A large model-based password evaluation evidence index mapping method

Abstract

The present application relates to the technical field of network security and cryptographic application security evaluation, and particularly relates to a cryptographic evaluation evidence index mapping method based on a large model, which obtains and eventizes cryptographic evaluation evidence data, generates relevant records, forms an index candidate mapping relationship based on a large model, constructs a cryptographic running state evolution chain, a forward state evolution partial order and a candidate mapping state sub-chain, obtains multiple indexes through conflict verification, and outputs evidence index mapping results according to mapping dynamic regulation rules, the present application generates relevant records through eventization analysis, forms an index candidate mapping relationship in combination with a large model and a cryptographic evaluation index knowledge base, and performs dynamic regulation relying on a state evolution chain and conflict verification indexes, identifies evidence duplication, state recurrence and time sequence abnormalities, and improves the accuracy, traceability and verifiability of evidence index mapping results.

Description

Technical Field

[0001] This invention relates to the field of network security and cryptographic application security assessment technology, and more specifically, to a method for mapping cryptographic evaluation evidence indicators based on a large model. Background Technology

[0002] As information technology services evolve towards networking, cloudification, and intelligence, the reliance on cryptographic technologies in areas such as identity authentication, access control, data transmission protection, data storage protection, and key management is continuously increasing. To evaluate the compliance, correctness, and effectiveness of cryptographic applications in the tested information system, cryptographic assessment typically requires collecting various types of evidence, including configuration files, certificate information, cryptographic device call records, business logs, network packets, screenshots, interview records, and test tool outputs. This evidence is then categorized, verified, and judged according to relevant evaluation indicators.

[0003] In actual evaluation work, the relationship between evidence and evaluation indicators is not a simple one-to-one correspondence. The same evaluation indicator often requires multiple pieces of evidence to support it; for example, certificate chain verification records, key negotiation records, encrypted message records, and business access logs all reflect the transmission protection status. The same piece of evidence may also be associated with multiple evaluation indicators such as identity authentication, communication integrity, and communication confidentiality. Existing evaluation assistance methods can typically organize evidence texts, clause content, or inspection items, and establish preliminary correspondences through human experience, keyword matching, rule templates, or semantic matching, which plays a role in improving data archiving efficiency and reducing the burden of manual organization.

[0004] However, the validity of cryptographic evaluation evidence depends not only on the superficial correlation between the evidence content and the evaluation metric description, but also on the cryptographic invocation state at the time of evidence generation, the operational state switching process, key updates, collection batches, and the temporal consistency between evidence. For example, in scenarios such as service restart, session recovery, certificate updates, key rotation, or abnormal switching, although some messages or logs may match a certain evaluation metric in content, if there are issues such as initialization vector reuse, cryptographic state fingerprint reproduction, state timing identifier tag rollback, or a high degree of overlap between the first packet after the switch and the record before the switch, then the degree of support of this evidence for the evaluation metric needs further verification. If a mapping relationship is established solely based on textual semantics or the content of a single piece of evidence, it may be difficult to identify the aforementioned conflicts at the operational state level.

[0005] Furthermore, cryptographic evaluation evidence often involves repeated collection, cross-business link collection, and supplementary collection at different time periods. For evidence from similar sources but not from the same event, the lack of evidence identity identification and state evolution verification can easily lead to duplicate evidence being mistaken for independent supporting evidence. For evidence showing similar cryptographic call states in different business scenarios, the lack of contextual difference analysis may also result in an overestimation of the confidence level of the evaluation indicators. Existing methods focus more on evidence archiving, clause retrieval, and content matching, and there is still room for improvement in the comprehensive analysis of the cryptographic operation state evolution chain, candidate mapping state sub-chain, conflict topology relationship, and abnormal temporal sequence relationship.

[0006] Therefore, this application proposes a method for mapping evidence indicators for cryptographic evaluation based on a large model. Summary of the Invention

[0007] In view of the shortcomings of existing technologies, the purpose of this invention is to provide a method for mapping cryptographic evaluation evidence indicators based on a large model.

[0008] To achieve the above objectives, the present invention provides the following technical solution: A method for mapping evidence indicators for cryptography evaluation based on a large model, comprising: S1. Obtain password evaluation evidence data from the information system under test, perform event-based parsing on the password evaluation evidence data, generate evidence event parsing records, and generate password call status records, running status switching event records, and repeated collection identification records based on the evidence event parsing records. S2, based on the large model, evidence event parsing records and cryptography evaluation indicator knowledge base, generates candidate mapping relationships between cryptography evaluation evidence data and evaluation indicators; S3, based on the cryptographic call state record, the running state switching event record and the indicator candidate mapping relationship, forms the cryptographic running state evolution chain, the positive state evolution partial order and the candidate mapping state sub-chain; S4, based on the cryptographic running state evolution chain, candidate mapping state sub-chain and indicator candidate mapping relationship, performs conflict verification on the indicator candidate mapping relationship to obtain the first packet overlap rate after switching, conflict topology strength index, evidence identity deviation degree and key time arrow reversal index. S5, based on the key time arrow reversal index, the overlap rate of the first packet after switching, the conflict topology strength index, the degree of evidence identity deviation, and the dynamic adjustment rules of mapping, dynamically adjusts the candidate mapping relationship of indicators, generates the reasons for dynamic adjustment and supplementary evidence collection requirements, and outputs the evidence indicator mapping results. The evidence indicator mapping results include the control results corresponding to the candidate indicator mapping relationships, the reasons for dynamic control, and the requirements for supplementary evidence collection.

[0009] In one embodiment, the evidence event parsing record includes an evidence identifier, an evidence context normalization label, evidence semantic feature information, and an evidence state feature vector; the evidence state feature vector includes password state fingerprint information and a state timing identifier label; the password invocation state record includes key information, initialization vector information, password state fingerprint information, and a state timing identifier label associated with the evidence event parsing record.

