Intelligent detection method and system for equal protection based on multi-source data

Abstract

The application discloses a multi-source data-based intelligent equal protection detection method and system, and belongs to the technical field of equal protection evaluation. The method specifically comprises the following steps: obtaining target network data, constructing a target network graph, converting node data into an associated feature set through a multi-source data association model based on a graph neural network, obtaining a penetration point feature subset by simulating attack evaluation on the associated feature set, obtaining a security configuration feature subset by performing strategy compliance evaluation on the associated feature set, calculating a security risk value through a dynamic evaluation model in combination with the penetration point feature subset and the security configuration feature subset, comparing the security risk value with a preset grade threshold, and obtaining a network security grade evaluation result. The data analysis depth during the evaluation of the target network is enhanced, and the accuracy and comprehensiveness of the network security grade evaluation are improved.

Description

Technical Field

[0001] This invention relates to a method and system for intelligent detection of information security compliance based on multi-source data, belonging to the field of information security compliance assessment technology. Background Technology

[0002] The Cybersecurity Classified Protection System (CCPS) classifies information and its carriers into protection levels based on their importance to ensure information security. The scope of CCPS assessments has expanded from traditional IT systems to emerging technology scenarios such as cloud computing, the Internet of Things (IoT), industrial control, and big data. Key industries such as finance, healthcare, and energy are listed as key regulatory areas, requiring strict adherence to CCPS requirements. As enterprises accelerate their digital transformation, the implementation of cloud-based business operations, mobile offices, and data interoperability has expanded their potential attack surface, leading to frequent data breaches and ransomware attacks. CCPS assessments have become a necessary means for enterprises to demonstrate their security capabilities.

[0003] In existing technologies, network security level assessment methods mainly identify system weaknesses through vulnerability scanning tools, determine abnormal access in the network through traffic analysis, and analyze event trajectories through security log auditing. However, existing technologies have the following problems: due to the high-dimensionality of multi-source data, the analysis logic and calculation are often simplified during the assessment, which leads to the inability to fully reflect the true security status of the system when assessing network security level, increasing the risk of underreporting and resulting in incomplete assessment results. Summary of the Invention

[0004] The purpose of this invention is to provide a method and system for intelligent detection of information security compliance based on multi-source data, so as to solve the problems of increased risk of missed detection and incomplete evaluation results in the prior art.

[0005] To solve the above-mentioned technical problems, the present invention is implemented using the following technical solution.

[0006] Intelligent detection methods for compliance with information security standards based on multi-source data include:

[0007] Specifically, the target network data is acquired, the locations and connections of network devices are extracted from the target network data, and a target network graph is generated.

[0008] The target network graph is input into a multi-source data association model based on graph neural networks, and association features are extracted through node embedding to generate an association feature set;

[0009] By performing simulated attack assessments and policy compliance assessments on the associated feature sets, and combining them with a pre-trained dynamic assessment model, security risk values ​​are calculated.

[0010] Based on the security risk value and the preset network security level classification standard, the network security level of the target network is classified, and the network security level assessment result is obtained.

[0011] Specifically, the target network graph is input into a multi-source data association model based on graph neural networks. Association features are extracted through node embedding to generate an association feature set, including:

[0012] Set the graph neural network parameters, corresponding aggregation functions, and node feature update functions to construct a multi-source data association model;

[0013] The network traffic data, terminal log data, vulnerability scan data, and security configuration policy data of the nodes in the target network graph are converted into numerical feature vectors as the initial feature information of the nodes.

[0014] Based on the connection relationships between nodes in the target network graph, the initial feature information of the nodes is aggregated using an aggregation function, and the aggregated initial feature information is nonlinearly transformed using a node feature update function to update the feature information of each node.

[0015] The feature information is iteratively aggregated and transformed, and the final feature information is used as a dense vector representation of the node.

[0016] The associated feature set is generated by combining the dense vectors of all nodes.

[0017] Specifically, by performing simulated attack assessments and policy compliance assessments on the associated feature set, and combining this with a pre-trained dynamic assessment model, a security risk value is calculated, including:

[0018] Feature selection is performed on the associated feature set to extract the penetration point feature subset and the security configuration feature subset, respectively;

[0019] Based on a subset of penetration point features, attack paths are simulated using a pre-defined attack action library. Based on the attack results of the attack paths, an attack risk feature vector is generated.

[0020] The security configuration feature subset is compared with the preset security policy set, the feature vector of the security policy violation instance is calculated, and the policy deviation feature vector is generated by clustering and grouping.

[0021] The attack risk feature vector and the strategy deviation feature vector are input into the dynamic evaluation model, which consists of a real-time evaluation layer and a historical comparison layer. The real-time evaluation layer calculates the baseline security risk value, and the historical comparison layer calculates the weight adjustment coefficient.

[0022] The safety risk value is obtained by merging the baseline safety risk value with the weight adjustment coefficient.

[0023] Specifically, based on a subset of penetration point features, attack paths are simulated using a pre-defined attack action library. Based on the attack results of these paths, an attack risk feature vector is generated, including:

[0024] The feature subset of penetration points is matched with the prerequisites required for attack actions in the preset attack action library, and attack action instances are created for attack actions that meet the prerequisites.

[0025] Starting from the initial position of the attack action, and using the attack action instances that meet the preconditions as directed edges, the attack path is iteratively expanded until no new attack action instances can be triggered, thus generating a complete network attack graph.

[0026] For attack actions triggered by attack paths in the network attack graph, a non-linear mapping is performed based on the required privilege escalation level to deduce the success probability of the attack action. Combined with the preset target asset security attributes, the impact score is calculated.

[0027] By calculating the statistical parameters of the attack success probability and the impact score, a linear transformation is performed on the parameters, and the vectors are then concatenated into a one-dimensional vector, which serves as the attack risk feature vector.

[0028] Specifically, a subset of security configuration features is compared with a preset set of security policies to calculate the feature vector of instances of violated security policies. Policy deviation feature vectors are then generated through clustering and grouping, including:

[0029] Based on the nodes in the target network graph, the preset security policy is instantiated to generate a specific security policy instance. Logical matching is performed by combining a subset of security configuration features to determine whether the security policy instance is violated, and the violated security policy instance, corresponding type, and network identifier are recorded.

