth count is less than the maximum depth threshold and there is an encoded identifier in the decoded data, continue to perform the decoding operation on the decoded data, and repeat the recursive depth count update and encoded feature scan.

[0030] Decoding stops when the recursion depth count reaches the maximum depth threshold, and the current decoding result is output as the result of multi-layer recursive decoding analysis.

[0031] Furthermore, in S4, the step of constructing the risk state machine model and driving the risk state machine model to perform state transitions based on the comprehensive risk score includes:

[0032] Establish a set of risk states and assign a status identifier to each risk state;

[0033] Establish state transition rules between risk states and set corresponding comprehensive risk score ranges for each state transition rule;

[0034] Determine the current risk status corresponding to the data to be tested;

[0035] Match the overall risk score with the overall risk score range in the state transition rules;

[0036] When the comprehensive risk score meets the corresponding state transition rule, the current risk state is updated to the target risk state and the state transition path is recorded.

[0037] Furthermore, in S4, the step of constructing an access association graph by combining the subject access association data corresponding to the data to be detected includes:

[0038] Extract the access subject identifier and access object identifier from the subject access association data;

[0039] Construct a set of access subject nodes based on the access subject identifier;

[0040] Construct a set of access object nodes based on the access object identifier;

[0041] Establish access relationship edges between access subject nodes and access object nodes based on access records in the subject access association data;

[0042] Generate an access relationship graph based on the set of access subject nodes, the set of access object nodes, and access relationship edges.

[0043] Furthermore, in S5, the step of performing byte-level localization of threat fragments in the data to be detected includes:

[0044] Based on the structural consistency deviation detection results, the structural anomaly field range in the data to be detected is determined, and the semantic threat feature range in the data to be detected is determined based on the semantic threat probability calculation results. The structural anomaly field range and the semantic threat feature range are then mapped to the data payload byte range of the data to be detected.

[0045] Record the data offset relationship generated by each layer of recursive decoding based on the analysis results of the multi-layer recursive decoding, and establish the recursive decoding offset mapping relationship;

[0046] Threat candidate byte ranges are calculated based on the data payload byte range and the recursive decoding offset mapping relationship. Then, a byte-by-byte scan detection is performed on the threat candidate byte ranges to determine the threat fragment byte ranges in the data to be detected.

[0047] Furthermore, in S5, the step of performing stripping processing on the located threat fragments to generate security data includes:

[0048] Obtain the byte range of the threat fragment in the data to be detected, and extract the data segment before the threat fragment and the data segment after the threat fragment from the data to be detected based on the byte range of the threat fragment;

[0049] Generate structural placeholder data based on the protocol field type corresponding to the data to be detected;

[0050] The data segments before the threat fragment, the structural placeholder data, and the data segments after the threat fragment are spliced ​​together to generate security data.

[0051] The security data undergoes structural consistency correction processing based on the protocol field order and field length rules corresponding to the data to be tested.

[0052] Furthermore, in S6, the steps of performing risk access control, risk state rollback meeting preset rollback conditions, and adaptive update of the calculated weights corresponding to the risk features include:

[0053] Obtain the time-series change sequence of the comprehensive risk score, and combine it with the current state and state transition rules of the risk state machine model to determine the target risk state corresponding to the data to be detected;

[0054] Based on the correspondence between the target risk status and the preset access control rules, risk access control operations are performed on access requests to the data to be detected;

[0055] When the current state of the risk state machine model meets the preset backoff condition, the current state is transitioned to the corresponding low-risk state according to the state transition rules of the risk state machine model.

[0056] Extract the risk contribution value of the risk features involved in the comprehensive risk score calculation within the current time window, update the corresponding calculation weight of the risk features according to the correlation between the risk contribution value and the change of the comprehensive risk score, and use the updated calculation weight for subsequent comprehensive risk score calculations.

[0057] Secondly, the present invention provides the following technical solution: a dynamic monitoring system for data security threats, the system comprising:

[0058] The structure detection module is used to build a normal data structure model based on standard protocol specifications and historical compliant data samples; acquire the data to be detected; and perform structural consistency deviation detection and semantic threat probability calculation on the data to be detected.

[0059] The recursive decoding module is used to initiate multi-layer recursive decoding analysis with a maximum depth threshold limit on the data to be detected when the structural consistency deviation detection or semantic threat probability calculation result meets the preset abnormal triggering condition.

[0060] The risk assessment module is used to extract risk features corresponding to the structural consistency deviation detection, semantic threat probability calculation and multi-layer recursive decoding analysis results. After normalizing the risk features, it calculates the comprehensive risk score of the data to be detected and constructs a risk feature vector.

[0061] The propagation analysis module is used to construct a risk state machine model, drive the risk state machine model to perform state transitions based on the comprehensive risk score, construct an access association graph by combining the subject access association data corresponding to the data to be detected, and perform risk propagation path analysis and propagation impact quantification.

[0062] The threat stripping module is used to combine the structural consistency deviation detection, semantic threat probability calculation and multi-layer recursive decoding analysis results to perform byte-level location of threat fragments in the data to be detected, and to perform stripping processing on the located threat fragments to generate security data.