[0010] In one embodiment, the candidate mapping relationship includes a set of candidate evidence records, evaluation indicator identification information, and candidate mapping evaluation information; the set of candidate evidence records consists of evidence event parsing records associated with the evaluation indicator identification information; the candidate mapping evaluation information includes candidate evidence support type and candidate mapping confidence index.

[0011] In one embodiment, the method for conflict verification of indicator candidate mapping relationships includes: constructing a key vector reuse conflict graph based on the cryptographic running state evolution chain and the candidate mapping state sub-chain; extracting the sub-graph corresponding to the candidate mapping state sub-chain from the key vector reuse conflict graph according to the indicator candidate mapping relationship, and determining the candidate mapping conflict sub-graph; Using the candidate mapping conflict subgraph as the conflict verification object, and combining the running state switching event record, repeated acquisition identification record and forward state evolution partial order, the first packet recurrence after switching, conflict topology association, evidence identity deviation and reverse state evolution are verified to obtain the first packet overlap rate after switching, conflict topology strength index, evidence identity deviation degree and key time arrow reversal index.

[0012] In one embodiment, the key vector multiplexing conflict graph includes conflict graph nodes, conflict graph edges, and conflict graph edge types; the conflict graph nodes are generated based on the cipher call state record and the evidence event parsing record associated with the cipher call state record; the conflict graph nodes in the candidate mapping conflict subgraph that are directly or indirectly connected by the conflict graph edges constitute the conflict connectivity component.

[0013] In one embodiment, when key information and initialization vector information are reused, password state fingerprint information is reproduced, state timing identifier tag is rolled back, password call state is reproduced before and after the running state switching event, or password call states with different evidence context normalization tags are reproduced cross-reproduced, conflict graph edges are established between the conflict graph nodes corresponding to the two password call state records. The conflict graph edge types include one or more of the following: key information and initialization vector information reuse type, password state fingerprint information reproduction type, state timing identifier label rollback type, password call state reproduction type before and after running state switching event, and password call state cross reproduction type with different evidence context normalization labels.

[0014] In one embodiment, the method for obtaining the overlap rate of the first packet after the switch includes: determining the conflict graph node corresponding to the first password call state record after each operation state switch as the first packet anchor node based on the operation state switch event record and the state timing identifier label; determining the conflict graph node corresponding to the password call state record before the operation state switch as the pre-switch reference node set; determining the conflict graph edge connecting the first packet anchor node and the pre-switch reference node set as the first packet reproduction candidate edge; and determining the maximum reproduction contribution value of each first packet anchor node based on the conflict graph edge type of the first packet reproduction candidate edge, the state timing distance determined by the state timing identifier label, and the difference in evidence context normalization label between the evidence event parsing records associated with the conflict graph nodes at both ends of the first packet reproduction candidate edge; and determining the overlap rate of the first packet after the switch as the ratio of the sum of the maximum reproduction contribution values ​​of each first packet anchor node to the sum of the maximum possible contribution values ​​of each first packet anchor node.

[0015] In one embodiment, the key time arrow reversal index is obtained by: establishing a forward evolution reference path based on the forward state evolution partial order in each conflicting connected component of the candidate mapping conflict subgraph; determining the reverse temporal conflict edge based on the forward evolution reference path, state temporal identifier label, and conflict graph edge type; calculating the reverse evolution contribution value based on the reverse temporal conflict edge, and calculating the conflict edge contribution value based on the conflict graph edges in the candidate mapping conflict subgraph; and determining the key time arrow reversal index as the ratio of the sum of the reverse evolution contribution values ​​of each reverse temporal conflict edge to the sum of the conflict edge contribution values ​​of all conflict graph edges in the candidate mapping conflict subgraph.

[0016] In one embodiment, the method for determining the reverse temporal conflict edge includes: determining the conflict graph edge of the state temporal identifier label rollback type as the reverse temporal conflict edge; and determining the conflict graph edge whose actual sequence relationship of the password call state records corresponding to the conflict graph nodes at both ends of the conflict graph edge is the opposite of the sequence relationship determined by the forward evolution reference path as the reverse temporal conflict edge.

[0017] In one embodiment, the backward evolution contribution value is calculated based on the conflict graph edge type of the backward temporal conflict edge, the difference in state temporal identifier labels corresponding to the conflict graph nodes at both ends of the backward temporal conflict edge, the number of levels crossed by the backward temporal conflict edge in the forward evolution reference path, and the percentage of reachable nodes of the backward temporal conflict edge. The contribution value of a conflict edge is calculated based on the conflict edge type in the candidate mapping conflict subgraph, the difference in the state time sequence label of the conflict nodes at both ends of the conflict edge, the number of levels crossed by the conflict edge in the forward evolution reference path, and the proportion of reachable nodes of the conflict edge. The reachable node percentage is the ratio of the number of conflict graph nodes reachable by the edges of the corresponding conflict graph to the total number of conflict graph nodes in the corresponding conflict connected component.

[0018] Compared with the prior art, the present invention has the following beneficial effects: This invention generates candidate mapping relationships between cryptographic evaluation evidence data and evaluation indicators based on a large model, evidence event parsing records, and a cryptographic evaluation indicator knowledge base. It also combines cryptographic call status records, running state switching event records, and candidate mapping relationships to form a cryptographic running state evolution chain, a positive state evolution partial order, and a candidate mapping state sub-chain. This makes the evidence indicator mapping process not only based on the evidence text content, but also further combined with the cryptographic running state and temporal evolution relationship for judgment, thereby improving the accuracy and consistency of the candidate mapping relationships. This invention performs conflict verification based on the cryptographic operational state evolution chain, candidate mapping state sub-chain, and indicator candidate mapping relationship. It obtains the first packet overlap rate, conflict topology strength index, evidence identity deviation degree, and key time arrow reversal index after switching. According to the mapping dynamic control rules, it dynamically controls the indicator candidate mapping relationship, generates dynamic control reasons and supplementary evidence collection requirements, so that situations such as state reproduction, evidence duplication, timing anomalies, or candidate mapping conflicts can be identified and handled, improving the credibility, interpretability, and support strength of the evidence indicator mapping results and evaluation conclusions. Attached Figure Description