[0030] Map the network identifier corresponding to the security policy instance to the corresponding node in the target network graph, calculate the degree centrality parameter, betweenness centrality parameter, and security domain attribute parameter of the node, and generate the node feature vector;

[0031] Based on the security policy instance type, a vocabulary containing all types and a zero vector with a length equal to the size of the vocabulary are constructed. For the currently violated security policy instance type, its index position in the vocabulary is found and the zero vector is adjusted to obtain the type feature vector.

[0032] The node feature vector and type feature vector are used as inputs, and clustering is performed according to their density. The centroid vector of each group is calculated, and the Euclidean distance is calculated in combination with the preset benchmark centroid vector. The weight coefficient of the group to which the security policy instance belongs is determined by the Euclidean distance value.

[0033] For network nodes related to security policy instances, key factors are determined by calculating topological attributes. Based on the key factors and security policy instances, heterogeneous deviation clusters are constructed to obtain policy deviation feature vectors.

[0034] Specifically, for network nodes related to security policy instances, key factors are determined by calculating topological attributes. Heterogeneous deviation clusters are then constructed based on these key factors and the security policy instance to obtain a policy deviation feature vector, including:

[0035] A quantized adjacency matrix is ​​constructed based on the connection relationships of the target network graph. The eigenvector centrality parameter of the node is obtained by calculating the principal eigenvector of the quantized adjacency matrix. The key factor is calculated by combining the betweenness centrality parameter and the degree centrality parameter.

[0036] Using the type of security policy instance as a feature, clustering is performed to generate a main cluster of security policy instances. The main clusters of security policy instances are then clustered using key factors to obtain heterogeneous bias clusters.

[0037] The product of the key factor and the weight coefficient of the group to which the security strategy instance belongs is used as the local deviation value. Nonlinear aggregation is performed to generate the cluster-level deviation contribution, and the cluster-level deviation contribution is cross-corrected to obtain the standardized cluster deviation index.

[0038] Construct a logical association topology between heterogeneous deviation clusters, nonlinearly fuse the standardized cluster deviation indices of adjacent heterogeneous deviation clusters to obtain an intermediate feature vector, compress the intermediate feature vector, and output the final policy deviation feature vector.

[0039] Specifically, based on security risk values ​​and preset network security level classification standards, the target network is classified into network security levels to obtain network security level assessment results, including:

[0040] Based on the preset network security level classification standard, the upper and lower bound thresholds of the security risk value range corresponding to each security level are compared sequentially with the security risk value.

[0041] Based on the comparison results, the security risk values ​​are mapped to the corresponding network security level identifiers, and the security risk values ​​are bound to the network security level identifiers to output the network security level assessment results.

[0042] Specifically, the process involves acquiring target network data, extracting the locations and connections of network devices from the target network data, and generating a target network graph, including:

[0043] Acquire target network data, which includes network topology data, network traffic data, terminal log data, vulnerability scan data, and security configuration policy data;

[0044] Based on network topology data, extract the location of network devices and the connection relationships between them;

[0045] The network device locations are mapped to node instances of graph node type, and the network device connection relationships are mapped to edge instances of graph edge type, generating the target network graph.

[0046] A network security level assessment system based on multi-source data includes: a data acquisition module, a feature extraction module, a risk assessment module, and a security level output module;

[0047] The data acquisition module is used to acquire target network data, extract the location of network devices and the connection relationship of network devices from the target network data, and generate a target network map;

[0048] The feature extraction module inputs the target network graph into a multi-source data association model based on graph neural networks, extracts association features through node embedding, and generates an association feature set.

[0049] The risk assessment module is used to calculate the security risk value by performing simulated attack assessment and policy compliance assessment on the associated feature set, combined with a pre-trained dynamic assessment model.

[0050] The security level output module is used to classify the network security level of the target network according to the security risk value and the preset network security level classification standard, and obtain the network security level evaluation result.

[0051] Specifically, the risk assessment module includes an attack risk assessment unit and a strategy assessment unit:

[0052] The attack risk assessment unit is used to generate a network attack graph, calculate the attack success probability and impact score, and generate an attack risk feature vector.

[0053] The policy evaluation unit is used to instantiate a preset security policy set, construct a heterogeneous deviation cluster, calculate the cluster-level deviation contribution, and generate a policy deviation feature vector.

[0054] Compared with existing technologies, the beneficial effects achieved by this invention are as follows: A target network graph is constructed based on target network data; its associated feature set is extracted using a multi-source data association model based on graph neural networks; simulated attack assessment and policy compliance assessment are performed on the associated feature set; a security risk value is calculated using a dynamic assessment model; and a network security level evaluation result is obtained by combining the security risk value with a preset network security level classification standard. This solves the problem that existing technologies cannot fully reflect the true security status of the system when evaluating network security levels, enhances the depth of data analysis when evaluating target networks, and improves the accuracy and comprehensiveness of network security level evaluation.

[0055] It should be understood that the above general description and the following detailed description are merely exemplary and explanatory, and are not intended to limit the technical solutions of this disclosure. Attached Figure Description

[0056] Figure 1 The flowchart of the intelligent detection method for information security compliance based on multi-source data provided by this invention;

[0057] Figure 2 The risk calculation flowchart provided for this invention;

[0058] Figure 3 The network security level classification diagram provided by this invention;

[0059] Figure 4 The structural diagram of the intelligent security protection detection system based on multi-source data provided by the present invention is shown. Detailed Implementation

[0060] The technical solution of the present invention will be described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the embodiments of the present invention and the specific features in the embodiments are detailed descriptions of the technical solution of the present invention, rather than limitations thereof. In the absence of conflict, the embodiments of the present invention and the technical features in the embodiments can be combined with each other.

[0061] The term "and / or" simply describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone. Additionally, the character " / " generally indicates that the preceding and following related objects have an "or" relationship.

[0062] Example 1

[0063] Please see Figures 1-3 This invention provides an embodiment of a cybersecurity compliance intelligent detection method based on multi-source data, which includes the following specific steps:

[0064] Step S1: Obtain target network data, extract the location of network devices and the connection relationship of network devices from the target network data, and generate a target network graph.