[0063] The control update module is used to perform risk access control, risk state rollback that meets preset rollback conditions, and adaptive update of the calculated weights corresponding to the risk features based on the time-series changes of the comprehensive risk score and the state transition results of the risk state machine model.

[0064] The present invention has the following beneficial effects:

[0065] 1. In this invention, a normal data structure model is constructed, and structural consistency deviation detection, semantic threat probability calculation, and multi-layer recursive decoding analysis are performed on the data to be detected. Risk features are extracted and a comprehensive risk score is calculated. Then, a risk state machine model is used to perform state transition and risk propagation path analysis is performed in conjunction with the access association graph. At the same time, threat fragments are located and stripped at the byte level to generate security data. Based on the changes in risk score, risk access control, risk state rollback, and adaptive update of feature weights are performed. This improves the problem that traditional data security threat monitoring relies only on single rule matching or single-stage anomaly detection methods, lacks multi-dimensional feature joint analysis and dynamic risk control mechanisms, and has insufficient threat identification capabilities in complex data environments.

[0066] 2. In this invention, the encoded feature scanning and identification of the data to be detected is performed, and multi-layer recursive decoding analysis is carried out under the condition of setting a maximum depth threshold. Multi-layer encoded data is parsed layer by layer under the control of recursive depth counting, thereby improving the problem that traditional data security detection only analyzes the original data or single-layer decoded data, which makes it difficult to identify the threat content hidden in the multi-layer encoded structure.

[0067] 3. In this invention, the structural consistency deviation detection result and the semantic threat probability calculation result are mapped to the data payload byte range, and the threat candidate byte range is determined by combining the recursive decoding offset mapping relationship. Then, the threat fragment is located by scanning byte by byte, and the located threat fragment is stripped and structural placeholder data is generated to complete the structural correction, thereby generating safe data. This improves the problem that the traditional security processing method uses overall interception or deletion of abnormal data, which leads to the blocking of legitimate data or the destruction of data structure. Attached Figure Description

[0068] Figure 1 This is a flowchart of a data security threat dynamic monitoring method proposed in this invention;

[0069] Figure 2 This is an architecture diagram of a data security threat dynamic monitoring system proposed in this invention. Detailed Implementation

[0070] The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0071] Example 1: In the first embodiment of the present invention, the present invention provides a method for dynamic monitoring of data security threats, such as... Figure 1 As shown, it includes the following steps:

[0072] S1. Construct a normal data structure model based on standard protocol specifications and historical compliant data samples; obtain the data to be detected, and perform structural consistency deviation detection and semantic threat probability calculation on the data to be detected;

[0073] Furthermore, in S1, the steps for constructing a normal data structure model based on standard protocol specifications and historical compliance data samples include:

[0074] Parse the field definitions, field order rules, and nesting structure rules in the standard protocol specification to generate a protocol structure template;

[0075] Collect historical compliance data samples and classify them according to the agreement type;

[0076] Structural features are extracted from historical compliance data samples. These features include the number of fields, the nesting level of fields, the order of fields, the distribution of field lengths, and the coding identifier.

[0077] Based on the extracted structural features, a structural feature vector is constructed, and statistical calculations are performed on the structural feature vector to obtain the structural feature statistical parameters;

[0078] Generate a normal data structure model based on the protocol structure template and statistical parameters of structural features.

[0079] Specifically, the input consists of standard protocol specifications and historical compliance data samples. The standard protocol specifications are taken from the officially released standard protocol text corresponding to the target business scenario. The historical compliance data samples are taken from historical session data without security event records collected from the business system. First, the standard protocol specifications are parsed to extract field definitions, field order rules, and nesting structure rules, generating a protocol structure template. The protocol structure template is used to constrain the compliance boundaries of subsequent structural feature extraction. Then, the collected historical compliance data samples are classified according to protocol type, so that historical compliance data samples in the same category correspond to the same protocol type and business scenario. For the classified historical compliance data samples, structural features are extracted from each sample. The structural features include the number of fields N. field Field nesting level L nest Field order feature S order Field length distribution D length and coding identifier I code Based on the extracted structural features, a structural feature vector StructuralVector=[N] is constructed. field ,L nest ,S order D length ,I code Statistical calculations are performed on the structural feature vectors corresponding to all historical compliant data samples under the same category. The field length distribution can be obtained by forming feature values ​​through statistical average field length or field length dispersion, thus obtaining the statistical parameters of the corresponding structural features. The statistical parameters include the mean vector μ=E[StructureVector] and variance vector σ of each dimension feature. 2 =Var[StructureVector], where the mathematical expectation calculation operator is represented by E[·] and the variance calculation operator is represented by Var[·]. Finally, based on the aforementioned generated protocol structure template and the calculated structural feature statistical parameters, a normal data structure model corresponding to the protocol type and business scenario is generated. The normal data structure model serves as the benchmark for subsequent structural consistency deviation detection and is used to calculate the degree of deviation between the data to be detected and the compliant data structure.