[0019] Figure 1 This is a flowchart of a cryptographic evaluation evidence index mapping method based on a large model according to the present invention. Figure 2 This is a schematic diagram illustrating the generation of candidate index mapping relationships in this invention; Figure 3 This is a schematic diagram of the output of the dynamic control and evidence index mapping results in this invention. Detailed Implementation

[0020] Reference Figure 1 A method for mapping evidence indicators for cryptographic evaluation based on a large model, comprising: S1. Obtain the password evaluation evidence data of the information system under test, perform event-based parsing on the password evaluation evidence data, generate evidence event parsing records, and generate password call status records, running status switching event records, and duplicate collection identification records based on the evidence event parsing records. Password evaluation evidence data usually comes from different materials such as logs, messages, configuration files, interface call records, packet capture results, and running monitoring data. The original forms vary greatly, and when directly used to judge the evaluation indicators, problems such as unclear evidence boundaries, missing status information, or duplicate evidence collection may easily occur. Through event-based analysis, cryptographic evaluation evidence data is organized into evidence event analysis records with clear evidence identifiers, context, semantics, and state characteristics. This transforms fragmented evidence into event units that are easy to compare and correlate. Cryptographic call status records reflect the cryptographic call states involved in the evidence; operational state switching event records reflect the time and scenarios of changes in the operational state of the tested information system; and repeated collection identification records reflect situations where the same or similar evidence has been collected multiple times. This lays a data foundation for the analysis of evidence authenticity, independence, and state continuity.

[0021] The process involves acquiring cryptographic evaluation evidence data from the tested information system and performing event-based parsing on this data according to its source, collection time, business scenario, cryptographic call location, and evidence carrier type. This generates evidence event parsing records, which include evidence identifiers, evidence context normalization tags, evidence semantic feature information, and evidence state feature vectors. The evidence identifiers correspond to the original cryptographic evaluation evidence data. Evidence context normalization tags are normalized based on business access links, interface names, session markers, device nodes, application processes, and collection batches. Evidence semantic feature information is extracted from cryptographic algorithm names, cryptographic protocol fields, certificate content, key negotiation statements, encryption / decryption call descriptions, and exception messages. The evidence state feature vector consists of cryptographic state fingerprint information and state time sequence identifier tags. For example, when processing the interface access logs, transport layer security protocol handshake messages, and cryptographic device call logs of a certain government business platform, the certificate verification event, key negotiation event, session key generation event, and business message encryption event in the same user login process are parsed into evidence event parsing records, and evidence context normalization labels under the same business link source are configured for them. At the same time, state timing identifier labels are generated based on message sequence number, call timestamp, and state transition order. Based on the evidence status feature vector in the evidence event parsing record, a password call status record, a running status switching event record, and a repeated collection identification record are generated; among them, the password call status record includes key information, initialization vector information, password status fingerprint information, and status timing identifier label associated with the evidence event parsing record.

[0022] The evidence event analysis record includes at least one of the following: evidence identifier, evaluation object identifier, collection batch identifier, evidence source identifier, collection time, evidence collection sequence number, message sequence number, and state transition sequence number. Key information is recorded as follows: The initialization vector information is denoted as The algorithm identifier is denoted as The direction of the call is denoted as The evidence context normalization label is denoted as The status timing identifier label is denoted as , For the first The sequence number of the cryptographic call status record. Key information comes from at least one of the following: key index, key handle, key derivation tag, or key negotiation result digest; the original key value is not written to the record. Initialization vector information comes from at least one of the following: message fields, interface input parameters, call return data, or log record content. Algorithm identifier and call direction come from at least one of the following: cryptographic call interface, message protocol fields, or log record content; if missing, they are treated as missing necessary fields. Cryptographic status fingerprint information. Obtained by formula: ;

[0023] in, For hash operations, the name and version of the hash algorithm used are written into the collection configuration, and the same hash algorithm is used within the same collection batch; This is a field concatenation operator that follows a fixed field order, field length marker, and uniform encoding format. In the calculated fields, , and These are necessary fields; the algorithm needs to initialize the vector when... These are also required fields. If any required field is missing, When the algorithm does not require initialization vectors, Recorded as and participate Calculation. Evidence context normalization label. and status timing identifier label Record independently, do not participate Calculation. Evidence context normalization label. The evidence is formed by standardizing the evaluation object identifier, collection batch identifier, and evidence source identifier from the evidence event analysis record, according to a fixed field order, field length marking, and unified coding format; if all of the above fields are missing... Status timing identifier label Based on collection time Message sequence number and state transition number It is constructed in a fixed order; when only one or two items exist, the monotonic sequence number is filled in by the existing items in the order of collection. Missing fields are... Marked as such, it is not used in equality determination; if two records are missing the same field at the same time, it is not considered as reuse or reproduction.

[0024] The runtime state transition event log is generated based on changes in runtime state before and after login, before and after session reconstruction, before and after key update, before and after certificate switch, and before and after service restart. The same operational state switching event is identified by the same event identifier. The operational state switching event record includes the event identifier, the switching time, the state range before the switching, and the state range after the switching; password call state records for which the event identifier or the state range before and after the switching cannot be determined are not included in the edge construction of password call state reproduction type before and after the operational state switching event and the calculation of the overlap rate of the first packet after the switching.

[0025] The duplicate collection identification record is generated based on the overlap between the evidence identifier, the evidence context normalization label, the password status fingerprint information, and the status time sequence identifier label; For example, if two packet capture files come from different collection batches, but the same business interface still shows the same initialization vector information and the same password state fingerprint information after the key is updated, then while generating the corresponding password call state record, the identification result of duplicate collection or state reproduction between the evidence is recorded.