[0065] The specific steps of step S1 are as follows:

[0066] Step S101: Obtain target network data, which includes network topology data, network traffic data, terminal log data, vulnerability scan data, and security configuration policy data.

[0067] In this embodiment, raw data streams from network devices, security devices, and terminal devices are collected, and the physical connections and logical routing relationships between network devices are parsed to generate network topology data. Data packets of network nodes are captured through traffic mirroring, and their source addresses, destination addresses, protocol types, and payload characteristics are parsed to form network traffic data. System event records, process activity information, and security audit logs are read from the log service of the terminal operating system to construct terminal log data. Port scanning and service identification are performed on the IP address range in the network through a vulnerability scanning engine, and features in the vulnerability database are matched to generate vulnerability scanning data. Access control rules, security policy entries, and permission settings are extracted from the configuration files of firewalls, intrusion detection systems, and identity management platforms to generate security configuration policy data.

[0068] Step S102: Based on the network topology data, extract the location of network devices and the connection relationship between network devices.

[0069] In this embodiment, the device identifier and network address mapping table recorded in the network topology data are parsed to obtain the unique logical identifier of the network device and its region. The link state records in the network topology data are traversed to extract the correspondence of physical interfaces directly connected between devices, generating an initial set of connection pairs. The routing configuration information and subnetting rules in the network topology data are analyzed to complete the logical connection relationships not explicitly declared in the initial set of connection pairs. Redundancy checks and loop detection are performed on the logical connection relationships to eliminate duplicate records and ensure that the connections are loop-free. The verified network device location information and logical connection relationships are encapsulated into structured data objects to obtain the network device location and network device connection relationship.

[0070] Step S103: Map the network device locations to node instances of graph node type, and map the network device connection relationships to edge instances of graph edge type to generate the target network graph.

[0071] In this embodiment, the node type is determined according to the corresponding device type in the network device location. A corresponding node instance is constructed for each device, and a node identifier generated based on the device's unique identifier is assigned to it. According to the connection record in the network device connection relationship, the source device identifier and the target device identifier are parsed. According to the connection type attribute specified in the connection record, the corresponding graph edge type is determined. Among the created node instances, a node instance that matches the source device identifier and the target device identifier is searched. Based on the determined graph edge type, a directed edge instance is created between the matched source node instance and the target node instance, and a connection attribute is set for the edge instance. After the edge instance creation is completed for all connection records, all node instances and edge instances are combined to construct the target network graph.

[0072] Step S2: Input the target network graph into the multi-source data association model based on graph neural network, extract association features through node embedding, and generate an association feature set.

[0073] The specific steps of step S2 are as follows:

[0074] Step S201: Set the graph neural network parameters, the corresponding aggregation function and node feature update function, and construct a multi-source data association model.

[0075] In this embodiment, the number of layers in the graph neural network and the dimension of the hidden features in each layer are set, the trainable weight matrix and bias vector of each layer of the neural network are initialized, a specific neighborhood information aggregation method is selected for the node feature aggregation operation, and its corresponding calculation rules are determined. The type of nonlinear transformation function used in the node feature update process is set, and a multi-source data association model is constructed through the hierarchical structure, weight parameters, aggregation rules and update functions.

[0076] Step S202: Convert the network traffic data, terminal log data, vulnerability scan data, and security configuration policy data of the nodes in the target network graph into numerical feature vectors as the initial feature information of the nodes.

[0077] In this embodiment, network traffic data is parsed to obtain transmission protocol type, service port number, and data packet size fields. The protocol type is mapped to a predefined enumerated value, the port number is segmented and normalized, and the data packet size is logarithmically scaled and converted into a standard score. Terminal log data is parsed to obtain event type identifiers and timestamp sequences. The event type identifiers are encoded according to a preset classification system to generate a multi-hotspot vector. The frequency of occurrence of each event type per unit time is calculated based on the timestamp sequence to form a frequency feature vector. Vulnerability scan data is parsed to obtain the baseline score and vulnerability type classification identifier. The baseline score is linearly normalized, the vulnerability type classification identifier is one-hot encoded, and the service port number with the vulnerability is associated with the open port number in the network traffic data. The policy entries in the security configuration policy data are compared with the baseline security configuration library. Policy entries that fully comply are marked as Boolean true values, entries that partially comply are calculated as compliance percentages based on the number of missing configuration items, and entries that do not comply are marked as zero values. Combined with maximum and minimum value normalization processing, all processed feature fields are combined into a numerical feature vector of a unified dimension as initial feature information.

[0078] Step S203: Based on the connection edge relationships of nodes in the target network graph, aggregate the initial feature information of the nodes through an aggregation function, and use the node feature update function to perform a nonlinear transformation on the aggregated initial feature information to update the feature information of each node.

[0079] In this embodiment, based on the connection edge relationships of nodes in the target network graph, the set of direct neighbor nodes of each node is located, the initial feature information of each node is extracted from the set of neighbor nodes to form a neighbor feature set, the neighbor feature set is aggregated to generate comprehensive neighbor feature information, the comprehensive neighbor feature information is fused with the initial feature information of the current node, the fused feature information is subjected to nonlinear transformation processing to generate updated node feature information, and the updated feature information is assigned to the corresponding node.

[0080] Step S204: Iteratively aggregate and transform the feature information, and use the final feature information as the dense vector representation of the node.

[0081] In this embodiment, for the current feature information of each node, the feature information of all directly adjacent nodes is obtained according to its connection edge relationship. The collected neighbor feature information is merged into unified aggregated feature information through aggregation operation. The aggregated feature information is connected and combined with the node's own current feature information to form extended feature information. The extended feature information is processed by nonlinear transformation to generate the updated feature information of all nodes in the target network graph, and it is represented as a dense vector.

[0082] Step S205: Combine the dense vectors of all nodes to generate the associated feature set.

