Information management and control method and system of information protection platform

Abstract

The application discloses an information management and control method and system of an information protection platform, and relates to the technical field of information management and control methods. According to the grade variation of the primary protection level, the multiple attack information to be managed and controlled, and the corresponding attack means level, the information emergency system is determined, and based on the information emergency system, the load workload of the information protection platform, and the protection level of the corresponding core information space, the corresponding information management and control measures are determined, thereby improving the accuracy of the information management and control measures. Therefore, the floating security range of the information protection platform is determined based on each sub-information management and control project and the attack range of the corresponding attack information; if the floating security range reaches the risk warning line, the risk management and control system of the information protection platform is triggered, and the information multiple protection event is determined, and based on the information multiple protection event, the multiple information spaces corresponding to the information protection platform, and the attack direction of the attack information, the dynamic protection event is constructed, thereby improving the accuracy of the dynamic protection event.

Description

Technical Field

[0001] This invention relates to the technical field of information management methods, and more particularly to an information management method and system for an information protection platform. Background Technology

[0002] With the development of technology, information attacks have gradually gained attention. In some drills, information protection platforms defend against attack information while being attacked themselves. Once the information space of the information protection platform is invaded by malicious information, it poses a significant threat to the information space. In existing technologies, information protection platforms provide basic protection for each information space. However, under the attack of numerous attack messages, each information space of the information protection platform gradually comes under attack pressure. However, each information space only has basic protection measures and cannot provide dynamic protection for different information spaces, which affects the accuracy of dynamic protection events. Summary of the Invention

[0003] The purpose of this invention is to overcome the shortcomings of the prior art. This invention provides an information management method and system for an information protection platform.

[0004] This invention provides an information management method for an information protection platform, comprising: In the simulation exercise of information attack, the information protection platform collects the corresponding information attack signals, and determines the attacked information space of the information protection platform based on the detection of the information attack signals. The primary protection level of the information protection platform is determined based on the attacked information space, the corresponding attack information, and the working status of the information protection platform; the primary protection level changes dynamically with the attack intensity of multiple attack information. The information emergency response system is determined based on the change in the primary protection level, the multiple attack information to be managed, and the corresponding attack method level. Based on the information emergency response system, the workload of the information protection platform, and the protection level of the corresponding core information space, the corresponding information control measures are determined. Based on the identification of information control measures, multiple sub-information control items are determined, and the floating security range of the information protection platform is determined based on the attack range of each sub-information control item and the corresponding attack information. If the floating security range touches the risk warning line, the risk control system of the information protection platform will be triggered, and a multi-protection information event will be identified. Based on the multi-protection information event, the multiple information spaces corresponding to the information protection platform, and the attack direction of the attack information, a dynamic protection event will be constructed.

[0005] This invention provides an information management and control system for an information protection platform. The information management and control system is applied to the aforementioned information management and control method for the information protection platform. The information management and control system includes: The attacked information space module is used to collect corresponding information attack signals based on the information protection platform during information attack simulation exercises, and to determine the attacked information space of the information protection platform based on the detection of the information attack signals. The primary protection level module is used to determine the primary protection level of the information protection platform based on the attacked information space, the corresponding attack information, and the working status of the information protection platform; the primary protection level changes dynamically with the attack intensity of multiple attack information. The information control measures module is used to determine the information emergency response system based on the change in the primary protection level, the multiple attack information to be controlled and the corresponding attack method level, and to determine the corresponding information control measures based on the information emergency response system, the workload of the information protection platform and the protection level of the corresponding core information space. The floating security range module is used to identify multiple sub-information control items based on the identification of information control measures, and to determine the floating security range of the information protection platform based on the attack range of each sub-information control item and the corresponding attack information. The dynamic protection event module is used to trigger the risk control system of the information protection platform if the floating security range touches the risk warning line, and to determine the information multi-protection event. Based on the information multi-protection event, the multiple information spaces corresponding to the information protection platform, and the attack direction of the attack information, a dynamic protection event is constructed.

[0006] Compared with the prior art, the beneficial effects of the present invention are: In this embodiment of the invention, the method described herein, during a simulated information attack exercise, collects corresponding information attack signals based on the information protection platform, and determines the attacked information space of the information protection platform based on the detection of the attacked information signals; determines the primary protection level of the information protection platform based on the attacked information space, the corresponding attack information, and the working status of the information protection platform; determines the information emergency response system based on the level change of the primary protection level, the multiple attack information to be managed, and the corresponding attack method level; and determines corresponding information control measures based on the information emergency response system, the workload of the information protection platform, and the protection level of the corresponding core information space. This method introduces the level change of the primary protection level, incorporates the overall consideration of the information emergency response system, the workload of the information protection platform, and the protection level of the corresponding core information space, and improves the accuracy of information control measures.

[0007] Therefore, multiple sub-information control items are identified based on the information control measures. The floating security range of the information protection platform is determined based on the attack range of each sub-information control item and the corresponding attack information. If the floating security range touches the risk warning line, the risk control system of the information protection platform is triggered, and a multi-protection information event is identified. Based on the multi-protection information event, the multiple information spaces corresponding to the information protection platform, and the attack direction of the attack information, a dynamic protection event is constructed. This introduces the floating security range of the information protection platform, further controlling the floating security range of the information protection platform. This achieves a holistic consideration of the multi-protection information event, the multiple information spaces corresponding to the information protection platform, and the attack direction of the attack information, improving the accuracy of the dynamic protection event. Attached Figure Description

[0008] Figure 1 This is a flowchart illustrating the information management method of the information protection platform in an embodiment of the present invention; Figure 2 This is a flowchart illustrating step S11 of the information management method of the information protection platform in this embodiment of the invention. Figure 3 This is a flowchart illustrating step S12 of the information management method of the information protection platform in this embodiment of the invention. Figure 4 This is a flowchart illustrating step S13 of the information management method of the information protection platform in this embodiment of the invention. Figure 5 This is a flowchart illustrating step S14 of the information management method of the information protection platform in this embodiment of the invention. Figure 6 This is a flowchart illustrating step S15 of the information management method of the information protection platform in this embodiment of the invention. Figure 7 This is a schematic diagram of the structural composition of the information management system of the information protection platform in an embodiment of the present invention. Detailed Implementation

[0009] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention.