[0080] Furthermore, in S1, the steps of performing structural consistency deviation detection and semantic threat probability calculation on the data to be detected include:

[0081] The protocol is parsed on the data to be detected to extract the structural features of the data and construct the structural feature vector of the data to be detected.

[0082] The structural consistency deviation value is calculated based on the structural feature statistical parameters corresponding to the structural feature vector of the structure to be detected and the normal data structure model.

[0083] Semantic features are extracted from the data to be detected. These semantic features include data payload content features, parameter combination features, and encoding features.

[0084] The semantic threat probability value corresponding to the data to be detected is calculated based on the semantic features and the pre-built threat probability model.

[0085] Output structural consistency deviation value and semantic threat probability value.

[0086] Specifically, the input consists of the data to be detected and the normal data structure model generated in the preceding steps. The data to be detected is taken from real-time session data collected in the target business scenario. The normal data structure model includes protocol structure templates and structural feature statistical parameters corresponding to the protocol type and business scenario. First, protocol parsing is performed on the data to be detected to extract the structural features of the data to be detected and construct the structural feature vector of the data to be detected. The feature vector of the structure to be detected Its dimensions and composition are consistent with the structural feature vectors corresponding to normal data structure models, including the number of fields. Field nesting level Field order characteristics Field length distribution and coding identifier Then, based on the feature vector of the structure to be detected Mean vector in the structural feature statistical parameters corresponding to a normal data structure model Calculate the structural consistency deviation value The structural consistency deviation value is calculated using the Euclidean norm, and the calculation formula is as follows: mean vector The mathematical expectation result obtained by performing statistical calculations on the structural feature vectors of historical compliance data samples in the aforementioned steps, after calculating the structural consistency deviation value, is used to extract semantic features from the data to be detected. The semantic features include data payload content features, parameter combination features, and encoding features. Based on the extracted semantic features, a pre-built threat probability model is called to calculate the semantic threat probability value corresponding to the data to be detected. The threat probability model is built on a Bayesian probability framework, and the calculation formula is as follows:

[0087] ;

[0088] in This represents the conditional probability of the target's semantic features appearing in the threat sample. Let be the prior probability of the threatening event. To determine the probability of the occurrence of target semantic features in the full dataset, a pre-built threat probability model is trained using an open-source threat intelligence database and local attack and defense samples. The prior probability can be incrementally updated based on new samples, and the final output is the structural consistency deviation value. and semantic threat probability value The two output results are used to determine the subsequent abnormal triggering conditions, serve as the basis for starting the multi-layer recursive decoding analysis, and also serve as the basic input data for subsequent risk feature extraction and comprehensive risk score calculation.

[0089] S2. When the structural consistency deviation detection or semantic threat probability calculation result meets the preset abnormal triggering condition, multi-layer recursive decoding analysis with a maximum depth threshold limit is started on the data to be detected. If there is still a decodable identifier when the recursion depth exceeds the threshold, recursive abnormal fallback handling is performed.

[0090] Furthermore, in S2, the steps for initiating multi-layer recursive decoding analysis with a maximum depth threshold limitation on the data to be detected include:

[0091] Perform a coding feature scan on the data to be tested to identify the coding identifier;

[0092] Initialize the recursive depth count and set the maximum depth threshold when the encoded identifier is detected;

[0093] According to the encoding type corresponding to the encoding identifier, the data to be detected is decoded to obtain decoded data, and the recursion depth count is updated on the decoded data and the encoding feature scan is performed;

[0094] When the recursive depth count is less than the maximum depth threshold and there is an encoded identifier in the decoded data, continue to perform the decoding operation on the decoded data, and repeat the recursive depth count update and encoded feature scan.

[0095] Decoding stops when the recursion depth count reaches the maximum depth threshold, and the current decoding result is output as the result of multi-layer recursive decoding analysis.

[0096] Specifically, the input is the data to be detected, D. input With the preset maximum depth threshold D max Data to be detected D input The detection data is taken from the target business scenario obtained in the aforementioned steps, with a preset maximum depth threshold D. max Based on the pre-defined depth range of common business scenarios and multi-layered nested attacks, the data to be detected, D, is first... input Perform a coding feature scan to identify the coding identifier I. code Encoding identifier I codeThe identification is based on encoding protocol characteristics known to those skilled in the art, such as Base64, URL encoding, and JSON encoding, upon identifying the encoding identifier I. code At that time, initialize the recursion depth count D. count Set the value to 0, and simultaneously set the maximum depth threshold D. max According to the identified coded identifier I code The corresponding encoding type, the data to be detected D input Perform the decoding operation to obtain the first layer of decoded data D. decode,1 Then count the recursion depth D. count Perform an increment update to obtain D. count =D count +1, and update the decoded data D decode,1 Perform the encoded feature scan again, counting D at the recursion depth. count Less than the maximum depth threshold D max And the current decoded data contains the encoding identifier I. code At this point, the corresponding encoding type decoding operation is performed on the currently decoded data to obtain the next layer of decoded data D. decode,k Where k is the current recursion level, and the recursion depth count D is executed repeatedly. count The increment-1 update and encoding feature scan, in the recursive depth count D count Reaching the maximum depth threshold D max If the decoding operation stops immediately, output the current decoded data. As a result of multi-layer recursive decoding analysis, the output multi-layer recursive decoding analysis result is used for subsequent risk feature extraction, and also serves as auxiliary input data for subsequent threat fragment localization. If the encoded identifier I is not identified during the recursive process... code If so, the original data to be detected is directly output as the result of multi-layer recursive decoding analysis.