[0083] In this embodiment, the dense vectors of the nodes are stacked vertically in a preset order to construct an initial node feature matrix. Null values ​​are detected in the initial node feature matrix, and rows with null values ​​are filled using the weighted average of the features of adjacent nodes. The variance of each feature dimension in the initial node feature matrix is ​​calculated, and feature dimensions with variances below a preset threshold are removed and normalized to ensure uniform feature vector length for each node. Max pooling is used to extract the global maximum value of each feature dimension along the node dimensions to generate a global feature vector. Simultaneously, average pooling is used to calculate the mean of each feature dimension to generate an average feature vector. The global feature vector and the average feature vector are concatenated to form a comprehensive feature. The comprehensive feature is then serialized and encapsulated to obtain an associated feature set. The feature items in the associated feature set include feature names and metadata descriptions. It should be noted that the order and threshold are set by those skilled in the art through simulation experiments.

[0084] Step S3: Calculate the security risk value by performing simulated attack assessment and policy compliance assessment on the associated feature set, combined with a pre-trained dynamic assessment model.

[0085] The specific steps of step S3 are as follows:

[0086] Step S301: Perform feature selection on the associated feature set, and extract the penetration point feature subset and the security configuration feature subset respectively.

[0087] In this embodiment, a pre-defined set of penetration point feature selection rules and a set of security configuration feature selection rules are used. Based on the feature names and metadata descriptions of all feature items in the associated feature set, they are matched with the sets of penetration point feature selection rules and security configuration feature selection rules respectively. Feature items that meet any discrimination condition in the set of penetration point feature selection rules are assigned to the penetration point feature subset, and feature items that meet any discrimination condition in the set of security configuration feature selection rules are assigned to the security configuration feature subset. Redundancy checks and merging operations are performed on the two feature subsets to ensure that the same feature item does not appear repeatedly in one subset. The final set of penetration point feature subset and security configuration feature subset are then output. It should be noted that the set of penetration point feature selection rules and the set of security configuration feature selection rules are set by those skilled in the art according to the actual situation.

[0088] Step S302: Based on the feature subset of penetration points, simulate attack paths using a preset attack action library, and generate attack risk feature vectors based on the attack results of the attack paths.

[0089] The specific steps of step S302 are as follows:

[0090] Step S3021: Match the subset of penetration point features with the prerequisites required for attack actions in the preset attack action library, and create attack action instances for attack actions that meet the prerequisites.

[0091] In this embodiment, a pre-defined attack action library is used, wherein the preconditions defined for each attack action include network service status, permission level, and vulnerability existence. The penetration point feature subset is logically compared with the attack action preconditions. If the attack action preconditions are fully met, it is marked as an executable action. A unique instance identifier is assigned to each executable action, and the specific attribute parameters of the target network entity targeted by the action are extracted from the penetration point feature subset. The static metadata defined in the attack action library is bound with the extracted dynamic target entity parameters to construct an attack action instance. It should be noted that the attack action library is set up by those skilled in the art through simulation experiments.

[0092] Step S3022: Using the initial position of the attack action as the starting point, and using the attack action instances that meet the preconditions as directed edges, iteratively expand the attack path until no new attack action instances can be triggered, thus generating a complete network attack graph.

[0093] In this embodiment, the global node set and the node set to be expanded are initialized. The node corresponding to the initial position is added to the two sets. A current node is taken from the node set to be expanded. All instances in the attack action instance library are traversed. The network service status, permission level and vulnerability existence contained in the current node are logically matched with the preconditions of each attack action instance. The successfully matched attack action instances are used as directed edges starting from the current node. The new permission set and the updated network reachability relationship after executing the attack action instance are calculated to obtain a new node. It is checked whether the new node already exists in the global node set. If it does not exist, it is added to the global node set and the node set to be expanded. The process is iterated until the node set to be expanded is empty, and a network attack graph is generated.

[0094] Step S3023: For the attack actions triggered by the attack path in the network attack graph, perform a non-linear mapping based on the required privilege escalation level to deduce the success probability of the attack actions, and calculate the impact score by combining the preset target asset security attributes.

[0095] In this embodiment, the privilege escalation level value is input into a preset nonlinear probability mapping function. The nonlinear probability mapping function is constructed by fitting the correlation between privilege escalation level and success rate in historical attack data, and outputs a scalar value representing the probability of attack success. According to the preset security attributes of the target asset, the confidentiality importance score, integrity importance score, and availability importance score of the target asset are obtained. The attack success probability value is multiplied by the confidentiality importance score, integrity importance score, and availability importance score respectively to obtain the first influence component, the second influence component, and the third influence component. The first influence component, the second influence component, and the third influence component are arithmetically summed to obtain the influence score of the attack action. It should be noted that the security attributes of the target asset are set by those skilled in the art according to the actual situation.

[0096] Step S3024: Calculate the statistical parameters of the attack success probability and the impact score, perform a linear transformation on them, project them, and then concatenate them into a one-dimensional vector, which serves as the attack risk feature vector.

[0097] In this embodiment, the attack success probability and impact score corresponding to all attack paths are extracted for statistical analysis. The maximum, minimum, arithmetic mean, and standard deviation of the attack success probability and impact score are calculated as statistical parameters. A linear scaling function is determined based on the numerical distribution range of the statistical parameters of the attack success probability and impact score. The minimum and maximum values ​​of the statistical parameters in the original data are determined based on the numerical distribution range of the statistical parameters of the attack success probability and impact score. The lower and upper limits of the target common numerical interval are set, for example, from 0 to 1. For the statistical value to be mapped, the difference between it and the original minimum value is calculated, and then divided by the difference between the original maximum and minimum values ​​to obtain the ratio value. The ratio value is multiplied by the width of the target interval and the lower limit of the target interval is added, thereby linearly transforming the original statistical quantity into the preset common numerical interval. The statistical parameters after mapping are arranged and combined to obtain a one-dimensional vector, which serves as the attack risk feature vector. It should be noted that the common numerical interval is set by those skilled in the art through simulation experiments.

[0098] Step S303: Compare the security configuration feature subset with the preset security policy set, calculate the feature vector of the violated security policy instance, and generate the policy deviation feature vector through clustering.