[0026] Reference Figure 2 S2, based on the large model, evidence event analysis records, and cryptography evaluation indicator knowledge base, generates candidate mapping relationships between cryptography evaluation evidence data and evaluation indicators; the cryptography evaluation indicator knowledge base stores the standard requirements, judgment points, evidence requirements, and common supporting material types of evaluation indicators; the large model, combined with the evidence semantic feature information in the evidence event analysis records, identifies the correspondence between cryptography evaluation evidence data and evaluation indicators. The generated candidate mapping relationships are not directly confirmed evaluation conclusions, but rather reflect candidate relationships that a certain set of cryptographic evaluation evidence data may support a certain evaluation indicator. This process can reduce the workload of manually searching for evidence item by item, while retaining candidate mapping evaluation information, leaving room for judgment in subsequent conflict verification and dynamic adjustment; The large model output uses structured fields, including evaluation indicator identifier information, candidate evidence record set, candidate evidence support type, and candidate mapping confidence index. The evaluation indicator identifier information is taken from the cryptographic evaluation indicator knowledge base; evaluation indicator identifiers from outside the knowledge base are not accepted. The candidate mapping confidence index for each candidate index mapping relationship is marked as follows: The range of values ​​is to Candidate evidence can be categorized into three types: strong supporting evidence, weak supporting evidence, and conflicting evidence requiring verification. It is used only as an evaluation parameter for the candidate mapping relationship of indicators, and not as an evaluation conclusion.

[0027] Based on the knowledge base of cryptographic evaluation indicators, the terms, verification objects, evidence requirements, judgment conditions and common evidence forms of the evaluation indicators are structured and organized. The evidence identifier, evidence context normalization label, evidence semantic feature information and evidence state feature vector in the evidence event analysis record are input into the large model. The large model performs semantic matching between the evidence semantic feature information and the indicator description in the knowledge base of evaluation indicators, checks the consistency between the evidence context normalization label and the business scenario, cryptographic application link and evidence acquisition location corresponding to the evaluation indicator, and makes association judgment between the evidence state feature vector and the cryptographic call status involved in the evaluation indicator, forming the initial association result between cryptographic evaluation evidence data and evaluation indicators. For example, when a certain evaluation indicator in the cryptographic evaluation indicator knowledge base requires verification of the confidentiality protection during the transmission process, the large model will match the transport layer security protocol handshake message, certificate verification record, session key negotiation record, and business message encryption call record with the verification object of the evaluation indicator, and exclude log records that only record ordinary access results without including the cryptographic call status.

[0028] The initial association results are aggregated according to the evaluation index identification information. Evidence event analysis records associated with the same evaluation index identification information are grouped into a candidate evidence record set. Based on the matching degree of evidence semantic feature information, the consistency of evidence context normalization labels, the completeness of evidence state feature vectors, and the complementary relationship between evidence event analysis records in the candidate evidence record set, candidate mapping evaluation information is generated. The candidate mapping evaluation information includes candidate evidence support type and candidate mapping confidence index. For example, when a certain evaluation indicator is associated with certificate chain verification records, key negotiation records, and encrypted message records, and the evidence context unification tags of the three types of evidence all point to the same business access link, the group of evidence event parsing records is classified into the same candidate evidence record set and assigned a higher candidate mapping confidence index; if there is only a single configuration screenshot and the corresponding password call status record is missing, its candidate evidence support type is recorded as weak support evidence and assigned a lower candidate mapping confidence index.

[0029] S3, based on the password call status record, the running state switching event record, and the indicator candidate mapping relationship, forms a password running state evolution chain, a forward state evolution partial order, and a candidate mapping state sub-chain; the password call status record reflects the state characteristics in one or more password calls, and the running state switching event record reflects the switching situation of the information system under test between different running stages. Based on these records, a cryptographic operation state evolution chain is compiled, which can show the relationship between cryptographic call states and changes in operational scenarios over time. The forward state evolution partial order reflects the sequential constraints that cryptographic call states should satisfy under normal operating conditions. The candidate mapping state sub-chain corresponds to the local state range involved in the candidate mapping relationship of a certain indicator, which facilitates centralized analysis of relevant states at the level of specific evaluation indicators and avoids irrelevant states interfering with the evidence judgment under the same indicator.

[0030] Read the key information, initialization vector information, password state fingerprint information and state timing identifier tag in the password call state record, and combine them with the switching time, running state before switching, running state after switching and related evidence event parsing record recorded in the running state switching event record to perform time sequence arrangement and state merging of the password call state record to form a password running state evolution chain. During the arrangement process, cryptographic call state records that appear consecutively under the same evidence context unification label and whose cryptographic state fingerprint information maintains an evolutionary relationship are grouped into the same chain segment. Cryptographic call state records that undergo operational state switching under different evidence context unification labels are sequentially linked according to state timing identifier labels. Records with gaps in state timing identifier labels, changes in key information, or abnormal reproduction of initialization vector information are retained as independent chain segment markers. Based on the actual sequential relationship of each cryptographic call state record in the cryptographic operational state evolution chain, the switching direction in the operational state switching event records, and the normal state progression relationship in the cryptographic call process, a forward state evolution partial order is established.

[0031] The forward state evolution partial order defines the constraints between cryptographic invocation states. For example, the session establishment state precedes the key negotiation completion state, the key negotiation completion state precedes the business message encryption state, and the key update state lags behind the original session key usage state. For candidate mapping relationships, the cryptographic invocation state records associated with each evidence event parsing record in the candidate evidence record set are extracted from the cryptographic operation state evolution chain, while maintaining their constraints in the forward state evolution partial order, forming a candidate mapping state sub-chain. For example, if the candidate evidence record set corresponding to a certain evaluation indicator includes transport layer security protocol handshake messages, certificate verification logs, and packet capture results of business ciphertext messages, then the cryptographic call state records associated with these three will be organized into candidate mapping state sub-chains according to the state order of certificate verification, key negotiation, session key generation, and business message encryption, and distinguished from other business link states in the complete cryptographic operation state evolution chain.