[0097] S3. Extract the risk features corresponding to the results of structural consistency deviation detection, semantic threat probability calculation and multi-layer recursive decoding analysis. After normalizing the risk features, calculate the comprehensive risk score of the data to be detected and construct the risk feature vector.

[0098] Specifically, the inputs are the structural consistency deviation detection results, semantic threat probability calculation results, and multi-layer recursive decoding analysis results. Corresponding risk features are extracted from these three results, including the structural consistency deviation value. Semantic threat probability value Recursion depth value Risk feature vectors are constructed based on the extracted risk features. ;in The deviation value is obtained from the structural consistency deviation detection. The probability value is calculated based on the semantic threat probability. For the recursive depth count obtained from multi-layer recursive decoding analysis, the risk feature vector is... The features in each dimension are normalized using the min-max normalization algorithm, and the calculation formula is as follows: ;in The first in the risk feature vector Each dimension of feature value, This is the minimum value of the feature in this dimension. The maximum value of this dimension feature. These are the normalized eigenvalues, and the normalized risk feature vector is obtained after normalization. Assign corresponding computational weights to each normalized feature. Calculate weights Based on a pre-defined hierarchy of risk characteristics, a comprehensive risk score is generated. The calculation formula is obtained through weighted summation. Output a comprehensive risk score With normalized risk feature vector Among them, the comprehensive risk score Used to drive the state transitions of subsequent risk state machine models, and to normalize risk feature vectors. Adaptive updates used for subsequent calculation of risk feature weights.

[0099] S4. Construct a risk state machine model and drive the risk state machine model to perform state transitions based on the comprehensive risk score; combine the subject access association data corresponding to the data to be detected to construct an access association graph, and perform risk propagation path analysis and propagation impact quantification.

[0100] Furthermore, in S4, the steps for constructing a risk state machine model and driving state transitions based on a comprehensive risk score include:

[0101] Establish a set of risk states and assign a status identifier to each risk state;

[0102] Establish state transition rules between risk states and set corresponding comprehensive risk score ranges for each state transition rule;

[0103] Determine the current risk status corresponding to the data to be tested;

[0104] Match the overall risk score with the overall risk score range in the state transition rules;

[0105] When the comprehensive risk score meets the corresponding state transition rule, the current risk state is updated to the target risk state and the state transition path is recorded.

[0106] Specifically, the input consists of the comprehensive risk score (RiskScore) calculated in the preceding steps and the subject access association data corresponding to the data to be detected. The comprehensive risk score (RiskScore) is calculated by normalizing the risk features corresponding to the results of structural consistency deviation detection, semantic threat probability calculation, and multi-layer recursive decoding analysis. The subject access association data is extracted from the data to be detected. First, a risk state set S={S0,S1,...,S...} is established. n}, and assign a unique status identifier ID to each risk status. state The state set covers the entire lifecycle of a risk, from its normal state to its spread, and then state transition rules R between risk states are established. trans And for each state transition rule R trans Set corresponding comprehensive risk score intervals [T] respectively min,i ,T max,i The comprehensive risk scoring range is pre-set based on the risk level classification requirements, and then the current risk state S is determined according to the initial detection results of the data to be detected. current The overall risk score (RiskScore) and the state transition rules (R) are combined. trans The corresponding comprehensive risk score range [T] min,i ,T max,i The matching process is performed, and when the overall risk score (RiskScore) falls within the overall risk score range corresponding to a certain state transition rule, the current risk state (S) is changed. current Updated to the target risk state S corresponding to this rule. target Simultaneously record the path of this state transition. trans Output the current state S of the risk state machine model. current Target risk status S target and state transition path trans The output is used to construct an access association graph by combining the subject access association data, providing a status basis for subsequent risk propagation path analysis and propagation impact quantification, and also serving as the core judgment basis for subsequent risk access control, status rollback and weight adaptive update.

[0107] Furthermore, in S4, the steps for constructing an access association graph by combining the subject access association data corresponding to the data to be detected include:

[0108] Extract the access subject identifier and access object identifier from the subject access association data;

[0109] Construct a set of access subject nodes based on the access subject identifier;

[0110] Construct a set of access object nodes based on the access object identifier;

[0111] Establish access relationship edges between access subject nodes and access object nodes based on access records in the subject access association data;

[0112] Generate an access relationship graph based on the set of access subject nodes, the set of access object nodes, and access relationship edges.