[0099] The specific steps of step S303 are as follows:

[0100] Step S3031: Instantiate the preset security policy based on the nodes in the target network graph to generate a specific security policy instance. Perform logical matching with the security configuration feature subset to determine whether the security policy instance is violated, and record the violated security policy instance, the corresponding type, and the network identifier.

[0101] In this embodiment, for security policies in the preset security policy set, the policy subject, object, and action conditions in the security policy are bound and replaced with the specific attributes of the current node according to the nodes in the target network graph, generating a specific security policy instance. The complete judgment conditions for allowing or prohibiting operations in the security policy instance are converted into executable conditional judgment logic expressions. The configuration item data corresponding to the node in the security configuration feature subset is used as input, and the conditional judgment logic expression is evaluated. If the evaluation result of the expression is false, it is determined that the configuration item data of the current node violates the security policy instance, and a security policy violation record is generated. The security policy violation record records the unique identifier of the violated security policy instance, the security policy type classification code, and the network identifier of the current node. It should be noted that the security policy set is set by extracting all mandatory security requirements involving access control, service configuration, communication encryption, audit logs, etc.

[0102] Step S3032: Map the network identifier corresponding to the security policy instance to the corresponding node in the target network graph, calculate the degree centrality parameter, betweenness centrality parameter and security domain attribute parameter of the node, and generate the node feature vector.

[0103] In this embodiment, based on the network identifier recorded in the security policy instance, the corresponding node associated with the security policy instance is matched in the target network graph. By constructing an adjacency table of the target network graph, the number of directly connected adjacent nodes of the corresponding node is counted to obtain the degree centrality parameter value of the corresponding node. Based on the global connection structure of the target network graph, the set of shortest paths between all node pairs in the graph is calculated, and the number of all shortest paths passing through the corresponding node is counted to obtain the betweenness centrality parameter value of the corresponding node. According to the preset security domain partitioning configuration table, the security domain attribute parameters of the corresponding node are determined. The degree centrality parameter value and the betweenness centrality parameter value are normalized to eliminate the influence of dimensions. All normalized degree centrality values, betweenness centrality values, and security domain attribute parameters are combined into a three-dimensional vector. By performing dimensionality reduction processing to retain the main feature components, the node feature vector is output. It should be noted that the security domain partitioning configuration table is set by those skilled in the art according to the actual situation.

[0104] Step S3033: Based on the security policy instance type, construct a vocabulary containing all types and a zero vector with a length equal to the size of the vocabulary. For the currently violated security policy instance type, find its index position in the vocabulary and adjust the zero vector to obtain the type feature vector.

[0105] In this embodiment, based on the security policy type classification code corresponding to the security policy instance, a unique set of security policy types is generated through deduplication. The security policy type set is then sorted lexicographically to form an ordered set of security policy types. This ordered set of security policy types serves as the foundation of the vocabulary, and a consecutive integer index value is assigned to each type to generate the vocabulary. A numerical vector with the same dimension is initialized based on the total length of the vocabulary, and all elements of this vector are set to zero. Based on the security policy type identifier associated with the currently violated security policy instance, the unique index number corresponding to the security policy type identifier is queried in the vocabulary. Based on the obtained index number, the element at the corresponding position in the zero vector is located, and the value of the element at that position is modified to one. The modified numerical vector is then output as the type feature vector.

[0106] Step S3034: Take the node feature vector and type feature vector as input, cluster them according to their density, calculate the centroid vector of each group, calculate the Euclidean distance with the preset benchmark centroid vector, and determine the weight coefficient of the group to which the security policy instance belongs through the Euclidean distance value.

[0107] In this embodiment, node feature vectors and type feature vectors are concatenated to generate joint feature vectors. Density peak detection is performed on the set of joint feature vectors. Joint feature vectors with local density values ​​greater than the average local density of their neighboring feature vectors are used as initial cluster centers. Based on the initial cluster centers, the joint feature vectors are assigned to groups represented by their nearest neighbor cluster centers, thus completing the clustering. For each group, the arithmetic mean of all joint feature vectors in each dimension is calculated to generate a centroid vector representing the core feature of the group. The sum of squared differences between the centroid vector and the preset benchmark centroid vector in each feature dimension is calculated. The square root of the sum of squared differences is used to obtain the Euclidean distance value. The Euclidean distance value is then subjected to piecewise linear transformation and normalization to ensure that the sum of the weight coefficients of all groups is a fixed constant. The weight coefficients corresponding to each group are then output.

[0108] Step S3035: For network nodes related to security policy instances, determine key factors by calculating topology attributes, construct heterogeneous deviation clusters based on key factors and security policy instances, and obtain policy deviation feature vectors.

[0109] The specific steps of step S3035 are as follows:

[0110] Step S30351: Construct a quantized adjacency matrix based on the connection relationships of the target network graph. Obtain the eigenvector centrality parameter of the node by calculating the principal eigenvector of the quantized adjacency matrix. Calculate the key factor by combining the betweenness centrality parameter and the degree centrality parameter.

[0111] In this embodiment, based on the nodes in the target network graph, a bidirectional mapping table between indices and nodes is established by assigning consecutive integer indices. A zero-matrix is ​​initialized based on the existence and direction attributes of the connecting edges between nodes, with a dimension equal to the total number of nodes. For each connection, feature information is filled into the corresponding row and column positions in the matrix to generate an initial weighted adjacency matrix, which is then normalized to obtain a quantized adjacency matrix. A random vector with all positive elements is initialized as the initial estimate of the principal eigenvector. The quantized adjacency matrix is ​​multiplied by the principal eigenvector, and norm normalization is performed. The difference norm between two adjacent iterations is iteratively executed and monitored. Convergence is determined when the difference norm is lower than a preset tolerance threshold. The components in the convergence result are extracted in node index order as the eigenvector centrality parameters of the corresponding nodes. The eigenvector centrality parameters, betweenness centrality parameters, and degree centrality parameters are normalized to their maximum values. The processing results are then mapped using a nonlinear function to obtain key factors. It should be noted that the tolerance threshold is set by those skilled in the art based on actual conditions.

[0112] Step S30352: Using the type of security policy instance as a feature, cluster the security policy instances to generate a main cluster, and then cluster the main cluster of security policy instances using key factors to obtain a heterogeneous bias cluster.