[0032] S4, based on the cryptographic operation state evolution chain, candidate mapping state sub-chain, and indicator candidate mapping relationship, performs conflict verification on the indicator candidate mapping relationship to obtain the first packet overlap rate after switching, conflict topology strength index, evidence identity deviation degree, and key time arrow reversal index; some cryptographic evaluation evidence data may seem to support a certain evaluation indicator semantically, but their corresponding cryptographic call states may have key information reuse, initialization vector information reuse, abnormal reproduction of cryptographic state fingerprints, abnormal state timing, and state duplication before and after operation state switching, etc. Conflict verification identifies anomalous associations within the candidate mapping state subchains. The first packet overlap rate after a switch reflects the degree of overlap between the first cipher call state after the state switch and the state before the switch; the conflict topology strength index reflects the clustering and diffusion of conflict relationships within the candidate mapping conflict range; the evidence identity deviation reflects the risk of duplicated or cross-contextual evidence being mistaken for independent evidence; and the key time arrow reversal index reflects whether there are anomalous evolutionary relationships in the cipher call states that are reversed from the forward state evolution order. These results collectively characterize the degree of evidence conflict hidden within the candidate mapping relationships.

[0033] Based on the cryptographic operation state evolution chain and candidate mapping state sub-chain, a key vector reuse conflict graph is constructed. Each cryptographic call state record and the evidence event parsing record associated with the cryptographic call state record are generated into a conflict graph node. When there is reuse of key information and initialization vector information, reproduction of cryptographic state fingerprint information, rollback of state time sequence identifier label, reproduction of cryptographic call state before and after operation state switching event, or cross reproduction of cryptographic call states with different evidence context normalization labels, conflict graph edges are established between the corresponding conflict graph nodes, and conflict graph edge types are configured for the conflict graph edges. Using password call state records as nodes in the conflict graph, the candidate mapping state subchain is the th... The cipher call state records associated with the candidate evidence record set of each indicator candidate mapping relationship are formed as a record sequence according to the state time sequence identifier label and the collection order. Within the same candidate mapping state sub-chain, the time sequence order of the cipher call state records is determined according to the state transition sequence number, message sequence number, and collection time, and then... The numbers are numbered consecutively, and the resulting numbers are denoted as follows: When the state transition sequence number is missing, the order is based on the message sequence number. When both the state transition sequence number and the message sequence number are missing, the order is based on the collection time. When all three are missing or have the same value, the order is based on the evidence collection sequence number. Comparison is only performed between password call state records that belong to the same evaluation object, the same collection batch, and the same candidate mapping state subchain; records that do not belong to the same time-series chain are not subject to state time-series identifier tag rollback determination, and the calculation of the state time-series identifier tag sequence difference is taken as... The actual collection order is determined by the evidence collection sequence number; if the evidence collection sequence number is missing, it is determined by the collection time; records for which the chronological order still cannot be determined are not considered. The criteria for constructing borders by type are not included. Conflict graph edges fall into five categories, denoted as follows: to : This is a multiplexing type for key information and initialization vector information. This refers to the type of fingerprint information reproduction for password status. The status sequence identifier label rollback type, This refers to the type of password call state reproduction before and after the runtime state switch event. This refers to the cross-reproduction type of different password call states for evidence context normalization labels. Without configured weights, The weight is 1.00. The weight is 0.85. The weight is 0.90. The weight is 0.95. The weight is 0.75. Conflict graph edges are established as undirected edges, with only one conflict graph edge established between the same pair of conflict graph nodes; calculations involving actual sequence relationships only determine the temporal direction of the conflict graph edge, without adding reverse edges. When the same conflict graph edge simultaneously satisfies multiple types, the type with the highest weight is determined as the primary type, and the conflict graph edge weight... Take the weight corresponding to the primary type. When multiple types have the same maximum weight, choose the type that best suits the primary type. , , , , The order determines the primary type. Non-primary types are retained in the edge attributes of the conflict graph, serving as the output content for dynamic adjustment reasons. In determining whether initialization vector information is equal, Used only as a fingerprint of password status The placeholder fields are not used as a basis for reusing initialization vector information; The valid comparison condition is , and Each edge construction condition corresponds one-to-one with the edge type in the conflict graph: The key information of the two corresponding records is the same and neither is empty, and the initialization vector information satisfies the valid comparison condition; The corresponding password status fingerprint information is the same and not empty; Records that are collected earlier in the actual collection sequence have a larger state temporal sequence position; The two records are located before and after the same running state switching event, respectively, and the password state fingerprint information is the same or the initialization vector information meets the valid comparison conditions. The evidence context normalization labels for the two records are not empty and are different, and the password state fingerprint information is the same, the key information is the same, or the initialization vector information satisfies the valid comparison conditions.

[0034] Based on the candidate evidence record set in the candidate index mapping relationship, the conflict graph nodes and their associated conflict graph edges involved in the candidate mapping state subchain are extracted from the key vector multiplexing conflict graph. The extracted conflict graph nodes and their associated conflict graph edges constitute the candidate mapping conflict subgraph corresponding to the candidate index mapping relationship.