[0113] Specifically, the input is the subject access association data corresponding to the data to be detected. The subject access association data is extracted from the data to be detected and includes the access subject identifier, the access object identifier, and the access record. First, the access subject identifier ID is extracted from the subject access association data. subject With access object identifier ID object The access subject identifier is used to uniquely identify the subject initiating the access, and the access object identifier is used to uniquely identify the object being accessed. Subsequently, an access subject node set V is constructed based on all extracted access subject identifiers. subject Construct a set of access object nodes V based on all extracted access object identifiers. object The set of nodes accessing the subject and the set of nodes accessing the object together constitute the node set V=V of the access association graph. subject ∪V object Then, based on the access records in the subject access association data, an access relationship edge E is established between each node in the subject node set and each node in the object node set. The access relationship edge is used to represent the access association between the subject and the object. Finally, based on the subject node set, the object node set, and the access relationship edge, an access association graph G=(V,E) is generated. The output access association graph is used for subsequent risk propagation path analysis and propagation impact quantification, providing a graphical analysis basis for risk propagation tracking and impact assessment. The access association graph can clearly present the access association relationship between the subject and the object, supporting the location of the risk propagation path and the quantitative calculation of the degree of propagation impact.

[0114] S5. Combining the structural consistency deviation detection, semantic threat probability calculation and multi-layer recursive decoding analysis results, perform byte-level positioning on the threat fragments in the data to be detected, perform stripping processing on the positioned threat fragments to generate security data, perform triple integrity verification on the security data, and perform a fallback handling for verification failure when the verification fails.

[0115] Furthermore, in S5, the steps for performing byte-level localization of threat fragments in the data to be detected include:

[0116] Based on the structural consistency deviation detection results, the structural anomaly field range in the data to be detected is determined, and the semantic threat feature range in the data to be detected is determined based on the semantic threat probability calculation results. The structural anomaly field range and the semantic threat feature range are then mapped to the data payload byte range of the data to be detected.

[0117] Record the data offset relationship generated by each layer of recursive decoding based on the analysis results of the multi-layer recursive decoding, and establish the recursive decoding offset mapping relationship;

[0118] Threat candidate byte ranges are calculated based on the data payload byte range and the recursive decoding offset mapping relationship. Then, a byte-by-byte scan detection is performed on the threat candidate byte ranges to determine the threat fragment byte ranges in the data to be detected.

[0119] Specifically, the inputs are the data to be detected, the structural consistency deviation detection results, the semantic threat probability calculation results, and the multi-layer recursive decoding analysis results. The structural consistency deviation detection results are calculated by comparing the data to be detected with the normal data structure model. The semantic threat probability calculation results are obtained by operating on semantic features and the threat probability model. The multi-layer recursive decoding analysis results are obtained through decoding operations with a maximum depth threshold limit. First, based on the structural consistency deviation detection results, the structural anomaly field intervals in the data to be detected are determined. Based on the semantic threat probability calculation results, the semantic threat feature intervals in the data to be detected are determined. The structural anomaly field intervals and semantic threat feature intervals are uniformly mapped to the corresponding data payload byte intervals of the data to be detected. Then, based on the multi-layer recursive decoding analysis results, the data offset relationship generated by each layer of recursive decoding is recorded, and a recursive decoding offset mapping relationship is established. The recursive decoding offset mapping relationship represents the byte position correspondence between the original data and the decoded data of each layer. Based on the data payload byte intervals and the recursive decoding offset mapping relationship, the threat candidate byte intervals are calculated. A byte-by-byte feature scan detection is performed on the threat candidate byte intervals, and finally, the threat fragment byte intervals in the data to be detected are determined. The threat fragment byte intervals are defined with the starting byte coordinate Pos. start With terminating byte coordinates Pos end The threat fragment byte range is characterized and output for subsequent threat fragment stripping processing, providing a basis for generating compliant security data and ensuring the accuracy of the stripping operation and the lossless nature of data processing.

[0120] Furthermore, in S5, the steps for performing stripping processing on located threat fragments to generate security data include:

[0121] Obtain the byte range of the threat fragment in the data to be detected, and extract the data segment before the threat fragment and the data segment after the threat fragment from the data to be detected based on the byte range of the threat fragment;

[0122] Generate structural placeholder data based on the protocol field type corresponding to the data to be detected;

[0123] The data segments before the threat fragment, the structural placeholder data, and the data segments after the threat fragment are spliced ​​together to generate security data.

[0124] The security data undergoes structural consistency correction processing based on the protocol field order and field length rules corresponding to the data to be tested.