[0113] In this embodiment, based on the type feature vector of security policy instances, the similarity metric of any two type feature vectors is calculated. The local density of each instance is calculated based on the similarity metric. Security policy instances in high-density regions are identified and merged into the same set based on a preset density threshold, forming preliminary clustering groups. The silhouette coefficient of the preliminary clustering groups is evaluated, and adjacent groups with silhouette coefficients below the silhouette threshold are merged. The size of the substructure-containing groups is determined by the silhouette coefficient magnitude, and these size groups are separated to form main clusters. Each main cluster is assigned a unique identifier. Key factors are added as new dimensions and concatenated with the type feature vector to construct extended feature vectors. The local density of the extended feature vectors contained within each main cluster is recalculated based on the main cluster identifier. Based on the local density distribution, sub-regions with significant density differences are divided within the main cluster. Security policy instances within each sub-region are identified as a sub-cluster. The statistical distribution consistency of the key factor values ​​of instances in each sub-cluster is verified. Sub-clusters with significantly different distribution patterns are further divided, and sub-clusters with the same main cluster affiliation are designated as heterogeneous deviation clusters. It should be noted that the density threshold and silhouette threshold are set by those skilled in the art according to actual conditions.

[0114] Step S30353: The product of the key factor and the weight coefficient of the group to which the security strategy instance belongs is used as the local deviation value. Nonlinear aggregation is performed to generate the cluster-level deviation contribution, and the cluster-level deviation contribution is cross-corrected to obtain the standardized cluster deviation index.

[0115] In this embodiment, the initial local deviation value of the security strategy instance is obtained by multiplying the key factor value with the weight coefficient of its group. The initial local deviation value set is then subjected to data distribution verification to identify and remove outliers, generating a preprocessed local deviation value sequence. A weighted aggregation operator is constructed based on this sequence, and the local deviation value sequence and the weighted aggregation operator are calculated using an exponential decay function to obtain the cluster-level deviation contribution. The cluster-level deviation contributions of adjacent groups are extracted to form a reference vector. The cluster-level deviation contribution of the current group is multiplied by the reference vector to obtain a cross-influence factor. A nonlinear transformation is performed on the cross-influence factor to generate a dynamic adjustment coefficient. The dynamic adjustment coefficient is multiplied by the cluster-level deviation contribution to obtain a cross-corrected intermediate cluster deviation index. Based on the arithmetic mean and standard deviation of the intermediate cluster deviation indices of all groups, a probability density function based on a normal distribution is constructed. The intermediate cluster deviation index of the current group is input into the probability density function for calculation to obtain the cumulative probability value under a normal distribution. The cumulative probability value is mapped to the standard normal distribution space, and through inverse function transformation and range constraint processing, a standardized cluster deviation index is obtained.

[0116] Step S30354: Construct the logical association topology between heterogeneous deviation clusters, perform nonlinear fusion of the standardized cluster deviation indices of adjacent heterogeneous deviation clusters to obtain intermediate feature vectors, compress the intermediate feature vectors, and output the final policy deviation feature vectors.

[0117] In this embodiment, the central feature vector of the heterogeneous deviation cluster and the identifier of the corresponding node in the network knowledge graph are extracted. The connection relationship in the knowledge graph is queried according to the node identifier. If there is a direct edge connection between the nodes corresponding to two heterogeneous deviation clusters, the two heterogeneous deviation clusters are determined to be adjacent clusters. The heterogeneous deviation clusters are used as vertices and the adjacent relationship is used as edges to construct a logical association topology. The standardized cluster deviation index of the vertex in the logical association topology is subjected to Gaussian kernel transformation, and the multidimensional Euclidean distance between it and the index of all adjacent vertices is calculated. Attention weight coefficients are generated according to the distance values. The standardized cluster deviation index of adjacent vertices is weighted and aggregated through the attention weight coefficients. The aggregation result and the current original index are input together into the hyperbolic tangent activation function for nonlinear transformation to obtain the local fusion value of the current vertex. Through multiple rounds of iteration, the local fusion value is extracted from each vertex and concatenated into an intermediate feature vector according to the vertex number order. Principal component analysis is performed on the intermediate feature vector, and the principal component components are selected for linear projection to reduce the dimensionality and generate the final policy deviation feature vector.

[0118] Step S304: Input the attack risk feature vector and the strategy deviation feature vector into the dynamic evaluation model. The dynamic evaluation model consists of a real-time evaluation layer and a historical comparison layer. The benchmark security risk value is calculated through the real-time evaluation layer, and the weight adjustment coefficient is calculated through the historical comparison layer.

[0119] In this embodiment, in the real-time evaluation layer, the attack risk feature vector and the policy deviation feature vector are normalized to eliminate dimensional differences. Based on a preset threat weight matrix, the normalized attack risk feature vector is weighted and summed to calculate an initial attack risk score. The policy deviation feature vector is scaled and combined with the target asset security attributes to calculate an initial policy deviation score. The initial attack risk score and the initial policy deviation score are input into a multilayer perceptron for nonlinear feature fusion to generate a baseline security risk value. In the historical comparison layer, historical case sequences with similar topological and business characteristics to the current target network are extracted from a preset historical database and compared based on their baseline security... The risk value sequence and its actual security event records are used to match the baseline security risk value with the historical risk sequence using a sequence alignment algorithm to identify the most relevant historical risk pattern fragments. Based on the correlation strength, the time decay factor and pattern confidence are calculated. According to the time decay factor, pattern confidence, and the deviation of the baseline security risk value from the historical baseline value, the weight adjustment coefficient is dynamically generated by linear interpolation. It should be noted that the threat weight matrix is ​​constructed by quantifying the severity of various attack threats based on industry security standards and historical vulnerability data. The historical database is formed by collecting and cleaning historical network security assessment data, actual security event records, and threat intelligence information, and then standardizing them.

[0120] Step S305: Calculate the safety risk value by fusing the baseline safety risk value and the weight adjustment coefficient.