[0010] Please see Figures 1 to 7 An information management method for an information protection platform, applied to information management scenarios; the information management method of the information protection platform includes: Step S11: In the simulation exercise of information attack, the corresponding information attack signal is collected based on the information protection platform, and the attacked information space of the information protection platform is determined based on the detection of the information attack signal. Step S12: Determine the primary protection level of the information protection platform based on the attacked information space, the corresponding attack information, and the working status of the information protection platform; the primary protection level changes dynamically with the attack intensity of multiple attack information. Step S13: Determine the information emergency response system based on the change in the primary protection level, the multiple attack information to be managed, and the corresponding attack method level, and determine the corresponding information control measures based on the information emergency response system, the load workload of the information protection platform, and the protection level of the corresponding core information space. Step S14: Based on the identification of information control measures, determine multiple sub-information control items, and determine the floating security range of the information protection platform based on the attack range of each sub-information control item and the corresponding attack information; Step S15: If the floating security range touches the risk warning line, the risk control system of the information protection platform is triggered, and the information multi-protection event is identified. Based on the information multi-protection event, the multiple information spaces corresponding to the information protection platform, and the attack direction of the attack information, a dynamic protection event is constructed.

[0011] refer to Figure 2 In step S11, the specific steps are as follows: S111: A simulation exercise system for information attacks is constructed based on an information protection platform and an information attack source. The information protection platform and the information attack source are in communication. The information attack source launches continuous information attacks on the information protection platform. At this time, the information protection platform is monitored in real time, and the corresponding information attack signals are collected. S112: Based on the information attack signal and the corresponding attack method, determine multiple attack factors, and determine the attacked information space of the information protection platform according to the multiple attack factors and the information attack mark of the information protection platform.

[0012] In the embodiments of this application, an information attack simulation exercise system is constructed based on an information protection platform and an information attack source. The information protection platform and the information attack source are in a communication state, and the information attack source continuously attacks the information protection platform. At this time, the information protection platform is monitored in real time, and the corresponding information attack signal is collected, thus introducing the collection of the corresponding information attack signal.

[0013] At this time, the simulation exercise system consists of the A-type information protection platform and the B-type attack source, and a stable communication connection is established between the two. In this simulation environment, the B-type attack source will continuously launch various attacks on the A-type platform, including but not limited to DDoS attacks, SQL injection, cross-site scripting attacks, malicious code injection and other attack forms.

[0014] During the attack, the monitoring system of Platform A will run in real time, collecting various attack signals. These signals include abnormal network traffic, abnormal system resource utilization, port scanning activity, abnormal login attempts, abnormal changes in data packets, and other indicators. For example, when attack source B launches a DDoS attack, Platform A will detect a sudden surge in network traffic, and at the same time, the system's CPU and memory usage will rise sharply. When attack source B attempts SQL injection, the platform will detect abnormal database query statements containing a large number of special characters and unconventional SQL syntax.

[0015] These attacked signals are captured in real time by the sensors and probes of the A-type platform and transmitted to the central analysis system for preliminary processing. The acquisition process is continuous, ensuring that various attack behaviors and patterns of the B attack source can be captured, providing a sufficient data foundation for subsequent attack space determination. Furthermore, multiple attack factors are identified based on the information attack signals and corresponding attack methods. The attacked information space of the information protection platform is determined based on the multiple attack factors and the information attack markers of the information protection platform. This approach takes into account the overall consideration of multiple attack factors and the information attack markers of the information protection platform, ensuring the accuracy of the attacked information space of the information protection platform.

[0016] At this point, based on the collected attack signals, the A-type platform will conduct in-depth analysis and identify multiple key attack factors. These attack factors include multiple dimensions such as attack type, attack frequency, attack intensity, attack duration, target system, and attack source characteristics. For example, by analyzing the attack patterns of attack source B, the platform identifies the following attack factors: high-frequency port scanning (more than 1,000 times per minute), continuous SQL injection attempts (more than 500 times per hour), and abnormal packet size distribution (a large number of packets exceeding the normal range).

[0017] Meanwhile, the A-type platform incorporates its own information attack marking system. These markings are identifiers pre-set on various key nodes and systems of the platform, used to quickly locate and identify attacked areas; for example, the web server of the A-type platform is marked as "WS-001", the database system as "DB-001", and the user authentication system as "UA-001", etc.

[0018] By matching and analyzing the identified attack factors with these attack markers, the Model A platform can accurately determine the attacked information space. For example, when a large number of SQL injection attempts targeting the "WS-001" marker are detected, the system will determine that the web server is part of the attacked information space; when abnormal database queries targeting the "DB-001" marker are found, the database system will also be included in the attacked information space.

[0019] Specifically, attack source B launched a 30-minute composite attack on the A-type information protection platform. In the first 10 minutes, attack source B mainly conducted port scanning and vulnerability detection. The A-type platform detected a large number of scanning activities targeting the "FW-001" (firewall) and "WS-001" (web server) tags, and the system resource utilization rate increased by 15%.

[0020] Over the next 15 minutes, attack source B shifted to SQL injection and XSS attacks, primarily targeting the "WS-001" and "DB-001" markers. Platform A detected abnormal HTTP requests and database queries, resulting in prolonged web server response times and a surge in database connections. In the final 5 minutes, attack source B attempted privilege escalation and data theft, targeting the "UA-001" (user authentication system) and "DB-001" markers. The platform detected abnormal login attempts and data export operations.

[0021] Through the analysis of this series of attack signals, the A-type platform identified the attacked information space as including: Web server (WS-001), database system (DB-001), user authentication system (UA-001), and firewall (FW-001). These four key systems constitute the current attacked information space, providing clear protection targets for subsequent protection level determination and emergency response.

[0022] This precise method of identifying the attacked information space enables the A-type platform to allocate protection resources in a targeted manner, ensuring effective protection of critical systems while avoiding over-protection of unaffected areas, thus achieving optimized allocation of protection resources. Optionally, the attacked information space refers to the collection of information systems, network areas, data resources, or functional modules within the information protection platform that are directly or indirectly affected and threatened by attack sources.

[0023] refer to Figure 3 In step S12, the specific steps are as follows: S121: Collect the attacked information space, determine the information distribution pattern of the attacked information space based on the detection of the attacked information space, and determine the first protection level coefficient according to the information distribution pattern of the attacked information space and the corresponding attack information. S122: Collect multiple working data from the information protection platform and determine the working status of the information protection platform based on the multiple working data; determine the second protection level coefficient based on the information distribution pattern of the attacked information space and the working status of the information protection platform; determine the primary protection level of the information protection platform based on the mapping relationship between the first protection level coefficient, the second first protection level coefficient and the first protection level; at the same time, monitor the attack intensity of the attack information in real time, and the primary protection level changes dynamically with the attack intensity of multiple attack information.

[0024] In the embodiments of this application, the attacked information space is collected, the information distribution pattern of the attacked information space is determined based on the detection of the attacked information space, and the first protection level coefficient is determined according to the information distribution pattern of the attacked information space and the corresponding attack information. This takes into account the overall consideration of the information distribution pattern of the attacked information space and the corresponding attack information, and ensures the accuracy of the first protection level coefficient.

[0025] At this point, the A-type platform will collect the attacked information space determined in step S11, including the Web server (WS-001), database system (DB-001), user authentication system (UA-001), and firewall (FW-001); the platform will conduct in-depth analysis on these attacked information spaces to determine the information distribution pattern of each space.

