CN107992758B - Dynamic management method and device for security mechanism - Google Patents

Abstract

The invention discloses a security mechanism dynamic management method and device. The method includes: extracting subject attributes and object attributes of an access data stream; The security mechanism components required for accessing the data stream; the ternary relationship is the relationship between the subject attribute, the object attribute and the security mechanism attribute; the determined security mechanism components are reorganized to generate a security protection system. In this way, the dynamic protection of Internet services is realized, thereby making the security protection mechanism of Internet services and Internet-based information systems more targeted, and also improving the security protection capabilities of Internet services or Internet-based information systems.

Description

A security mechanism dynamic management method and device

technical field

The invention relates to the field of information security, in particular to a method and device for dynamic management of a security mechanism.

Background technique

The Internet is a global key information infrastructure, and important information systems based on the Internet are related to the national economy and people's livelihood. Among them, important information systems refer to information systems that do not involve state secrets and play an important role in national security and economy, such as taxation, public security, and fire protection. Important information systems contain important information or provide important government services. If an important information system is damaged, it will have a great negative impact on the property and government functions of the organization. Therefore, some protection mechanisms are needed to protect the important information systems based on the Internet. .

In the prior art, a static and single protection mechanism is usually used. For example, a protection mechanism is preset for a certain information system, and a preset security mechanism is used whenever and whoever accesses it.

When faced with different access objects or different access objects, the static and single protection means is not targeted, and the security protection performance is poor.

SUMMARY OF THE INVENTION

In view of this, the embodiments of the present invention provide a method and device for dynamic management of a security mechanism, which solve the problems in the prior art that static and single protection means do not have targeted protection capability and have poor security protection performance.

A method for dynamic management of a security mechanism provided by an embodiment of the present invention includes:

Extract the subject attribute and object attribute of the access data stream;

According to the preset ternary relationship, the subject attribute and object attribute of the access data stream, the security mechanism component required for the access data stream is determined; the ternary relationship is between the subject attribute, the object attribute and the security mechanism attribute Relationship;

Combining the identified security mechanism components to generate a security protection system.

Optionally, the construction method of the ternary relationship includes:

Using the decision tree method, according to the subject attribute set, object attribute set and safety mechanism attribute set in the preset sample set, the subject attribute decision tree, the object attribute decision tree and the safety mechanism attribute decision tree are established respectively;

According to the preset security protection log, the subject attribute decision tree, the object attribute decision tree and the security mechanism decision tree, a ternary relationship is constructed; the ternary relationship is the relationship between the subject attribute, the object attribute and the security mechanism attribute.

Optionally, the decision tree method is used to establish the subject attribute decision tree, the object attribute decision tree and the safety mechanism attribute decision tree respectively according to the subject attribute set, the object attribute set and the safety mechanism attribute set in the preset sample set, including :

For each parameter in the preset attribute set, the attribute value of each attribute included in the parameter is extracted, and the assignment relationship of each attribute and attribute value is obtained; the preset attribute set is the subject attribute set, the object attribute set and the security mechanism attribute any set of attributes in the set;

According to the assignment relationship of each attribute and attribute value included in each parameter in the preset attribute set and the preset security management knowledge base, cluster each parameter in the preset attribute set to obtain the category of each parameter ;

Calculate the information gain rate of each attribute included in each parameter;

According to the category of each parameter and the information gain rate of each attribute included in the parameter, an attribute decision tree of the preset attribute set is constructed; each branch node in the attribute decision tree is an attribute, and the leaf node is the clustering result. each category.

Optionally, the ternary relationship is constructed according to the preset security protection log, the subject attribute decision tree, the object attribute decision tree and the security mechanism decision tree, including:

According to the preset security protection log, select the security mechanism corresponding to each subject attribute in the subject attribute decision tree and each object attribute in the object attribute decision tree;

According to the security mechanism attribute decision tree, determine each attribute of each selected security mechanism;

Calculate the information gain rate of each attribute of the selected security mechanism;

According to the subject attribute decision tree, the object attribute decision tree and its corresponding security mechanism, and the information gain rate of each attribute of each security mechanism, a ternary relationship is constructed.