[0121] In this embodiment, the baseline security risk value output by the real-time evaluation layer is multiplied by the weight adjustment coefficient output by the historical comparison layer to obtain the corrected security risk value.

[0122] exist Figure 2 In this process, a subset of penetration point features and a subset of security configuration features are extracted from the associated feature set. A network attack graph is constructed by simulating attack paths. The success probability and impact score of the attack actions triggered by the attack paths in the network attack graph are calculated. An attack risk feature vector is generated by statistical parameters of the success probability and impact score. The security policy is instantiated and key factors are calculated. Heterogeneous deviation clusters are constructed based on the key factors and security policy instances to obtain the policy deviation feature vector. Based on the policy deviation feature vector, the attack risk feature vector and the preset dynamic evaluation model, the baseline security risk value and weight adjustment coefficient are obtained. These are then fused to calculate the security risk value.

[0123] Step S4: Based on the security risk value and the preset network security level classification standard, classify the target network into network security levels and obtain the network security level assessment results.

[0124] The specific steps of step S4 are as follows:

[0125] Step S401: According to the preset network security level classification standard, the upper and lower bound thresholds of the security risk value range corresponding to each security level are compared with the security risk value in sequence.

[0126] In this embodiment, the initial level determination state is unmatched. The network security level classification standard is traversed in descending order of level. The upper and lower bounds of the risk value range corresponding to each level are obtained in turn. The security risk value is compared with the lower and upper bounds of the range of each level to determine whether it is within the range of the current security level. When the security risk value meets the range condition of the corresponding level, the traversal process is terminated, the current security level is recorded, and the level determination state is updated to complete.

[0127] Step S402: Based on the comparison results, map the security risk value to the corresponding network security level identifier, bind the security risk value to the network security level identifier, and output the network security level assessment result.

[0128] In this embodiment, a network security level identifier is generated based on the security level corresponding to the security risk value. The security risk value is mapped and bound to the network security level identifier. The binding result is encapsulated into a standard output format and the network security level assessment result is output.

[0129] exist Figure 3 The evaluation results are divided into five levels, including Level 5 Special Control Protection, Level 4 Mandatory Protection, Level 3 Supervisory Protection, Level 2 Guidance Protection, and Level 1 User Self-Protection, arranged from highest to lowest. Level 5 has the strongest target network protection, while Level 1 has the weakest.

[0130] Example 2

[0131] Please see Figure 4 The present invention provides an embodiment of a security compliance intelligent detection system based on multi-source data, comprising a data acquisition module, a feature extraction module, a risk assessment module, and a security level output module.

[0132] The data acquisition module is used to acquire target network data, extract the location of network devices and the connection relationship of network devices from the target network data, and generate a target network graph.

[0133] The feature extraction module inputs the target network graph into a multi-source data association model based on graph neural networks, extracts association features through node embedding, and generates an association feature set.

[0134] The risk assessment module is used to calculate the security risk value by performing simulated attack assessment and policy compliance assessment on the associated feature set, combined with a pre-trained dynamic assessment model.

[0135] The security level output module is used to classify the network security level of the target network according to the security risk value and the preset network security level classification standard, and obtain the network security level evaluation result.

[0136] The risk assessment module includes an attack risk assessment unit and a strategy assessment unit.

[0137] The attack risk assessment unit is used to generate a network attack graph, calculate the probability of attack success and the impact score, and generate an attack risk feature vector.

[0138] The policy evaluation unit is used to instantiate a preset security policy set, construct a heterogeneous deviation cluster, calculate the cluster-level deviation contribution, and generate a policy deviation feature vector.

[0139] In addition, the parts of the technical solutions provided in the embodiments of this application that are consistent with the implementation principles of the corresponding technical solutions in the prior art have not been described in detail, so as to avoid excessive elaboration.

[0140] The embodiments of the present invention have been described above with reference to the accompanying drawings. However, the present invention is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other modifications under the guidance of the present invention without departing from the spirit and scope of the present invention, and all of these modifications are within the scope of protection of the present invention.

Claims

1. A method for intelligent detection of information security compliance based on multi-source data, characterized in that, include: Acquire target network data, extract network device locations and network device connection relationships from the target network data, and generate a target network graph; The target network graph is input into a multi-source data association model based on graph neural networks, and association features are extracted through node embedding to generate an association feature set; By performing simulated attack assessments and policy compliance assessments on the associated feature sets, and combining them with a pre-trained dynamic assessment model, security risk values ​​are calculated. Based on the security risk value and the preset network security level classification standard, the network security level of the target network is classified, and the network security level assessment result is obtained.

2. The intelligent detection method for information security compliance based on multi-source data according to claim 1, characterized in that, The step of inputting the target network graph into a multi-source data association model based on graph neural networks, extracting association features through node embedding, and generating an association feature set includes: Set the graph neural network parameters, corresponding aggregation functions, and node feature update functions to construct a multi-source data association model; The network traffic data, terminal log data, vulnerability scan data, and security configuration policy data of the nodes in the target network graph are converted into numerical feature vectors as the initial feature information of the nodes. Based on the connection relationships between nodes in the target network graph, the initial feature information of the nodes is aggregated using an aggregation function, and the aggregated initial feature information is nonlinearly transformed using a node feature update function to update the feature information of each node. The feature information is iteratively aggregated and transformed, and the final feature information is used as a dense vector representation of the node. The associated feature set is generated by combining the dense vectors of all nodes.

3. The intelligent detection method for information security compliance based on multi-source data according to claim 2, characterized in that, The process of calculating security risk values ​​by performing simulated attack assessments and policy compliance assessments on the associated feature sets, combined with a pre-trained dynamic assessment model, includes: Feature selection is performed on the associated feature set to extract the penetration point feature subset and the security configuration feature subset, respectively; Based on a subset of penetration point features, attack paths are simulated using a pre-defined attack action library. Based on the attack results of the attack paths, an attack risk feature vector is generated. The security configuration feature subset is compared with the preset security policy set, the feature vector of the security policy violation instance is calculated, and the policy deviation feature vector is generated by clustering and grouping. The attack risk feature vector and the strategy deviation feature vector are input into the dynamic evaluation model, which consists of a real-time evaluation layer and a historical comparison layer. The real-time evaluation layer calculates the baseline security risk value, and the historical comparison layer calculates the weight adjustment coefficient. The safety risk value is obtained by merging the baseline safety risk value with the weight adjustment coefficient.