[0026] Information distribution patterns refer to the organizational structure, sensitivity, importance, and distribution density of various types of information within the attacked information space. For example, a web server (WS-001) contains publicly available web page information, user interaction interfaces, and some business logic, exhibiting an information distribution pattern of "high interaction - medium sensitivity." A database system (DB-001) stores user data, core business data, and system configuration information, exhibiting a "high density - high sensitivity" pattern. A user authentication system (UA-001) contains user credentials, permission information, and authentication logic, exhibiting a "critical - high sensitivity" pattern. A firewall (FW-001) contains network rules and access control policies, exhibiting a "control point - medium sensitivity" pattern.

[0027] Meanwhile, the A-type platform will analyze the specific attack information of the B attack source targeting these information spaces, including attack type, attack frequency, and attack target accuracy; for example, the B attack source launched a high-frequency SQL injection attack on the database system (DB-001), attempted a brute-force attack on the user authentication system (UA-001), and carried out an XSS attack on the web server (WS-001).

[0028] Based on these information distribution patterns and corresponding attack information, Platform A calculates the first protection level coefficient. For example, for a "high-density, high-sensitivity" database system subjected to a high-frequency SQL injection attack, the first protection level coefficient is set to 0.85 (high value); for a "critical, high-sensitivity" user authentication system subjected to brute-force attacks, the coefficient is 0.80; for a "high-interaction, medium-sensitivity" web server subjected to an XSS attack, the coefficient is 0.65; and for a "control point, medium-sensitivity" firewall subjected to port scanning, the coefficient is 0.50. Optionally, the first protection level coefficient refers to a quantitative indicator calculated based on the information distribution pattern and corresponding attack information characteristics of the attacked information space in the information management method of the information protection platform. This coefficient reflects the basic protection strength required by the attacked information space under the current attack situation and is one of the key parameters for determining the primary protection level.

[0029] Furthermore, multiple operational data points from the information protection platform are collected, and the platform's operational status is determined based on this data. A second protection level coefficient is determined based on the information distribution pattern of the attacked information space and the platform's operational status. The primary protection level of the information protection platform is then determined based on the mapping relationship between the first protection level coefficient, the second first protection level coefficient, and the first protection level. Simultaneously, the attack intensity of the attack information is monitored in real time, and the primary protection level dynamically changes with the attack intensity of multiple attack information points. This comprehensive consideration of the mapping relationship between the first protection level coefficient, the second first protection level coefficient, and the first protection level ensures the accuracy of the primary protection level of the information protection platform.

[0030] At this time, the A-type platform will collect multiple work data, including key performance indicators such as CPU utilization, memory usage, network bandwidth utilization, response latency, and concurrent connections. For example, under the attack of the B attack source, the platform detected that the CPU utilization reached 75%, the memory usage was 68%, the network bandwidth utilization was 82%, the response latency increased to 200ms, and the number of concurrent connections reached 3 times the normal value.

[0031] Based on this work data, the Model A platform will assess the current working status and classify it into "normal", "high load", "high load" or "overload" states. In the current example, because multiple indicators are close to or exceed the threshold, the platform determines it to be in the "high load" state.

[0032] The platform calculates a second protection level coefficient by combining the information distribution pattern of the attacked information space with the current operating status. For example, considering a "high-density, high-sensitivity" database system under "high load," the second protection level coefficient is 0.75; a "critical, high-sensitivity" user authentication system under the same condition has a coefficient of 0.70; other systems will also obtain corresponding coefficient values ​​based on their importance and current status. Optionally, the second protection level coefficient refers to another key quantitative indicator calculated based on the information distribution pattern of the attacked information space and the current operating status of the information protection platform in the information management method of the information protection platform. It works together with the first protection level coefficient to determine the primary protection level of the information protection platform. The second protection level coefficient mainly reflects the platform's actual protection capability and resource guarantee level for the attacked information space under the current workload and system status.

[0033] Platform A determines the primary protection level based on the first and second protection level coefficients through a preset mapping relationship. For example, the platform uses a weighted average algorithm: Primary Protection Level = (First Protection Level Coefficient × 0.6) + (Second Protection Level Coefficient × 0.4); taking a database system as an example: (0.85 × 0.6) + (0.75 × 0.4) = 0.81, corresponding to a primary protection level of "Level 3 High Protection". At this point, the primary protection level is a comprehensive rating index calculated based on the first and second protection level coefficients, reflecting the current required protection strength of the attacked information space and the platform's actual protection capabilities. It is the basic protection level in the information protection system, directly determining the strength of the protective measures and the degree of resource investment to be taken against the attacked information space.

[0034] Meanwhile, Platform A will monitor the attack intensity changes of Attack Source B in real time. For example, when Attack Source B suddenly increases the frequency of SQL injection attacks, increasing the attack intensity of the database system by 50%, the platform will immediately recalculate the first protection level coefficient (from 0.85 to 0.92) and adjust the primary protection level accordingly (from "Level 3 High Protection" to "Level 4 Emergency Protection"). Conversely, when the attack intensity weakens, the protection level will also be reduced accordingly to avoid wasting resources.

[0035] Specifically, the A-type platform collects multiple operational data, including key performance indicators such as CPU utilization, memory usage, network bandwidth utilization, response latency, and concurrent connections. For example, under the attack from the B attack source, the platform detected that the CPU utilization reached 75%, the memory usage was 68%, the network bandwidth utilization was 82%, the response latency increased to 200ms, and the number of concurrent connections reached 3 times the normal value.

[0036] Based on this work data, the Model A platform will assess the current working status and classify it into "normal", "high load", "high load" or "overload" states. In the current example, because multiple indicators are close to or exceed the threshold, the platform determines it to be in the "high load" state.

[0037] The platform will combine the information distribution pattern of the attacked information space with the current working status to calculate the second protection level coefficient. For example, considering that the "high density-high sensitivity" database system is under "high load" state, the second protection level coefficient is 0.75; the "critical-high sensitivity" user authentication system is under the same state, with a coefficient of 0.70; other systems will also get corresponding coefficient values ​​according to their importance and current state.

[0038] The A-type platform determines the primary protection level based on the first protection level coefficient and the second protection level coefficient through a preset mapping relationship. For example, the platform uses a weighted average algorithm: Primary protection level = (first protection level coefficient × 0.6) + (second protection level coefficient × 0.4); taking the database system as an example: (0.85 × 0.6) + (0.75 × 0.4) = 0.81, corresponding to a primary protection level of "Level 3 High Protection".