[0125] Specifically, the input includes the data to be detected, the byte range of the threat fragment, and the protocol field type, protocol field order, and field length rules corresponding to the data to be detected. The byte range of the threat fragment is determined through the aforementioned byte-level positioning steps, with the starting byte coordinate Pos. start With terminating byte coordinates Pos end The representation, protocol field type, protocol field order, and field length rules are derived from the previously constructed normal data structure model. First, the byte range of the threat fragment in the data to be detected is obtained. Based on this byte range, the data segment before and after the threat fragment is extracted from the data to be detected. The data segment before the threat fragment is the data from the start byte to Pos in the data to be detected. start The byte segment of -1, the data segment after the threat segment is the data to be detected from Pos. end The data fragments from +1 to the last byte are then processed. Next, structural placeholder data is generated based on the protocol field type corresponding to the data to be detected. The field format and length of the structural placeholder data conform to the specifications of the corresponding protocol fields. Then, the data segment before the threat fragment, the structural placeholder data, and the data segment after the threat fragment are concatenated according to the original field order of the data to be detected to obtain initial secure data. Finally, according to the protocol field order and field length rules corresponding to the data to be detected, structural consistency correction processing is performed on the initial secure data. During the correction process, the field alignment and length matching of the data fragments are adjusted to ensure compliance with protocol specifications. Finally, secure data is generated. The output secure data is used for subsequent triple integrity checks to verify whether the structure remains intact and the protocol compliant after data stripping, providing a foundation for subsequent secure data transmission and processing, while preventing damage to the original data structure due to threat fragment stripping.

[0126] S6. Based on the time-series changes of the comprehensive risk score and the state transition results of the risk state machine model, perform risk access control, risk state rollback that meets the preset rollback conditions, and adaptive update of the calculated weights corresponding to risk features.

[0127] Furthermore, in S6, the steps of performing risk access control, risk state rollback that meets preset rollback conditions, and adaptive update of the weights corresponding to risk features include:

[0128] Obtain the time-series change sequence of the comprehensive risk score, and combine it with the current state and state transition rules of the risk state machine model to determine the target risk state corresponding to the data to be detected;

[0129] Based on the correspondence between the target risk status and the preset access control rules, risk access control operations are performed on access requests to the data to be detected;

[0130] When the current state of the risk state machine model meets the preset backoff condition, the current state is transitioned to the corresponding low-risk state according to the state transition rules of the risk state machine model.

[0131] Extract the risk contribution value of the risk features involved in the comprehensive risk score calculation within the current time window, update the corresponding calculation weight of the risk features according to the correlation between the risk contribution value and the change of the comprehensive risk score, and use the updated calculation weight for subsequent comprehensive risk score calculations.

[0132] Specifically, the inputs are the time-series change sequence of the comprehensive risk score, the current state of the risk state machine model, state transition rules, preset access control rules, preset fallback conditions, and the weights corresponding to the risk features. The time-series change sequence of the comprehensive risk score is calculated from the comprehensive risk score RiskScore within a continuous time window. t The current state of the risk state machine model is S, as determined in the preceding steps. current State transition rules, preset access control rules, and preset fallback conditions are all pre-set based on business security requirements, and the calculation weights corresponding to risk characteristics are the initial weights W used in the comprehensive risk score calculation. i First, the time-series change sequence of the comprehensive risk score is obtained. Then, combining the current state and state transition rules of the risk state machine model, the target risk state corresponding to the data to be detected is determined. Based on the correspondence between the target risk state and the preset access control rules, risk access control operations are performed on the access requests to the data to be detected. When the current state of the risk state machine model meets the preset rollback conditions, the current state is transitioned to the corresponding low-risk state according to the state transition rules of the risk state machine model. Finally, the risk contribution value C of the risk features involved in the comprehensive risk score calculation within the current time window is extracted. i According to the risk contribution value C i The correlation between the risk feature and the change magnitude ΔRiskScore is updated to determine the corresponding calculated weights. The updated calculated weights are then applied to the subsequent calculation process of the comprehensive risk score. This step outputs the risk access control execution result, the low-risk state after the risk state machine is updated, and the adaptively updated calculated weights of the risk features. The risk access control execution result is used to suppress the further spread of data security threats, the updated low-risk state is used to restore the normal operation of the corresponding business, and the adaptively updated calculated weights are used to improve the accuracy of the subsequent comprehensive risk score calculation and ensure the continuous optimization of the dynamic monitoring process of data security threats.

[0133] Example 2: In data center networks or large campus networks, switches undertake the high-speed forwarding of large amounts of business data. Data packets generated by different business systems are continuously transmitted through the network via switch ports. When attackers construct abnormal protocol structure data or nested encoded data to hide malicious payloads within normal business data and enter the switch network, traditional switches typically rely on simple rule matching or static access control policies for detection. This makes it difficult to identify threat data hidden in the encoding layer, easily leading to the continuous propagation of abnormal data in the network. To solve the above problems, this invention provides a dynamic data security threat monitoring system, the structure of which is as follows: Figure 2 As shown;

[0134] The system is deployed on the data flow detection node of the switch to perform real-time security analysis on the data forwarded by the switch. The system includes a structure detection module, a recursive decoding module, a risk assessment module, a propagation analysis module, a threat stripping module, and a control update module.

[0135] After receiving service data, the switch first constructs a normal data structure model based on standard protocol specifications and historical compliant data samples by the structure detection module, and performs structure consistency deviation detection and semantic threat probability calculation on the data to be detected, thereby identifying abnormal protocol structure data and potential semantic threat data, and realizing the initial screening of abnormal data.