[0035] Determine candidate mapping conflict subgraphs. Conflict graph nodes in candidate mapping conflict subgraphs that are directly or indirectly connected by conflict graph edges are classified into the same conflict connected component. For example, the candidate evidence record set corresponding to a certain evaluation indicator includes key negotiation record, encrypted message record and the first business message record after the operation restart. If the first business message record after the operation restart has the same initialization vector information and the same password state fingerprint information as the business message record before the restart, then a conflict graph edge of the password call state reproduction type before and after the operation state switching event is established between the corresponding conflict graph nodes. Using the candidate mapping conflict subgraph as the conflict verification object, and combining the running state switching event record, repeated acquisition identification record, and forward state evolution partial order, the first packet recurrence after the switch, conflict topology association, evidence identity deviation, and reverse state evolution are verified. Specifically, based on the running state switching event record and state time sequence identifier label, the conflict graph node corresponding to the first password call state record after each running state switch is determined as the first packet anchor node, and the conflict graph node corresponding to the password call state record before the running state switch is determined as the pre-switch reference node set. The conflict graph edge connecting the first packet anchor node and the pre-switch reference node set is determined as the first packet recurrence candidate edge. The maximum recurrence contribution value of each first packet anchor node is determined according to the conflict graph edge type, state time sequence distance, and evidence context normalization label difference. The ratio of the sum of the maximum recurrence contribution values ​​of each first packet anchor node to the sum of the maximum possible contribution values ​​of each first packet anchor node is recorded as the first packet overlap rate after the switch. The first packet anchor node is the password call state record with the smallest state sequence identifier tag position within the same candidate mapping state subchain and the state interval after the switch in the same operational state switching event. If multiple password call state records with the same smallest state sequence identifier tag position exist after the same operational state switching event, the one with the smallest message sequence number is used as the first packet anchor node; if the message sequence number is missing, the one with the smallest evidence collection sequence number is used as the first packet anchor node; if they still cannot be distinguished, this switching event is not included in the first packet overlap rate after the switch. The set of first packet anchor nodes is denoted as... First package anchoring node The corresponding reference node set before the switch is denoted as . Within the state interval before the switch of the same running state switching event, and... Belonging to the same candidate mapping state subchain and collected earlier than A set of conflict graph nodes. Connections and The set of candidate edges that reproduce the first package of the middle node is denoted as . For any given package, reproduce candidate edges. Reproducible contribution value Obtained by the following formula: ;

[0036] in, The weights corresponding to the primary type of the edges in this conflict graph. Anchoring node for the first package Compared with the reference node set before the switch The maximum state sequence identifier tag order difference between nodes. First packet anchor node. Maximum Reproducible Contribution for The maximum value of each recurrence contribution value. When empty Maximum possible contribution value This represents the maximum value among the edge weights of the five conflict types in the graph. The first packet overlap rate after the switch. Calculate using the following formula: ;

[0037] in, When the denominator is empty or the denominator is 0, .

[0038] The conflict topology strength index is obtained by statistically analyzing the number of conflicting edges within the candidate mapping conflict subgraph, the size of conflicting connected components, and the normalized label connectivity across evidence contexts. In the candidate mapping conflict subgraph corresponding to the candidate mapping relationships of each indicator, the set of conflict graph nodes is denoted as... The set of edges in a conflict graph is denoted as The conflict topology strength index is denoted as . Calculate using the following formula: ;

[0039] in, The conflict edge density is the ratio of the actual number of conflicting edges to the number of edges when each of any two distinct nodes in the node set creates a conflicting edge; when the number of nodes is less than 2, . The percentage of the most edge-conflicting connected component is calculated as the ratio of the number of nodes in the most edge-conflicting connected component to the total number of nodes in the candidate mapping conflict subgraph; when the conflict graph has no edges or no node set, . To determine the proportion of conflict edges with unified labels across evidence contexts, the ratio of the number of conflict graph edges where both ends of the evidence context have non-empty and distinct unified labels is taken to the total number of conflict graph edges; when the conflict graph edges are empty, .

[0040] Based on the overlap between evidence identifiers, evidence context normalization labels, password status fingerprint information, and status time sequence identifiers in the repeated collection and identification records, the degree of evidence identity deviation is obtained. No. The set of candidate evidence records for the candidate mapping relationship of each indicator is denoted as . , The number of internal evidence event analysis records is denoted as The degree of evidence identity deviation is denoted as The number of unordered record pairs in the candidate evidence record set that satisfy any of the following conditions is denoted as . The two records have the same evidence identifier and the evidence identifier is not empty; the two records have the same password status fingerprint information and the password status fingerprint information is not empty; the two records belong to the same evaluation object, the same collection batch and the same candidate mapping status subchain, the evidence context normalization label is the same, and the difference in the order of the status time sequence identifier label does not exceed 1. Calculate using the following formula: ;

[0041] in, hour, Record pairs that do not belong to the same time sequence chain are not included in the time sequence tag order difference. .

[0042] In each conflicting connected component, a forward evolution reference path is established based on the forward state evolution partial order. The forward state evolution partial order is determined based on the ascending order of the state temporal identifier labels and the collection order. The set of conflict graph edges in the candidate mapping conflict subgraph is denoted as... The set of conflict graph edges whose actual acquisition sequence is opposite to the forward state evolution direction is denoted as . Conflicting graph edges whose actual data collection sequence cannot be determined, whose forward state evolution direction cannot be determined, or whose end-state timing identifiers have the same sequence number are not included. Key time arrow reversed exponent. Calculate using the following formula: ;

[0043] in, For the edge of the conflict graph The weight corresponding to the main type. Empty or denominator is hour, .

[0044] Conflict graph edges with the state timing identifier label rollback type, and conflict graph edges whose actual sequence of password call state records corresponding to the conflict graph nodes at both ends of the conflict graph edge is reversed from the sequence determined by the forward evolution reference path, are identified as reverse temporal conflict edges. The reverse evolution contribution value is calculated based on the conflict graph edge type of the reverse temporal conflict edge, the difference in state timing identifier labels corresponding to the conflict graph nodes at both ends of the reverse temporal conflict edge, the number of levels crossed by the reverse temporal conflict edge in the forward evolution reference path, and the proportion of reachable nodes of the reverse temporal conflict edge. The contribution value is calculated based on the conflict graph edge type of the conflict graph edge in the candidate mapping conflict subgraph, the difference in the state time sequence identifier labels corresponding to the conflict graph nodes at both ends of the conflict graph edge, the level crossed by the conflict graph edge in the forward evolution reference path, and the proportion of reachable nodes of the conflict graph edge. The proportion of reachable nodes is the ratio of the number of conflict graph nodes reachable by the corresponding conflict graph edge to the total number of conflict graph nodes in the corresponding conflict connected component. The ratio of the sum of the reverse evolution contribution values ​​of each reverse time sequence conflict edge to the sum of the conflict edge contribution values ​​of all conflict graph edges in the candidate mapping conflict subgraph is denoted as the key time arrow reversal index.