[0039] Meanwhile, Platform A will monitor the attack intensity changes of Attack Source B in real time. For example, when Attack Source B suddenly increases the frequency of SQL injection attacks, increasing the attack intensity of the database system by 50%, the platform will immediately recalculate the first protection level coefficient (from 0.85 to 0.92) and adjust the primary protection level accordingly (from "Level 3 High Protection" to "Level 4 Emergency Protection"). Conversely, when the attack intensity weakens, the protection level will also be reduced accordingly to avoid wasting resources.

[0040] refer to Figure 4 In step S13, the specific steps are as follows: S131: Real-time monitoring of the dynamic changes in the primary protection level, determining the change in the primary protection level within a preset time period based on the identification of the dynamic changes in the primary protection level, and simultaneously collecting multiple attack information to be managed and marking the attack methods corresponding to the multiple attack information to be managed. S132: Determine the first level of emergency information content based on the change in the primary protection level and the multiple attack information to be controlled; determine the second level of emergency information content based on the change in the primary protection level and the attack methods corresponding to the multiple attack information to be controlled; and determine the emergency information system based on the first and second level of emergency information content. S133: In the information emergency response system, the workload of the information protection platform is collected, and the corresponding core information space is marked based on the identification of the information protection platform. The protection level of the core information space is determined based on the traceability of the core information space. The corresponding information control measures are determined based on the workload of the information protection platform and the protection level of the corresponding core information space.

[0041] In the embodiments of this application, the dynamic changes of the primary protection level are monitored in real time, and the change in the primary protection level within a preset time period is determined based on the identification of the dynamic changes of the primary protection level. At the same time, multiple attack information to be controlled is collected, and the attack methods corresponding to the multiple attack information to be controlled are marked. This approach incorporates the overall consideration of identifying the dynamic changes of the primary protection level and ensures the accuracy of the change in the primary protection level within a preset time period.

[0042] At this time, the A-type platform will monitor the dynamic changes of the primary protection level in real time; the system will set a preset time window (e.g., 5 minutes) and continuously track the changes in the protection level within this time period; for example, under the attack of attack source B, the primary protection level of the A-type platform will rapidly rise from "Level 2 Medium Protection" to "Level 4 Emergency Protection" within 5 minutes, and this rapid change will be accurately recorded by the system.

[0043] The platform calculates the change in protection level, which is the range of change in protection level within a preset time period. For example, if the protection level rises from level 2 (numerical representation) to level 4, the change in protection level is +2 levels. This change reflects the urgency and escalation speed of the attack threat and is an important basis for subsequent emergency response.

[0044] Meanwhile, Platform A will collect multiple attack information that needs to be controlled; in the attack scenario of attack source B, this attack information includes: high-frequency SQL injection attacks against database systems (200 times per minute), brute-force attempts against user authentication systems (150 times per minute), and XSS attacks against web servers (100 times per minute), etc.

[0045] For each piece of attack information collected, the platform will label its corresponding attack method; for example, SQL injection attacks are labeled as "database penetration" attacks, brute-force attacks are labeled as "credential theft" attacks, and XSS attacks are labeled as "client-side attack" attacks. This labeling and classification helps the system to take appropriate countermeasures against different types of attacks.

[0046] Furthermore, the first level of emergency information content is determined based on the change in the primary protection level and the multiple attack information to be controlled. The second level of emergency information content is determined based on the attack methods corresponding to the change in the primary protection level and the multiple attack information to be controlled. The emergency information system is determined based on the first and second level emergency information content, which takes into account the overall consideration of the first and second level emergency information content and ensures the accuracy of the emergency information system.

[0047] At this point, based on the change in the primary protection level and the multiple attack information to be managed, Platform A will determine the first layer of emergency response measures. For example, when the change in level is +2 (a sharp increase) and the attack information includes high-frequency SQL injection and brute-force attacks, the first layer of emergency response measures includes: immediately activating the database protection module, increasing the monitoring frequency of the user authentication system, and restricting access permissions for abnormal IPs. Optionally, the first layer of emergency response measures, determined based on the change in the primary protection level and the multiple attack information to be managed, is a set of basic emergency response measures against attack threats. It is the first layer of protection in the information emergency response system, mainly focusing on the urgency of the attack and the overall threat level, providing a rapid and direct emergency response solution.

[0048] Simultaneously, the platform will determine the second layer of emergency response content based on the level change and the corresponding attack methods of the attack information. For example, for "database penetration" attacks, the second layer of emergency response content includes: activating SQL injection filtering rules, enabling database access whitelists, and activating database operation auditing; for "credential theft" attacks, it includes: enabling multi-factor authentication, adding login failure lockout mechanisms, and strengthening password complexity requirements. Optionally, the second layer of emergency response content is a set of specialized emergency response strategies determined based on the level change of the primary protection level and the attack methods corresponding to the multiple attack information to be managed. It is the second layer of protection in the information emergency response system, mainly focusing on the technical implementation methods, attack paths, and attack characteristics of the attack, providing precise and professional technical solutions.

[0049] By integrating the first and second layers of information emergency response content, the Model A platform will construct a complete information emergency response system. This system is a multi-layered set of protection strategies that considers both the urgency of the attack (reflected by the level change) and provides specific countermeasures for different types of attack methods. For example, in an attack scenario from attack source B, the information emergency response system includes: a database emergency protection subsystem, a user authentication enhancement subsystem, and a web server security hardening subsystem, etc. Each subsystem has specific execution strategies and priorities.

[0050] Therefore, in the information emergency response system, the workload of the information protection platform is collected, and the corresponding core information space is marked based on the identification of the information protection platform. The protection level of the core information space is determined by tracing the core information space. The corresponding information control measures are determined based on the workload of the information protection platform and the protection level of the corresponding core information space. This approach takes into account both the workload of the information protection platform and the protection level of the corresponding core information space, ensuring the accuracy of the corresponding information control measures.

[0051] At this point, after the information emergency response system is established, the A-type platform will collect its own workload data, including CPU utilization, memory usage, network bandwidth utilization, and the number of concurrent processing tasks. For example, under the continuous attack of the B attack source, the platform detected that the CPU utilization reached 85%, the memory usage was 78%, the network bandwidth utilization was 90%, and the number of concurrent processing tasks reached 80% of the system capacity.

[0052] Simultaneously, the platform identifies and marks core information spaces based on system identification. In Model A platforms, these core information spaces include: the core database (stores critical business data), the master authentication server (manages all user credentials), and the central control system (manages the operation of the entire protection platform). By tracing the historical protection records and current threat status of these core information spaces, the platform determines the protection level of each core information space. For example, the core database is rated as "Level 1 Highest Protection," the master authentication server as "Level 2 High Protection," and the central control system as "Level 2 High Protection." Optionally, the core information space is a set of core information assets selected from the attacked information space based on key indicators such as information importance, system criticality, and business impact. These assets have a decisive impact on the overall security of the information protection platform. They are the most critical and important protected objects in the entire protection system, typically including information systems, data resources, and functional modules that play a core role in organizational business operations, data security, and system stability.