[0136] When the detection result meets the abnormal triggering condition, the recursive decoding module performs multi-layer recursive decoding analysis on the data to be detected with a maximum depth threshold limit, and parses the nested encoded data layer by layer, thereby identifying the threat content hidden in the multi-layer encoding and improving the switch's ability to parse complex attack data.

[0137] Subsequently, the risk assessment module extracts risk features from the structural inspection results and decoding analysis results and calculates a comprehensive risk score to form a risk feature vector. This vector is then used to conduct a unified risk quantification assessment of the data flow accessed by the switch, providing a basis for subsequent risk control.

[0138] The propagation analysis module constructs a risk state machine model based on the comprehensive risk score and performs state transitions. At the same time, it constructs an access association graph by combining the subject access association data recorded by the switch, analyzes the propagation path of risk data in the network and quantifies the propagation impact, thereby identifying potential risk diffusion relationships.

[0139] When threatening content is identified in the data, the threat stripping module performs byte-level location and stripping of the threat fragments, generating secure data while ensuring the integrity of the data structure, so that the processed data can continue to participate in the data forwarding process of the switch.

[0140] The control update module performs risk access control based on the time-series changes of the comprehensive risk score and the state transition results of the risk state machine model, and performs risk state rollback when preset conditions are met. At the same time, it adaptively updates the weights of risk features, enabling the system to dynamically optimize its risk identification capabilities based on actual operating conditions.

[0141] By deploying this system in a switch environment, dynamic monitoring of abnormal data structure, hidden coding threats, and risk propagation behaviors can be achieved during data forwarding, thereby improving the switch network's ability to identify and control data security threats.

[0142] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for dynamic monitoring of data security threats, characterized in that, Includes the following steps: S1. Construct a normal data structure model based on standard protocol specifications and historical compliant data samples; obtain the data to be detected, and perform structural consistency deviation detection and semantic threat probability calculation on the data to be detected; S2. When the structural consistency deviation detection or semantic threat probability calculation result meets the preset abnormal triggering condition, multi-layer recursive decoding analysis with a maximum depth threshold limit is started on the data to be detected. S3. Extract the risk features corresponding to the structural consistency deviation detection, semantic threat probability calculation and multi-layer recursive decoding analysis results. After normalizing the risk features, calculate the comprehensive risk score of the data to be detected and construct the risk feature vector. S4. Construct a risk state machine model, and drive the risk state machine model to perform state transitions based on the comprehensive risk score; construct an access association graph by combining the subject access association data corresponding to the data to be detected, and perform risk propagation path analysis and propagation impact quantification. S5. Combining the structural consistency deviation detection, semantic threat probability calculation and multi-layer recursive decoding analysis results, perform byte-level positioning of threat fragments in the data to be detected, and perform stripping processing on the located threat fragments to generate security data. S6. Based on the time-series changes of the comprehensive risk score and the state transition results of the risk state machine model, perform risk access control, risk state rollback that meets the preset rollback conditions, and adaptive update of the calculated weights corresponding to the risk features. The steps of performing risk access control, risk state rollback meeting preset rollback conditions, and adaptive update of the calculated weights corresponding to the risk features include: Obtain the time-series change sequence of the comprehensive risk score, and combine it with the current state and state transition rules of the risk state machine model to determine the target risk state corresponding to the data to be detected; Based on the correspondence between the target risk status and the preset access control rules, risk access control operations are performed on access requests to the data to be detected; When the current state of the risk state machine model meets the preset backoff condition, the current state is transitioned to the corresponding low-risk state according to the state transition rules of the risk state machine model. Extract the risk contribution value of the risk features involved in the comprehensive risk score calculation within the current time window, update the corresponding calculation weight of the risk features according to the correlation between the risk contribution value and the change of the comprehensive risk score, and use the updated calculation weight for subsequent comprehensive risk score calculations.

2. The data security threat dynamic monitoring method according to claim 1, characterized in that, In S1, the steps for constructing a normal data structure model based on standard protocol specifications and historical compliance data samples include: Parse the field definitions, field order rules, and nesting structure rules in the standard protocol specification to generate a protocol structure template; Collect historical compliance data samples and classify them according to the agreement type; Structural features are extracted from historical compliance data samples, including the number of fields, field nesting level, field order features, field length distribution, and coding identifiers. Based on the extracted structural features, a structural feature vector is constructed, and statistical calculations are performed on the structural feature vector to obtain the structural feature statistical parameters; Generate a normal data structure model based on the protocol structure template and statistical parameters of structural features.

3. The data security threat dynamic monitoring method according to claim 2, characterized in that, In S1, the steps of performing structural consistency deviation detection and semantic threat probability calculation on the data to be detected include: The protocol is parsed on the data to be detected to extract the structural features of the data and construct the structural feature vector of the data to be detected. The structural consistency deviation value is calculated based on the structural feature statistical parameters corresponding to the structural feature vector of the structure to be detected and the normal data structure model. Semantic features are extracted from the data to be detected, including data payload content features, parameter combination features, and encoding features. The semantic threat probability value corresponding to the data to be detected is calculated based on the semantic features and the pre-built threat probability model. Output structural consistency deviation value and semantic threat probability value.