[0045] Reference Figure 3 S5, based on the key time arrow reversal index, the overlap rate of the first packet after switching, the conflict topology strength index, the degree of evidence identity deviation, and the dynamic adjustment rules of the mapping, dynamically adjusts the candidate mapping relationship of the indicators, generates the reasons for dynamic adjustment and supplementary evidence collection requirements, and outputs the evidence indicator mapping results; the dynamic adjustment rules of the mapping receive the key time arrow reversal index, the overlap rate of the first packet after switching, the conflict topology strength index, and the degree of evidence identity deviation, and incorporate the conflict verification results into the adjustment process of the candidate mapping relationship of the indicators. For candidate mapping relationships of indicators with low conflict degree and relatively stable evidence status relationship, their adjustment results are retained; For candidate index mapping relationships exhibiting state recurrence, time sequence reversal, evidence identity deviation, or conflicting topological anomalies, the control results and candidate mapping evaluation information are adjusted accordingly. The dynamic control reason record identifies the source of the anomaly triggering the adjustment, the type of conflict, and the evidence differences. Supplementary evidence requirements indicate the evidence content requiring further verification or supplementation. The output evidence index mapping results include both the control results corresponding to the candidate index mapping relationships and the dynamic control reasons and supplementary evidence requirements, facilitating cryptographic assessment personnel in verifying the supporting evidence relationships and their risk sources.

[0046] The algorithm reads the key time arrow reversal index, the first packet overlap rate after switching, the conflict topology strength index, and the evidence identity deviation degree. These results are then matched with the threshold range, combined triggering conditions, control priorities, and evidence integrity requirements in the dynamic mapping control rules to dynamically control the candidate indicator mapping relationships, generating evidence indicator mapping results. The control results include retaining candidate indicator mapping relationships, lowering candidate mapping confidence indices, adjusting candidate evidence support types, marking conflicts for verification, and eliminating abnormal candidate mapping relationships. The dynamic mapping control rules can be set as follows: The key time arrow reversal index is denoted as The overlap rate of the first packet after the switch is recorded as follows: The conflict topology strength index is denoted as The degree of evidence identity deviation is denoted as Candidate mapping confidence index is marked as The adjusted candidate mapping confidence index is labeled as The confidence deduction is recorded as... The initial value is 0. When greater than or equal to 0.20, Increase by 0.25; When greater than or equal to 0.60, Increase by 0.20; When greater than or equal to 0.50, Increase by 0.15; When greater than or equal to 0.50, Increase by 0.15; when multiple conditions are met simultaneously, the corresponding deduction values ​​are accumulated. Calculate using the following formula: ;

[0047] Among them, when all four indices are less than the corresponding threshold, the candidate mapping relationship is retained; when one index is greater than or equal to the corresponding threshold, the confidence index of the candidate mapping is reduced; when two or more indices are greater than or equal to the corresponding threshold and When this occurs, the candidate evidence support type is set to weak support evidence; if two or more indices are greater than or equal to the corresponding threshold and When this happens, the candidate mapping relationship of the indicators is marked as conflicting and needs to be verified; if two or more indices are greater than or equal to the corresponding threshold and At that time, abnormal candidate mapping relationships are eliminated. The reasons for dynamic adjustment include the index name, index value, threshold, type of edge in the association conflict graph, and evidence identifier that are greater than or equal to the threshold; the supplementary evidence collection requirements include at least one of the following: the original message to be supplemented, the password call log, the key update record, the key destruction record, the continuous message sequence, and the original collection environment description.

[0048] For example, the candidate evidence record set corresponding to a certain evaluation indicator includes key negotiation logs, business encrypted messages, and the first encrypted message after service restart. If the first encrypted message has the same initialization vector information and the same password state fingerprint information as the message before restart, and there is a state time sequence identifier tag rollback in the corresponding conflicting connected component, then the candidate mapping confidence index of the candidate mapping relationship of this indicator is reduced according to the mapping dynamic adjustment rules. The reason for dynamic adjustment is recorded as the recurrence of password call state after the running state switch and the accompanying reverse state evolution. The supplementary evidence requirements are recorded as the key destruction record, key regeneration record, continuous message sequence before and after restart, and original collection environment description at the time of service restart. The output evidence indicator mapping result includes the adjustment result corresponding to the candidate mapping relationship of this indicator, the reason for dynamic adjustment, and the supplementary evidence requirements.

[0049] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for mapping cryptographic evaluation evidence indicators based on a large model, characterized in that, include: S1. Obtain password evaluation evidence data from the information system under test, perform event-based parsing on the password evaluation evidence data, generate evidence event parsing records, and generate password call status records, running status switching event records, and repeated collection identification records based on the evidence event parsing records. S2, based on the large model, evidence event parsing records and cryptography evaluation indicator knowledge base, generates candidate mapping relationships between cryptography evaluation evidence data and evaluation indicators; S3, based on the cryptographic call state record, the running state switching event record and the indicator candidate mapping relationship, forms the cryptographic running state evolution chain, the positive state evolution partial order and the candidate mapping state sub-chain; S4, based on the cryptographic running state evolution chain, candidate mapping state sub-chain and indicator candidate mapping relationship, performs conflict verification on the indicator candidate mapping relationship to obtain the first packet overlap rate after switching, conflict topology strength index, evidence identity deviation degree and key time arrow reversal index. S5, based on the key time arrow reversal index, the first packet overlap rate after switching, the conflict topology strength index, the degree of evidence identity deviation, and the dynamic adjustment rules of mapping, dynamically adjusts the candidate mapping relationship of indicators, generates the reasons for dynamic adjustment and supplementary evidence collection requirements, and outputs the evidence indicator mapping results. The evidence indicator mapping results include the control results corresponding to the candidate indicator mapping relationships, the reasons for dynamic control, and the requirements for supplementary evidence collection.