[0053] Platform A determines specific information control measures based on the current workload and the protection level of the core information space. These measures need to balance security requirements and system performance to avoid system crashes due to over-protection. The information control measures are a collection of technical means, management strategies, and operating procedures formulated and implemented based on the core information space, the primary protection level, the level change, the information emergency content, and multiple attack information to be controlled. It is a specific execution plan for the information protection platform to achieve proactive defense, dynamic response, and precise control. It aims to effectively respond to various attack threats and ensure the security of the information space through a systematic and hierarchical combination of measures.

[0054] For example, when the workload is high (CPU 85%, memory 78%) and the core database requires "Level 1 Highest Protection", control measures include: enabling database connection pool restrictions, prioritizing database query processing resources, and temporarily diverting non-critical business data access requests; when the main authentication server requires "Level 2 High Protection", control measures include: enabling distributed authentication processing, increasing authentication request queue management, and implementing intelligent traffic scheduling; when the central control system requires "Level 2 High Protection", control measures include: enabling control command priority processing, implementing dynamic allocation of system resources, and activating backup control channels.

[0055] Specifically, after the information emergency response system is built, the A-type platform will collect its own workload data, including CPU utilization, memory usage, network bandwidth utilization, and number of concurrent processing tasks. For example, under the continuous attack of the B attack source, the platform detected that the CPU utilization reached 85%, the memory usage was 78%, the network bandwidth utilization was 90%, and the number of concurrent processing tasks reached 80% of the system capacity.

[0056] Meanwhile, the platform will identify and mark core information spaces based on system identification. In the A-type platform, these core information spaces include: core database (stores critical business data), master authentication server (manages all user credentials), central control system (manages the operation of the entire protection platform), etc. By tracing the historical protection records and current threat status of these core information spaces, the platform will determine the protection level of each core information space. For example, the core database is rated as "Level 1 Highest Protection", the master authentication server is "Level 2 High Protection", and the central control system is "Level 2 High Protection".

[0057] Platform A determines specific information control measures based on the current workload and the protection level of the core information space. These measures need to balance security requirements and system performance to avoid system crashes due to excessive protection. For example, when the workload is high (CPU 85%, memory 78%) and the core database requires "Level 1 Highest Protection", control measures include: enabling database connection pool limits, prioritizing database query processing resources, and temporarily diverting non-critical business data access requests. When the main authentication server requires "Level 2 High Protection", control measures include: enabling distributed authentication processing, increasing authentication request queue management, and implementing intelligent traffic scheduling. When the central control system requires "Level 2 High Protection", control measures include: enabling control command priority processing, implementing dynamic allocation of system resources, and activating backup control channels.

[0058] refer to Figure 5 In step S14, the specific steps are as follows: S141: Based on the identification of information control measures, multiple information control routes are determined, and the optimal information control route is determined according to the multiple information control routes, the corresponding attack information, and the current working process of the information protection platform. S142: Based on the identification of the optimal information control route, multiple information control nodes are determined. Each information control node matches the corresponding sub-information control item based on the corresponding attack information to collect multiple sub-information control items. S143: In multiple sub-information management projects, the floating security range of the information protection platform is determined based on each sub-information management project, the corresponding attack information, and the attack range corresponding to the attack information.

[0059] In the embodiments of this application, multiple information control routes are determined based on the identification of information control measures. The optimal information control route is determined according to the multiple information control routes, the corresponding attack information, and the current working process of the information protection platform. This approach takes into account the overall consideration of multiple information control routes, the corresponding attack information, and the current working process of the information protection platform, ensuring the accuracy of the optimal information control route.

[0060] At this point, Platform A will identify multiple information control routes based on the information control measures determined in step S13. These routes represent different paths and strategy combinations for implementing control measures. For example, for SQL injection and brute-force attacks from attack source B, the platform identifies the following control routes: Route 1: Database Protection Priority Route - Primarily addresses attacks by strengthening database access control, enabling SQL injection filtering, and implementing database operation auditing; Route 2: Authentication System Enhancement Route - Primarily addresses attacks by enabling multi-factor authentication, adding login failure lockout mechanisms, and strengthening password policies; Route 3: Comprehensive Protection Route - Simultaneously implements database protection and authentication system enhancement, supplemented by network traffic monitoring and abnormal behavior detection. Optionally, the information control route is an information protection strategy execution path with a clear time sequence and logical relationship, formulated based on the core information space, primary protection level, level change, information emergency content, information control measures, and multiple attack information to be controlled. It is a systematic protection scheme implementation guide that specifies what protection measures should be taken, when to take them, how to implement them, and how to evaluate their effectiveness under different attack situations and system states.

[0061] After determining these control routes, the Model A platform will evaluate the applicability and effectiveness of each route by combining the corresponding attack information and the current work process; the attack information includes attack type, attack intensity, attack target, etc.; the current work process includes system resource usage, the running status of each module, other tasks being executed, etc.

[0062] For example, in an attack scenario originating from attack source B, the platform detected a high intensity of SQL injection attacks (200 times per minute) and a medium intensity of brute-force attacks (100 times per minute). Simultaneously, the system CPU utilization reached 80%, and memory usage was 75%. Based on this information, the platform would assess: Route 1 effectively counters SQL injection attacks, but the increased database protection measures further burden the system; Route 2 is significantly effective against brute-force attacks and consumes relatively few system resources; Route 3 offers the best protection, but leads to system resource strain and impacts overall performance. Through comprehensive evaluation, the A-model platform determined Route 2 to be the optimal information management route, as it effectively addresses the most pressing threats under limited system resource conditions, while reserving sufficient system resources for subsequent attack escalations.

[0063] Furthermore, multiple information control nodes are determined based on the identification of the optimal information control route. Each information control node matches the corresponding sub-information control item based on the corresponding attack information to collect multiple sub-information control items. This approach takes into account the overall consideration of identifying the optimal information control route and ensures the accuracy of multiple information control nodes.

[0064] At this point, after determining the optimal information control route (Route 2: Authentication System Enhancement Route), the A-type platform will identify multiple information control nodes on this route; these nodes are the key control points for implementing control measures, and each node corresponds to a specific protection link.

[0065] In the authentication system enhancement roadmap, the platform identified the following control nodes: Node 1: User login verification node - responsible for handling user login requests and credential verification; Node 2: Authentication policy execution node - responsible for executing multi-factor authentication, password complexity checks, and other policies; Node 3: Abnormal login detection node - responsible for detecting abnormal login behavior and brute-force attempts; Node 4: Access control node - responsible for controlling resource access based on user identity and permissions.

[0066] For each control node, the platform will match the corresponding sub-information control items based on the corresponding attack information. For example, at the user login verification node, for brute-force attacks targeting attack source B, the matched sub-information control items include: login frequency limit (maximum 5 login attempts per IP per minute), abnormal IP identification (identifying IP addresses that attempt a large number of logins in a short period of time), and CAPTCHA mechanism (enabling CAPTCHA during abnormal login attempts).