4. The data security threat dynamic monitoring method according to claim 1, characterized in that, In S2, the step of initiating multi-layer recursive decoding analysis with a maximum depth threshold limit on the data to be detected includes: Perform a coding feature scan on the data to be tested to identify the coding identifier; Initialize the recursive depth count and set the maximum depth threshold when the encoded identifier is detected; According to the encoding type corresponding to the encoding identifier, the data to be detected is decoded to obtain decoded data, and the recursion depth count is updated on the decoded data and the encoding feature scan is performed; When the recursive depth count is less than the maximum depth threshold and there is an encoded identifier in the decoded data, continue to perform the decoding operation on the decoded data, and repeat the recursive depth count update and encoded feature scan. Decoding stops when the recursion depth count reaches the maximum depth threshold, and the current decoding result is output as the result of multi-layer recursive decoding analysis.

5. The data security threat dynamic monitoring method according to claim 1, characterized in that, In S4, the step of constructing the risk state machine model and driving the risk state machine model to perform state transitions based on the comprehensive risk score includes: Establish a set of risk states and assign a status identifier to each risk state; Establish state transition rules between risk states and set corresponding comprehensive risk score ranges for each state transition rule; Determine the current risk status corresponding to the data to be tested; Match the overall risk score with the overall risk score range in the state transition rules; When the comprehensive risk score meets the corresponding state transition rule, the current risk state is updated to the target risk state and the state transition path is recorded.

6. The data security threat dynamic monitoring method according to claim 1, characterized in that, In S4, the step of constructing an access association graph by combining the subject access association data corresponding to the data to be detected includes: Extract the access subject identifier and access object identifier from the subject access association data; Construct a set of access subject nodes based on the access subject identifier; Construct a set of access object nodes based on the access object identifier; Establish access relationship edges between access subject nodes and access object nodes based on access records in the subject access association data; Generate an access relationship graph based on the set of access subject nodes, the set of access object nodes, and access relationship edges.

7. The data security threat dynamic monitoring method according to claim 1, characterized in that, In S5, the step of performing byte-level localization of threat fragments in the data to be detected includes: Based on the structural consistency deviation detection results, the structural anomaly field range in the data to be detected is determined, and the semantic threat feature range in the data to be detected is determined based on the semantic threat probability calculation results. The structural anomaly field range and the semantic threat feature range are then mapped to the data payload byte range of the data to be detected. Record the data offset relationship generated by each layer of recursive decoding based on the analysis results of the multi-layer recursive decoding, and establish the recursive decoding offset mapping relationship; Threat candidate byte ranges are calculated based on the data payload byte range and the recursive decoding offset mapping relationship. Then, a byte-by-byte scan detection is performed on the threat candidate byte ranges to determine the threat fragment byte ranges in the data to be detected.

8. The data security threat dynamic monitoring method according to claim 1, characterized in that, In S5, the step of performing stripping processing on the located threat fragments to generate security data includes: Obtain the byte range of the threat fragment in the data to be detected, and extract the data segment before the threat fragment and the data segment after the threat fragment from the data to be detected based on the byte range of the threat fragment; Generate structural placeholder data based on the protocol field type corresponding to the data to be detected; The data segments before the threat fragment, the structural placeholder data, and the data segments after the threat fragment are spliced ​​together to generate security data. The security data undergoes structural consistency correction processing based on the protocol field order and field length rules corresponding to the data to be tested.

9. A dynamic monitoring system for data security threats, characterized in that, A data security threat dynamic monitoring method according to any one of claims 1-8, the system comprising: The structure detection module is used to build a normal data structure model based on standard protocol specifications and historical compliant data samples; acquire the data to be detected; and perform structural consistency deviation detection and semantic threat probability calculation on the data to be detected. The recursive decoding module is used to initiate multi-layer recursive decoding analysis with a maximum depth threshold limit on the data to be detected when the structural consistency deviation detection or semantic threat probability calculation result meets the preset abnormal triggering condition. The risk assessment module is used to extract risk features corresponding to the structural consistency deviation detection, semantic threat probability calculation and multi-layer recursive decoding analysis results. After normalizing the risk features, it calculates the comprehensive risk score of the data to be detected and constructs a risk feature vector. The propagation analysis module is used to construct a risk state machine model, drive the risk state machine model to perform state transitions based on the comprehensive risk score, construct an access association graph by combining the subject access association data corresponding to the data to be detected, and perform risk propagation path analysis and propagation impact quantification. The threat stripping module is used to combine the structural consistency deviation detection, semantic threat probability calculation and multi-layer recursive decoding analysis results to perform byte-level location of threat fragments in the data to be detected, and to perform stripping processing on the located threat fragments to generate security data. The control update module is used to perform risk access control, risk state rollback that meets preset rollback conditions, and adaptive update of the calculated weights corresponding to the risk features based on the time-series changes of the comprehensive risk score and the state transition results of the risk state machine model.

Images