Optionally, according to a preset ternary relationship, the security mechanism components corresponding to the subject attribute and the object attribute are respectively determined, including:

According to a preset ternary relationship, respectively determine the security requirement protection template corresponding to the subject attribute of the access data stream and the object attribute; the security requirement protection template is a set of at least one security attribute;

Using a slack matching algorithm, a plurality of security mechanism components are matched for the security mechanism requirement protection template.

Optionally, the determined security mechanisms are combined to generate a security protection system, including:

Abstract each security mechanism component into an index state machine;

Use the index state machine to establish a safety mechanism process;

According to the safety mechanism process, configure corresponding safety equipment and/or safety system to generate a safety protection system.

The embodiment of the present invention also provides a security mechanism dynamic management device, including:

The extraction unit is used to extract the subject attribute and object attribute of the access data stream;

The matching unit is used to determine the security mechanism components required for the access data stream according to the preset ternary relationship, the subject attribute and the object attribute of the access data stream; the ternary relationship is the subject attribute, the object attribute and the Relationships between security mechanism attributes;

The combination unit is used to combine the determined safety mechanism components to generate a safety protection system.

Optionally, also include:

The attribute decision tree establishment unit is used to use the decision tree method to establish the subject attribute decision tree, object attribute decision tree and safety mechanism attribute decision tree respectively according to the subject attribute set, object attribute set and safety mechanism attribute set in the preset sample set. ;

The ternary relationship building unit is used to construct a ternary relationship according to the preset security protection log, the subject attribute decision tree, the object attribute decision tree and the security mechanism decision tree; the ternary relationship is subject attribute, object attribute and Relationships between security mechanism properties.

Optionally, the matching unit includes:

A determination subunit, configured to respectively determine the subject attribute of the access data stream and the security requirement protection template corresponding to the object attribute according to a preset ternary relationship; the security requirement protection template is a set of at least one of the security attributes;

The matching subunit is used for matching a plurality of security mechanism components for the security mechanism requirement protection template by using a slack matching algorithm.

Optionally, the combination unit includes:

The abstract subunit is used to abstract each security mechanism component into an index state machine;

establishing a subunit for establishing a safety mechanism process using the index state machine;

A generation sub-unit is used to configure corresponding safety equipment and/or safety system according to the safety mechanism process, so as to generate a safety protection system.

A method for dynamic management of a security mechanism provided by an embodiment of the present invention includes: extracting subject attributes and object attributes of an access data stream; determining the subject attribute and object attribute of the access data stream according to a preset ternary relationship The security mechanism components required for accessing the data stream; the ternary relationship is the relationship between the subject attribute, the object attribute and the security mechanism attribute; the determined security mechanisms are reorganized to generate a security protection system. In this way, the dynamic protection of Internet services is realized, thereby making the security protection mechanism of Internet services and Internet-based information systems more targeted, and also improving the security protection capabilities of Internet services or Internet-based information systems.

In addition, the embodiment of the present invention adopts the decision tree method, which improves the effects of assignment relationship optimization, noise reduction processing, semantic processing, conflict detection and resolution, etc.; and, after obtaining the security requirement protection template, adopts The slack matching algorithm matches the corresponding security mechanism for the security mechanism protection template. In this way, the matching accuracy is guaranteed while reducing the matching complexity; the index state machine method is used in the security mechanism reorganization, which overcomes the existing security mechanism reorganization The deficiencies of the technology in formal modeling solve the problem of function mapping and path mapping in the transition from the logic level to the instance level, providing theoretical and technical support for the reorganization of the security mechanism, and also optimizing the algorithm efficiency.

Description of drawings

In order to explain the embodiments of the present invention or the technical solutions in the prior art more clearly, the following briefly introduces the accompanying drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only It is an embodiment of the present invention. For those of ordinary skill in the art, other drawings can also be obtained according to the provided drawings without creative work.

1 shows a schematic flowchart of a method for dynamic management of a security mechanism provided by an embodiment of the present invention;

Fig. 2 shows the schematic diagram of Internet business subject, object and security mechanism;

3 shows a schematic flowchart of a method for constructing a ternary relationship according to an embodiment of the present invention;

Figure 4 shows a schematic diagram of a ternary relationship;

FIG. 5 shows a schematic structural diagram of an apparatus for dynamic management of a security mechanism provided by an embodiment of the present invention.