[0067] At the authentication policy execution node, the matching sub-information control items include: multi-factor authentication activation (enabling SMS or email verification for high-risk login requests), password complexity enhancement (requiring passwords to contain uppercase and lowercase letters, numbers, and special characters), and password history (preventing users from reusing old passwords).

[0068] At the abnormal login detection node, the matched sub-information control items include: login behavior analysis (analyzing the abnormality of user login time, location, and device), failed login count (accumulating the number of failed logins, triggering locking when the threshold is exceeded), and abnormal pattern recognition (identifying the characteristic patterns of brute-force attacks), etc.

[0069] At the access control node, the matching sub-information management items include: the principle of least privilege (users can only access necessary resources), dynamic permission adjustment (user permissions are dynamically adjusted based on risk assessment), and secondary authentication for sensitive operations (additional authentication is required for critical operations). In this way, the A-type platform will collect multiple sub-information management items, each of which targets specific attack information and management nodes, forming a comprehensive protection network.

[0070] Therefore, in multiple sub-information management projects, the floating security range of the information protection platform is determined based on each sub-information management project, the corresponding attack information, and the attack range corresponding to that attack information. This approach takes into account the overall consideration of each sub-information management project, the corresponding attack information, and the attack range corresponding to that attack information, ensuring the accuracy of the floating security range of the information protection platform.

[0071] At this point, after collecting multiple sub-information management items, the A-type platform will determine the floating security range of the information protection platform based on each sub-information management item, the corresponding attack information, and the attack range corresponding to the attack information.

[0072] The floating security range is a dynamically adjusted security boundary that reflects the level of security that the platform can maintain under the current attack environment; this range changes in real time with the attack intensity, system status, and the effectiveness of protective measures.

[0073] Specifically, the platform analyzes the protection effectiveness and resource consumption of each sub-information management project, and calculates the security boundaries in various dimensions by combining the attack range of the corresponding attack information. For example, for the login frequency limit sub-project, the platform will assess how strong a brute-force attack this measure can effectively resist (e.g., a maximum of 10 login attempts per minute), and the impact of implementing this measure on system performance (e.g., an increase of 5% in CPU load). For the multi-factor authentication activation sub-project, the platform will assess how much authentication security this measure can improve (e.g., reducing the risk of credential theft by 99%), and the impact on user experience (e.g., increasing login time by 10-15 seconds). For the abnormal login detection sub-project, the platform will assess how quickly this measure can identify attack behavior (e.g., identifying anomalies after an average of 3 failed login attempts), and the false positive rate (e.g., approximately 5% of normal logins are falsely judged as abnormal).

[0074] By comprehensively analyzing the protection effectiveness and resource consumption of all sub-information management projects, the Model A platform will determine the overall floating security range. This range includes multiple dimensions: Security dimension: the upper limit of attack intensity that the platform can withstand (e.g., being able to withstand 200 SQL injection attacks per minute and 100 brute-force attacks per minute); Performance dimension: the performance level that the system can provide while maintaining security (e.g., CPU utilization not exceeding 85%, response time not exceeding 500ms); Availability dimension: the service quality that the system can still provide when protection measures are effective (e.g., the login success rate of normal users is not less than 95%).

[0075] refer to Figure 6 In step S15, the specific steps are as follows: S151: Monitor the floating safety range in real time and determine the preset risk warning line based on the traceability of the information protection platform. Compare the floating safety range with the preset risk warning line in real time to respond when the floating safety range touches the risk warning line. S152: If the floating safety range touches the risk warning line, the corresponding risk control system will be determined based on the detection of the information protection platform, and the risk control system of the information protection platform will be triggered; at this time, the current working process of the information emergency system and the information protection platform will be collected, and the information multi-protection event will be determined according to the current working process of the risk control system, the information emergency system and the information protection platform. S153: Determine the first dynamic protection content based on the multiple information spaces corresponding to the information multi-protection event and the information protection platform; determine the second dynamic protection content based on the attack direction of the information multi-protection event and the attack information; and construct a dynamic protection event based on the first dynamic protection content and the second dynamic protection content.

[0076] In the embodiments of this application, the floating safety range is monitored in real time, and a preset risk warning line is determined based on the traceability of the information protection platform. The floating safety range is compared with the preset risk warning line in real time so as to respond when the floating safety range touches the risk warning line. This is compatible with the overall consideration of the traceability of the information protection platform and ensures the accuracy of the preset risk warning line.

[0077] At this point, the A-type platform will establish a real-time monitoring system to continuously track the floating security range determined in step S14. This floating security range is a multi-dimensional dynamic boundary, including security dimensions (the upper limit of the attack strength that can be resisted), performance dimensions (the threshold for system resource usage), and availability dimensions (the level of service quality assurance).

[0078] Meanwhile, the platform will preset multiple risk warning lines based on historical protection data and system security requirements. These warning lines are critical thresholds for system security. Once breached, it means that the system faces serious security risks. For example, the A-type platform sets the following risk warning lines: Security warning line: The attack strength that can be resisted drops to below 90% of the actual attack strength; Performance warning line: CPU utilization exceeds 90% or memory usage exceeds 85%; Availability warning line: The success rate of normal user login is below 95% or the response time exceeds 1 second.

[0079] The platform continuously compares the real-time monitored floating security range with these preset risk warning lines. For example, under the attack source B, the platform detected the following: Security dimension: The withstandable brute-force attack intensity dropped to 135 times per minute, while the actual attack intensity was 150 times per minute, which is lower than the security warning line (90%); Performance dimension: CPU utilization reached 88%, and memory usage was 82%, which has not yet reached the performance warning line; Availability dimension: The normal user login success rate was 96%, and the response time was 800ms, which has not yet reached the availability warning line.

[0080] When monitoring detects that any dimension of the floating safety range has touched or exceeded the corresponding risk warning line, the system will immediately trigger a response mechanism; in the example above, since the safety dimension has touched the risk warning line, the platform will initiate the risk control process.

[0081] Furthermore, if the floating safety range touches the risk warning line, the corresponding risk control system is determined based on the detection of the information protection platform, and the risk control system of the information protection platform is triggered. At this time, the current working process of the information emergency system and the information protection platform is collected, and the information multi-protection event is determined based on the current working process of the risk control system, the information emergency system, and the information protection platform. This takes into account the overall consideration of the current working process of the risk control system, the information emergency system, and the information protection platform, and ensures the accuracy of information multi-protection events.

[0082] At this point, when the floating safety range touches the risk warning line, the Model A platform will immediately activate the risk management system; this system is a pre-designed high-level security response mechanism that includes a variety of emergency protection measures and system protection strategies.