2. The method for mapping cryptographic evaluation evidence indicators based on a large model according to claim 1, characterized in that, The evidence event parsing record includes evidence identifier, evidence context normalization label, evidence semantic feature information, and evidence state feature vector; the evidence state feature vector includes cryptographic state fingerprint information and state timing identifier label; the cryptographic call state record includes key information, initialization vector information, cryptographic state fingerprint information, and state timing identifier label associated with the evidence event parsing record.

3. The method for mapping cryptographic evaluation evidence indicators based on a large model according to claim 2, characterized in that, The candidate mapping relationship includes a set of candidate evidence records, evaluation indicator identification information, and candidate mapping evaluation information; the set of candidate evidence records consists of evidence event analysis records associated with the evaluation indicator identification information; the candidate mapping evaluation information includes candidate evidence support type and candidate mapping confidence index.

4. The method for mapping cryptographic evaluation evidence indicators based on a large model according to claim 3, characterized in that, The methods for conflict verification of indicator candidate mapping relationships include: constructing a key vector reuse conflict graph based on the cryptographic operation state evolution chain and the candidate mapping state sub-chain; extracting the sub-graph corresponding to the candidate mapping state sub-chain from the key vector reuse conflict graph according to the indicator candidate mapping relationship, and determining the candidate mapping conflict sub-graph; Using the candidate mapping conflict subgraph as the conflict verification object, and combining the running state switching event record, repeated acquisition identification record and forward state evolution partial order, the first packet recurrence after switching, conflict topology association, evidence identity deviation and reverse state evolution are verified to obtain the first packet overlap rate after switching, conflict topology strength index, evidence identity deviation degree and key time arrow reversal index.

5. The method for mapping cryptographic evaluation evidence indicators based on a large model according to claim 4, characterized in that, The key vector multiplexing collision graph includes collision graph nodes, collision graph edges, and collision graph edge types; Conflict graph nodes are generated based on password call status records and evidence event parsing records associated with password call status records; conflict graph nodes directly or indirectly connected by conflict graph edges in the candidate mapping conflict subgraph constitute conflict connected components.

6. The method for mapping cryptographic evaluation evidence indicators based on a large model according to claim 5, characterized in that, When key information and initialization vector information are reused, password state fingerprint information is reproduced, state timing identifier label is rolled back, password call state is reproduced before and after the running state switching event, or password call states with different evidence context normalization labels are reproduced cross-reproduced between two password call state records, conflict graph edges are established between the conflict graph nodes corresponding to the two password call state records. The conflict graph edge types include one or more of the following: key information and initialization vector information reuse type, password state fingerprint information reproduction type, state timing identifier label rollback type, password call state reproduction type before and after running state switching event, and password call state cross reproduction type with different evidence context normalization labels.

7. The method for mapping cryptographic evaluation evidence indicators based on a large model according to claim 1, characterized in that, The method for obtaining the first packet overlap rate after the switchover includes: based on the running state switchover event record and the state timing identifier label, the conflict graph node corresponding to the first password call state record after each running state switchover is determined as the first packet anchor node, and the conflict graph node corresponding to the password call state record before the running state switchover is determined as the pre-switch reference node set; the conflict graph edge connecting the first packet anchor node and the pre-switch reference node set is determined as the first packet reproduction candidate edge, and the maximum reproduction contribution value of each first packet anchor node is determined based on the conflict graph edge type of the first packet reproduction candidate edge, the state timing distance determined by the state timing identifier label, and the difference in evidence context normalization label between the evidence event parsing records associated with the conflict graph nodes at both ends of the first packet reproduction candidate edge; the ratio of the sum of the maximum reproduction contribution values ​​of each first packet anchor node to the sum of the maximum possible contribution values ​​of each first packet anchor node is determined as the first packet overlap rate after the switchover.

8. The method for mapping cryptographic evaluation evidence indicators based on a large model according to claim 7, characterized in that, The key time arrow reversal index is obtained by: establishing a forward evolution reference path based on the forward state evolution partial order in each conflicting connected component of the candidate mapping conflict subgraph; determining the reverse temporal conflict edge based on the forward evolution reference path, state temporal identifier label, and conflict graph edge type; calculating the reverse evolution contribution value based on the reverse temporal conflict edge, and calculating the conflict edge contribution value based on the conflict graph edges in the candidate mapping conflict subgraph; and determining the key time arrow reversal index as the ratio of the sum of the reverse evolution contribution values ​​of each reverse temporal conflict edge to the sum of the conflict edge contribution values ​​of all conflict graph edges in the candidate mapping conflict subgraph.

9. The method for mapping cryptographic evaluation evidence indicators based on a large model according to claim 8, characterized in that, The methods for determining reverse temporal conflict edges include: identifying conflict graph edges whose conflict graph edge type is state temporal identifier label rollback type as reverse temporal conflict edges; identifying conflict graph edges whose actual sequence of password call state records corresponding to the conflict graph nodes at both ends of the conflict graph edge is the opposite of the sequence of sequence determined by the forward evolution reference path as reverse temporal conflict edges.

10. The method for mapping cryptographic evaluation evidence indicators based on a large model according to claim 9, characterized in that, The backward evolution contribution value is calculated based on the conflict graph edge type of the backward temporal conflict edge, the difference in state temporal identifier labels corresponding to the conflict graph nodes at both ends of the backward temporal conflict edge, the number of levels crossed by the backward temporal conflict edge in the forward evolution reference path, and the proportion of reachable nodes of the backward temporal conflict edge. The contribution value of a conflict edge is calculated based on the conflict edge type in the candidate mapping conflict subgraph, the difference in the state time sequence label of the conflict nodes at both ends of the conflict edge, the number of levels crossed by the conflict edge in the forward evolution reference path, and the proportion of reachable nodes of the conflict edge. The reachable node percentage is the ratio of the number of conflict graph nodes reachable by the edges of the corresponding conflict graph to the total number of conflict graph nodes in the corresponding conflict connected component.

Images