Detailed ways

The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

Referring to FIG. 1, a schematic flowchart of a method for dynamic management of a security mechanism provided by an embodiment of the present invention is shown. In this embodiment, the method includes:

S101: Extract the subject attribute and the object attribute in the access data stream;

In this embodiment, as shown in FIG. 2 , in the Internet service, there are subjects and objects in the generation of the access data stream, wherein the subject can be understood as the object that initiates the Internet service in the Internet service, and the object can be understood as the subject in the Internet service Objects to be accessed; for example, subjects may include: users, devices, etc.; objects may include: documents, pictures, etc.

Attributes are identifiers that represent entity characteristics. For example, when the subject is a user, age and position can be regarded as subject attributes, and when the object is a document, the document type and document size can be regarded as object attributes. S102: Determine the security mechanism component required for the access data stream according to a preset ternary relationship, subject attributes and object attributes of the access data stream; the ternary relationship is subject attribute, object attribute and security mechanism attribute The relationship between;

It should be noted that the security protection for the access data flow includes a variety of security mechanisms, such as firewalls, passwords, etc., and attributes are identifiers representing entity characteristics. In this embodiment, the security mechanism attributes may include authentication methods, access control policies, etc. etc., the environmental attributes include time, space, etc.

In this embodiment, the construction of the ternary relationship may be performed before S101, and the specific construction method will be described in detail below, and will not be repeated here.

Wherein, after executing S102, the security mechanism components required for accessing the data stream are obtained. Specifically, S102 includes:

According to a preset ternary relationship, respectively determine the security requirement protection template corresponding to the subject attribute of the access data stream and the object attribute; the security requirement protection template is a set of at least one security attribute;

Using a slack matching algorithm, a plurality of security mechanism components are matched for the security mechanism requirement protection template.

In this embodiment, since the ternary relationship is the relationship between the subject attribute, the object attribute and the security mechanism attribute, according to the subject attribute and the object attribute, at least one security mechanism attribute corresponding to the subject attribute and the object attribute can be obtained. Here, the set of at least one security mechanism attribute is represented as a security requirement protection template; however, it is not enough to know the security requirement protection template only, it is also necessary to know the security mechanism corresponding to the security requirement protection template. To reduce the complexity of matching while maintaining accuracy, a slack matching algorithm can be used to match the corresponding security mechanism components for the obtained security requirement protection template. Specifically, the slack matching algorithm is shown in the following formula 1):

1) S=ω ₁ H ₁ +ω ₂ H ₂ ;

Among them, ω ₁ and ω ₂ are weights, 0<ω ₁ <1, 0<ω ₂ <1; H ₁ is used to describe the similarity degree of the hierarchical relationship between the security mechanism attribute tree and the security protection requirement tree, and H ₂ is used to describe the similarity of the number of nodes in the attribute subtree of the security mechanism attribute tree and the security protection requirement tree.

For example: Assume that the security requirement protection template corresponding to the subject attribute and object attribute of the access data stream determined can be understood as the description of the security protection requirements for accessing the data stream. For example, the security requirement protection template may include: authentication, data Encapsulation and access control; while the security mechanism components can be understood as functional units, for example: authentication can include: password authentication, certificate-based authentication, biometric-based authentication, etc., password types include: password length, type; matching security mechanism The components can be: 1) the password length is greater than 8; 2) the password type is alphanumeric.

S103: Combine the determined safety mechanisms to generate a safety protection system;

In this embodiment, the subject attribute and the object attribute of the access data stream respectively correspond to multiple security mechanism components. To generate a security protection system, these security mechanism components need to be combined. Specifically, S103 includes:

Abstract each security mechanism component into an index state machine;

Use the index state machine to establish a safety mechanism process;

According to the safety mechanism process, configure corresponding safety equipment and/or safety system to generate a safety protection system.