[0083] While activating the risk management system, the platform will collect the current information emergency system (determined in step S13) and the platform's current work process; the information emergency system includes the database emergency protection subsystem, the user authentication enhancement subsystem, etc.; the current work process includes the system resource allocation, the operating status of each protection module, the task queue being processed, etc.

[0084] Based on a comprehensive analysis of the risk management system, information emergency response system, and current work progress, the platform will identify information multi-protection events. These events represent multiple protective measures that need to be taken simultaneously to address current security threats. For example, in an attack scenario originating from attack source B, the platform identifies the following information multi-protection events: Event 1: Emergency Hardening of the Authentication System – including activating a backup authentication server, implementing stricter login frequency limits, and enabling multi-factor authentication for all login requests; Event 2: Enhanced Database Protection – including activating a database access whitelist, implementing in-depth database query analysis, and enabling encrypted transmission of sensitive data; Event 3: System Resource Optimization – including reallocating system resources (prioritizing authentication and database services), suspending non-critical background tasks, and enabling load balancing mechanisms; Event 4: Precise Identification of Attack Sources – including enabling advanced behavioral analysis, implementing attack source feature extraction, and initiating attack tracing analysis; These multi-layered protection events are not isolated but rather interconnected and collaborative, forming a holistic protection strategy aimed at simultaneously addressing the threat of attack sources B from multiple dimensions and restoring the system's security status.

[0085] Therefore, the first dynamic protection content is determined based on the multiple information spaces corresponding to the information protection platform and the multiple information protection events. The second dynamic protection content is determined based on the attack direction of the information protection events and attack information. The dynamic protection events are constructed based on the first and second dynamic protection content, which takes into account the overall consideration of the attack direction of the information protection events and attack information, and ensures the accuracy of the second dynamic protection content.

[0086] At this point, after identifying the multiple information protection events, the A-type platform will construct dynamic protection events based on these events; dynamic protection events are a comprehensive set of protection strategies that integrate protection content from different dimensions to form a comprehensive and coordinated protection system.

[0087] The platform will determine the first dynamic protection content based on the information multi-protection event and the multiple information spaces corresponding to the information protection platform; these information spaces include the attacked information spaces determined in step S11, such as the Web server (WS-001), database system (DB-001), user authentication system (UA-001), and firewall (FW-001), etc.

[0088] For example, for emergency hardening events of the authentication system and the information space of the user authentication system (UA-001), the first dynamic protection measures include: implementing two-factor authentication, enabling biometric verification, and strengthening session management mechanisms on the user authentication system; for database protection hardening events and the information space of the database system (DB-001), the measures include: implementing real-time monitoring of database access, enabling secondary authorization for sensitive operations, and activating data anonymization mechanisms.

[0089] Secondly, the platform will determine the second dynamic protection content based on the attack direction of the multi-layered information protection events and attack information; the attack direction refers to the path and target of the attack source, such as attack source B launching an attack on the database through a web application, or launching an attack on the authentication system through a login interface, etc.

[0090] For example, in response to emergency hardening events of the authentication system and attacks launched by B attack sources through the login interface, the second dynamic protection measures include: implementing an intelligent CAPTCHA mechanism at the login interface, enabling real-time blocking of abnormal login behavior, and implementing dynamic adjustment of the login request rate; in response to database protection enhancement events and attacks launched by B attack sources through web applications, measures include: implementing deep data filtering at the interaction interface between the web application and the database, enabling real-time detection and blocking of SQL injection, and activating abnormal database query identification.

[0091] The platform constructs dynamic protection events based on the first and second dynamic protection content. These dynamic protection events constitute a comprehensive protection strategy, considering the protection needs of different information spaces and providing specialized protection measures for different attack directions. For example, in an attack scenario originating from attack source B, the dynamic protection events include: an authentication system dynamic protection sub-event: integrating the spatial protection needs of the user authentication system and the protection measures for login interface attack directions to form a comprehensive authentication system protection strategy; a database system dynamic protection sub-event: integrating the spatial protection needs of the database system and the protection measures for Web application attack directions to form a multi-layered database protection strategy; and a system-wide dynamic protection sub-event: integrating the protection needs of all information spaces and the protection measures for all attack directions to form a system-level overall protection strategy.

[0092] These dynamic protection events are not static, but are updated and optimized in real time based on changes in the attack situation, adjustments to the system status, and feedback on the protection effect, ensuring that the A-type platform can continuously and effectively cope with various attack attempts from the B attack source.

[0093] Please see Figure 7 , Figure 7 This is a schematic diagram of the structural composition of the information management and control system of the information protection platform in this embodiment of the invention; the information management and control system of the information protection platform includes: The attacked information space module 21 is used to collect corresponding information attack signals based on the information protection platform during information attack simulation exercises, and to determine the attacked information space of the information protection platform based on the detection of the information attack signals. The primary protection level module 22 is used to determine the primary protection level of the information protection platform based on the attacked information space, the corresponding attack information, and the working status of the information protection platform; the primary protection level changes dynamically with the attack intensity of multiple attack information. The information control measures module 23 is used to determine the information emergency system based on the change in the primary protection level, the multiple attack information to be controlled and the corresponding attack method level, and to determine the corresponding information control measures based on the information emergency system, the load workload of the information protection platform and the protection level of the corresponding core information space. The floating security range module 24 is used to determine multiple sub-information control items based on the identification of information control measures, and to determine the floating security range of the information protection platform based on the attack range of each sub-information control item and the corresponding attack information. The dynamic protection event module 25 is used to trigger the risk control system of the information protection platform if the floating security range touches the risk warning line, determine the information multi-protection event, and construct a dynamic protection event based on the information multi-protection event, the multiple information spaces corresponding to the information protection platform, and the attack direction of the attack information.

[0094] The technical features of the above embodiments can be combined arbitrarily. For the sake of brevity, not all combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

Claims

1. An information management and control method for an information protection platform, characterized in that, include: In the simulation exercise of information attack, the information protection platform collects the corresponding information attack signals, and determines the attacked information space of the information protection platform based on the detection of the information attack signals. The primary protection level of the information protection platform is determined based on the attacked information space, the corresponding attack information, and the working status of the information protection platform; the primary protection level changes dynamically with the attack intensity of multiple attack information. The information emergency response system is determined based on the change in the primary protection level, the multiple attack information to be managed, and the corresponding attack method level. Based on the information emergency response system, the workload of the information protection platform, and the protection level of the corresponding core information space, the corresponding information control measures are determined. Based on the identification of information control measures, multiple sub-information control items are determined, and the floating security range of the information protection platform is determined based on the attack range of each sub-information control item and the corresponding attack information. If the floating security range touches the risk warning line, the risk control system of the information protection platform will be triggered, and a multi-protection information event will be identified. Based on the multi-protection information event, the multiple information spaces corresponding to the information protection platform, and the attack direction of the attack information, a dynamic protection event will be constructed.