4. The intelligent detection method for information security compliance based on multi-source data according to claim 3, characterized in that, The attack path simulation, based on a subset of penetration point features and a pre-defined attack action library, generates an attack risk feature vector according to the attack results of the attack path, including: The feature subset of penetration points is matched with the prerequisites required for attack actions in the preset attack action library, and attack action instances are created for attack actions that meet the prerequisites. Starting from the initial position of the attack action, and using the attack action instances that meet the preconditions as directed edges, the attack path is iteratively expanded until no new attack action instances can be triggered, thus generating a complete network attack graph. For attack actions triggered by attack paths in the network attack graph, a non-linear mapping is performed based on the required privilege escalation level to deduce the success probability of the attack action. Combined with the preset target asset security attributes, the impact score is calculated. By calculating the statistical parameters of the attack success probability and the impact score, a linear transformation is performed on the parameters, and the vectors are then concatenated into a one-dimensional vector, which serves as the attack risk feature vector.

5. The intelligent detection method for information security compliance based on multi-source data according to claim 4, characterized in that, The step of comparing a subset of security configuration features with a preset set of security policies, calculating feature vectors for instances of violated security policies, and generating policy deviation feature vectors through clustering includes: Based on the nodes in the target network graph, the preset security policy is instantiated to generate a specific security policy instance. Logical matching is performed by combining a subset of security configuration features to determine whether the security policy instance is violated, and the violated security policy instance, corresponding type, and network identifier are recorded. Map the network identifier corresponding to the security policy instance to the corresponding node in the target network graph, calculate the degree centrality parameter, betweenness centrality parameter, and security domain attribute parameter of the node, and generate the node feature vector; Based on the security policy instance type, a vocabulary containing all types and a zero vector with a length equal to the size of the vocabulary are constructed. For the currently violated security policy instance type, its index position in the vocabulary is found and the zero vector is adjusted to obtain the type feature vector. The node feature vector and type feature vector are used as inputs, and clustering is performed according to their density. The centroid vector of each group is calculated, and the Euclidean distance is calculated in combination with the preset benchmark centroid vector. The weight coefficient of the group to which the security policy instance belongs is determined by the Euclidean distance value. For network nodes related to security policy instances, key factors are determined by calculating topological attributes. Based on the key factors and security policy instances, heterogeneous deviation clusters are constructed to obtain policy deviation feature vectors.

6. The intelligent detection method for information security compliance based on multi-source data according to claim 5, characterized in that, For the network nodes related to the security policy instance, key factors are determined by calculating topological attributes. Based on these key factors and the security policy instance, a heterogeneous deviation cluster is constructed to obtain a policy deviation feature vector, including: A quantized adjacency matrix is ​​constructed based on the connection relationships of the target network graph. The eigenvector centrality parameter of the node is obtained by calculating the principal eigenvector of the quantized adjacency matrix. The key factor is calculated by combining the betweenness centrality parameter and the degree centrality parameter. Using the type of security policy instance as a feature, clustering is performed to generate a main cluster of security policy instances. The main clusters of security policy instances are then clustered using key factors to obtain heterogeneous bias clusters. The product of the key factor and the weight coefficient of the group to which the security strategy instance belongs is used as the local deviation value. Nonlinear aggregation is performed to generate the cluster-level deviation contribution, and the cluster-level deviation contribution is cross-corrected to obtain the standardized cluster deviation index. Construct a logical association topology between heterogeneous deviation clusters, nonlinearly fuse the standardized cluster deviation indices of adjacent heterogeneous deviation clusters to obtain an intermediate feature vector, compress the intermediate feature vector, and output the final policy deviation feature vector.

7. The intelligent detection method for information security compliance based on multi-source data according to claim 6, characterized in that, The process of classifying the target network into network security levels based on security risk values ​​and preset network security level classification standards, and obtaining network security level assessment results, includes: Based on the preset network security level classification standard, the upper and lower bound thresholds of the security risk value range corresponding to each security level are compared sequentially with the security risk value. Based on the comparison results, the security risk values ​​are mapped to the corresponding network security level identifiers, and the security risk values ​​are bound to the network security level identifiers to output the network security level assessment results.

8. The intelligent detection method for information security compliance based on multi-source data according to claim 7, characterized in that, The step of acquiring target network data, extracting network device locations and network device connection relationships from the target network data, and generating a target network graph includes: Acquire target network data, which includes network topology data, network traffic data, terminal log data, vulnerability scan data, and security configuration policy data; Based on network topology data, extract the location of network devices and the connection relationships between them; The network device locations are mapped to node instances of graph node type, and the network device connection relationships are mapped to edge instances of graph edge type, generating the target network graph.

9. A multi-source data-based intelligent security compliance detection system, used to implement the multi-source data-based intelligent security compliance detection method according to any one of claims 1-8, characterized in that, It includes a data acquisition module, a feature extraction module, a risk assessment module, and a security level output module. The data acquisition module is used to acquire target network data, extract the location of network devices and the connection relationship of network devices from the target network data, and generate a target network map; The feature extraction module inputs the target network graph into a multi-source data association model based on graph neural networks, extracts association features through node embedding, and generates an association feature set. The risk assessment module is used to calculate the security risk value by performing simulated attack assessment and policy compliance assessment on the associated feature set, combined with a pre-trained dynamic assessment model. The security level output module is used to classify the network security level of the target network according to the security risk value and the preset network security level classification standard, and obtain the network security level evaluation result.

10. The intelligent security compliance detection system based on multi-source data according to claim 9, characterized in that, The risk assessment module includes an attack risk assessment unit and a strategy assessment unit: The attack risk assessment unit is used to generate a network attack graph, calculate the attack success probability and impact score, and generate an attack risk feature vector. The policy evaluation unit is used to instantiate a preset security policy set, construct a heterogeneous deviation cluster, calculate the cluster-level deviation contribution, and generate a policy deviation feature vector.

Images