In this embodiment, the index state machine includes a state structure, a control structure, and a data structure, and the three are related to each other. The state structure in the index state machine represents the execution operation and state change of the security mechanism component; the control structure represents the control operation and state change in the execution flow of the security mechanism component; the data structure represents the total record of the changes of each part in the operation process of the security mechanism component , which ensures the consistency and integrity of the interactive data between the various components in the system.

Specifically, the process of using the index state machine to establish the security mechanism process includes:

According to the connection relationship and control relationship between the security mechanism components, obtain the security mechanism type and specific usage method to be used for this access, and save each security mechanism type and its specific usage method as a state of the state structure ;

Set the rules for transition from one state to another, and save the rules to the structure state machine;

The configuration information required by the security mechanism method is stored in the data structure.

For example: the types of security mechanisms saved in the state structure include: secure access authentication, password authentication, mandatory access control, etc.; one state transitions to another state, which is equivalent to one security mechanism type passing to another security mechanism Mechanism type, for example, password authentication can only be performed after the secure access authentication method is passed.

In this embodiment, if security protection for Internet services is required, after extracting the subject attribute and object attribute of the access data stream, the security mechanism components required for accessing the data stream can be quickly extracted according to the preset type relation library , and based on the index state machine, the security mechanism is reorganized to obtain a security mechanism protection system. In this way, the dynamic protection of Internet services is realized, thereby making the security protection mechanism of Internet services and Internet-based information systems more targeted, and also improving the security protection capabilities of Internet services or Internet-based information systems.

Referring to FIG. 3, a schematic flowchart of a method for generating a ternary relationship provided by an embodiment of the present invention is shown. In this embodiment, the method includes:

S301: Using the decision tree method, according to the subject attribute set, the object attribute set and the safety mechanism attribute set in the preset sample set, respectively establish the subject attribute decision tree, the object attribute decision tree and the safety mechanism attribute decision tree;

In this embodiment, the sample set is a subject attribute set, an object attribute set and a security mechanism attribute set collected from massive data, wherein the subject attribute set includes the subject and each attribute of each subject, for example, the subject is a user, the user's attribute Including: age, position, etc.; the object attribute set includes the object and various attributes of the object, for example: the object attribute is document, and the document attribute includes: document type and document size, etc. In this embodiment, the method of decision tree is used to establish the subject , the decision tree of the attributes of the object and the security mechanism, that is, each branch node in the established decision tree represents the attributes of the subject, object or security mechanism. Specifically, for the subject attribute decision tree, object attribute decision tree and security mechanism decision tree The establishment of , respectively carry out the steps of the following steps 1)-4):

Wherein, the preset attribute set in the following is any attribute set of subject attribute set, object attribute set and security mechanism attribute set;

1) For each parameter in the preset attribute set, extract each attribute value included in the parameter, and obtain the assignment relationship of each attribute and the attribute value;

2) According to the assignment relationship of each attribute and attribute value included in each parameter in the preset attribute set and the preset security management knowledge base, cluster each parameter in the preset attribute set to obtain each parameter category;

3) Calculate the information gain rate of each attribute included in each parameter;

4) construct the attribute decision tree of the preset attribute set according to the category of each parameter and the information gain rate of each attribute included in the each parameter;

It should be noted that each branch node in the attribute decision tree is an attribute, and the page node is each category of the clustering result.

For example: if the preset attribute set is a subject attribute set, the parameters in the preset attribute set represent each subject, for example, a user or a device. If the parameter is a user, the extracted attribute values of the user include age, position, etc.; In the embodiment, it should be known that the main attribute set includes different users and the attributes of each user, wherein the attribute value includes 20, and the bank employee, the assignment relationship between the main attribute and the attribute value is: age corresponds to 20, and position corresponds to the bank. Staff.

If the preset attribute set is an object attribute set, the parameters in the preset attribute set represent various objects, such as documents, pictures, etc. If the parameter is a document, the extracted user attribute values include: document type and document size.

If the preset attribute set is a security mechanism attribute set, the parameters in the preset attribute set represent the security mechanism, such as password authentication, security mechanism authentication, etc. If the parameter is password authentication, the attributes included are: access control policy, data packaging, etc.