2. The information management and control method of the information protection platform according to claim 1, characterized in that, In the simulated information attack exercise, the information protection platform collects corresponding information attack signals, and determines the attacked information space of the information protection platform based on the detection of the information attack signals, including: A simulation exercise system for information attacks is built based on an information protection platform and an information attack source. The information protection platform and the information attack source are in communication, and the information attack source launches continuous information attacks on the information protection platform. At this time, the information protection platform is monitored in real time, and the corresponding information attack signals are collected. Based on the information attack signals and corresponding attack methods, multiple attack factors are identified. Based on these multiple attack factors and the information attack markers of the information protection platform, the attacked information space of the information protection platform is determined.

3. The information management and control method of the information protection platform according to claim 1, characterized in that, The initial protection level of the information protection platform is determined based on the attacked information space, the corresponding attack information, and the working status of the information protection platform. The initial protection level changes dynamically based on the attack intensity of multiple attack signals, including: The system collects the attacked information space, determines the information distribution pattern of the attacked information space based on the detection of the attacked information space, and determines the first protection level coefficient based on the information distribution pattern of the attacked information space and the corresponding attack information. Multiple operational data points from the information protection platform are collected, and the operational status of the information protection platform is determined based on these data points. A second protection level coefficient is determined based on the information distribution pattern of the attacked information space and the operational status of the information protection platform. The primary protection level of the information protection platform is determined based on the mapping relationship between the first protection level coefficient, the second first protection level coefficient, and the first protection level. At the same time, the attack intensity of the attack information is monitored in real time, and the primary protection level changes dynamically with the attack intensity of multiple attack information.

4. The information management and control method of the information protection platform according to claim 1, characterized in that, The information emergency response system is determined based on the change in the primary protection level, multiple attack information to be managed, and the corresponding attack method levels. Based on this information emergency response system, the workload of the information protection platform, and the protection level of the corresponding core information space, corresponding information control measures are determined, including: The system monitors the dynamic changes of the primary protection level in real time, determines the change in the primary protection level over a preset time period based on the identification of these dynamic changes, and collects information on multiple attacks to be controlled, marking the attack methods corresponding to these attacks.

5. The information management and control method of the information protection platform according to claim 4, characterized in that, The process of determining an information emergency response system based on the change in the primary protection level, multiple attack information to be managed, and the corresponding attack method levels, and determining corresponding information control measures based on this information emergency response system, the workload of the information protection platform, and the protection level of the corresponding core information space, also includes: The first level of emergency information content is determined based on the change in the primary protection level and the multiple attack information to be controlled. The second level of emergency information content is determined based on the attack methods corresponding to the change in the primary protection level and the multiple attack information to be controlled. The emergency information system is determined based on the first and second level of emergency information content. In the information emergency response system, the workload of the information protection platform is collected, and the corresponding core information space is marked based on the identification of the information protection platform. The protection level of the core information space is determined by tracing the core information space. The corresponding information control measures are determined based on the workload of the information protection platform and the protection level of the corresponding core information space.

6. The information management and control method of the information protection platform according to claim 1, characterized in that, The process involves identifying multiple sub-information control items based on the identification of information control measures, and determining the floating security range of the information protection platform based on the attack range of each sub-information control item and the corresponding attack information, including: Multiple information control routes are identified based on the identification of information control measures. The optimal information control route is then determined based on these multiple information control routes, the corresponding attack information, and the current working progress of the information protection platform.

7. The information management and control method of the information protection platform according to claim 6, characterized in that, The method of identifying multiple sub-information control items based on the identification of information control measures, and determining the floating security range of the information protection platform based on the attack range of each sub-information control item and the corresponding attack information, further includes: Multiple information control nodes are identified based on the optimal information control route. Each information control node matches a corresponding sub-information control item based on the corresponding attack information in order to collect multiple sub-information control items. In multiple sub-information management projects, the floating security range of the information protection platform is determined based on each sub-information management project, the corresponding attack information, and the attack range corresponding to the attack information.

8. The information management and control method of the information protection platform according to claim 1, characterized in that, If the floating security range touches the risk warning line, the risk management system of the information protection platform is triggered, and a multi-layered information protection event is identified. Based on this multi-layered information protection event, the multiple information spaces corresponding to the information protection platform, and the attack direction of the attack information, a dynamic protection event is constructed, including: The system monitors the floating safety range in real time and determines the preset risk warning line based on the traceability of the information protection platform. It compares the floating safety range with the preset risk warning line in real time to respond when the floating safety range touches the risk warning line.

9. The information management and control method of the information protection platform according to claim 8, characterized in that, If the floating security range touches the risk warning line, the risk control system of the information protection platform will be triggered, and a multi-layered information protection event will be identified. Based on this multi-layered information protection event, the multiple information spaces corresponding to the information protection platform, and the attack direction of the attack information, a dynamic protection event will be constructed. This also includes: If the floating safety range touches the risk warning line, the corresponding risk control system is determined based on the detection of the information protection platform, and the risk control system of the information protection platform is triggered; at this time, the current working process of the information emergency system and the information protection platform is collected, and the information multi-protection event is determined based on the current working process of the risk control system, the information emergency system, and the information protection platform. The first dynamic protection content is determined based on multiple information spaces corresponding to the information protection platform and the information protection event. The second dynamic protection content is determined based on the attack direction of the information protection event and the attack information. The dynamic protection event is constructed based on the first dynamic protection content and the second dynamic protection content.

10. An information management and control system for an information protection platform, characterized in that, The information management system of the information protection platform is applied to the information management method of the information protection platform as described in any one of claims 1-9, and the information management system of the information protection platform includes: The attacked information space module is used to collect corresponding information attack signals based on the information protection platform during information attack simulation exercises, and to determine the attacked information space of the information protection platform based on the detection of the information attack signals. The primary protection level module is used to determine the primary protection level of the information protection platform based on the attacked information space, the corresponding attack information, and the working status of the information protection platform; the primary protection level changes dynamically with the attack intensity of multiple attack information. The information control measures module is used to determine the information emergency response system based on the change in the primary protection level, the multiple attack information to be controlled and the corresponding attack method level, and to determine the corresponding information control measures based on the information emergency response system, the workload of the information protection platform and the protection level of the corresponding core information space. The floating security range module is used to identify multiple sub-information control items based on the identification of information control measures, and to determine the floating security range of the information protection platform based on the attack range of each sub-information control item and the corresponding attack information. The dynamic protection event module is used to trigger the risk control system of the information protection platform if the floating security range touches the risk warning line, and to determine the information multi-protection event. Based on the information multi-protection event, the multiple information spaces corresponding to the information protection platform, and the attack direction of the attack information, a dynamic protection event is constructed.

Images