In this embodiment, the preset safety management knowledge base includes the historical records of parameter classification. Therefore, according to each attribute of the parameter and the attribute value corresponding to each attribute, as well as the safety management knowledge base, a preset parameter set can be used for clustering, and the same The parameters of a class are grouped into one class.

In this embodiment, the information gain rate, also known as the information gain ratio, is an extension of the information gain, and is the ratio of the uncertainty of the attribute's influence on the classification to the uncertainty of the attribute itself. Using the information gain rate as a metric is to overcome the problem that using information gain tends to select attributes with more attribute values.

Since there may be many collected subject, object, and security mechanism attributes, not all attributes are useful for entity classification. Calculate the information gain rate of each attribute. The greater the information gain rate of the attribute, the greater the impact on the classification. Such an attribute can be used as a split attribute to classify entities.

In this embodiment, the establishment of each attribute decision tree adopts the decision tree method, which is superior to other algorithms in terms of assignment relationship optimization, noise reduction processing, semantic processing, conflict detection and resolution, and the like.

S302: Build a ternary relationship according to the preset security protection log, the subject attribute decision tree, the object attribute decision tree and the security mechanism decision tree; the ternary relationship is the relationship between the subject attribute decision tree and the security mechanism attribute decision tree And the relationship between the object attribute decision tree and the security mechanism attribute decision tree.

In this embodiment, the preset security protection log includes the historical records of different subjects and objects and the adopted security mechanism, and also includes different attributes of the subjects and objects. The user makes a decision tree according to these historical historical records and subject attributes. , the object attribute decision tree and the security mechanism decision tree to construct a ternary relationship. Specifically, S302 includes:

According to the preset security protection log, select the security mechanism corresponding to each subject attribute in the subject attribute decision tree and each object attribute in the object attribute decision tree;

According to the security mechanism attribute decision tree, determine each attribute of each selected security mechanism;

Calculate the information gain rate of each attribute of the selected security mechanism;

According to the subject attribute decision tree, the object attribute decision tree and its corresponding security mechanism, and the information gain rate of each security mechanism, a ternary relationship is constructed.

4 is a schematic diagram of a ternary relationship. It can be seen from the figure that it includes: the corresponding relationship between the subject attribute decision tree and the security mechanism attribute decision tree, and the corresponding relationship between the object attribute decision tree and the security mechanism attribute decision tree, that is, the subject The corresponding relationship between attributes and security mechanism attributes and the corresponding relationship between object attributes and security mechanism attributes.

In this embodiment, the subject attribute decision tree, the object attribute decision tree and the security mechanism attribute decision tree are constructed from massive data by the method of decision tree, and the relationship between the subject attribute decision tree and the security mechanism attribute decision tree, and the object attribute decision tree are established. Relationship between decision tree and security mechanism attribute decision tree. When a security mechanism needs to be established, the required security mechanism attributes can be quickly determined through the type relation library, so as to determine the corresponding security mechanism, and realize the dynamic protection of Internet services, so that the Internet services and Internet-based information systems can be effectively protected. The security protection mechanism is more targeted and improves the security protection capability of Internet services or Internet-based information systems.

Referring to FIG. 5 , a schematic structural diagram of an apparatus for dynamic management of a security mechanism provided by an embodiment of the present invention is shown. In this embodiment, the apparatus includes:

Extraction unit 501, used to extract the subject attribute and object attribute of the access data stream;

A matching unit 502, configured to determine the security mechanism components required for the access data stream according to a preset ternary relationship, the subject attribute and object attribute of the access data stream; the ternary relationship is subject attribute, object attribute and the relationship between the properties of the security mechanism;

The combining unit 503 is configured to combine the determined safety mechanism components to generate a safety protection system.

Optionally, also include:

The attribute decision tree establishment unit is used to use the decision tree method to establish the subject attribute decision tree, object attribute decision tree and safety mechanism attribute decision tree respectively according to the subject attribute set, object attribute set and safety mechanism attribute set in the preset sample set. ;

The ternary relationship building unit is used to construct a ternary relationship according to the preset security protection log, the subject attribute decision tree, the object attribute decision tree and the security mechanism decision tree; the ternary relationship is subject attribute, object attribute and Relationships between security mechanism properties.

Optionally, the matching unit includes:

A determination subunit, configured to respectively determine the subject attribute of the access data stream and the security requirement protection template corresponding to the object attribute according to a preset ternary relationship; the security requirement protection template is a set of at least one of the security attributes;

The matching subunit is used for matching a plurality of security mechanism components for the security mechanism requirement protection template by using a slack matching algorithm.

Optionally, the combination unit includes:

The abstract subunit is used to abstract each security mechanism component into an index state machine;

establishing a subunit for establishing a safety mechanism process using the index state machine;

A generation sub-unit is used to configure corresponding safety equipment and/or safety system according to the safety mechanism process, so as to generate a safety protection system.

Through the device of this embodiment, dynamic protection of Internet services is realized, so that the security protection mechanism of Internet services and Internet-based information systems is more targeted, and the security protection capabilities of Internet services or Internet-based information systems are improved. .

It should be noted that the various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. For the same and similar parts among the various embodiments, refer to each other Can.

The above description of the disclosed embodiments enables any person skilled in the art to make or use the present invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the generic principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Thus, the present invention is not intended to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims (6)

1. A dynamic management method for a security mechanism is characterized by comprising the following steps:

extracting subject attributes and object attributes of the access data stream;

determining a security mechanism component required by the access data stream according to a preset ternary relationship, and the subject attribute and the object attribute of the access data stream; the three-element relation is the relation among the subject attribute, the object attribute and the safety mechanism attribute;

combining the determined safety mechanism components to generate a safety protection system;

the determining a security mechanism component required by the access data stream according to the preset ternary relationship, the subject attribute and the object attribute of the access data stream includes:

respectively determining a subject attribute of an access data stream and a safety demand protection template corresponding to the object attribute according to a preset ternary relationship; the security requirement protection template is a set of at least one security attribute;

matching a plurality of safety mechanism components for the safety mechanism demand protection template by adopting a sag matching algorithm;

the combining the determined safety mechanisms to generate a safety protection system includes:

abstracting each security mechanism component into an index state machine;

establishing a security mechanism flow by utilizing the index state machine;

and configuring corresponding safety equipment and/or safety systems according to the safety mechanism flow so as to generate a safety protection system.

2. The method of claim 1, wherein the method for constructing the ternary relationship comprises:

respectively establishing a subject attribute decision tree, an object attribute decision tree and a security mechanism attribute decision tree according to a subject attribute set, an object attribute set and a security mechanism attribute set in a preset sample set by adopting a decision tree method;

constructing a ternary relationship according to a preset safety protection log, the subject attribute decision tree, the object attribute decision tree and a safety mechanism decision tree; the three-element relation is the relation among the subject attribute, the object attribute and the safety mechanism attribute.

3. The method according to claim 2, wherein the establishing the subject attribute decision tree, the object attribute decision tree and the security mechanism attribute decision tree according to the subject attribute set, the object attribute set and the security mechanism attribute set in the preset sample set by using the decision tree method comprises:

extracting attribute values of the attributes included in each parameter aiming at each parameter in a preset attribute set to obtain an assignment relation between each attribute and each attribute value; the preset attribute set is any one of a subject attribute set, an object attribute set and a security mechanism attribute set;

clustering the parameters in the preset attribute set according to the assignment relationship between each attribute and each attribute value included in each parameter in the preset attribute set and a preset safety management knowledge base to obtain the category of each parameter;

calculating the information gain rate of each attribute included in each parameter;

constructing an attribute decision tree of a preset attribute set according to the category of each parameter and the information gain rate of each attribute included in each parameter; each branch node in the attribute decision tree is an attribute, and a leaf node is each category of the clustering result.

4. The method of claim 2, wherein the constructing the ternary relationship according to the preset security protection log, the subject attribute decision tree, the object attribute decision tree, and the security mechanism decision tree comprises:

selecting each subject attribute in the subject attribute decision tree and a safety mechanism corresponding to each object attribute in the object attribute decision tree according to a preset safety protection log;

determining each attribute of each selected security mechanism according to the security mechanism attribute decision tree;

calculating the information gain rate of each attribute of the selected security mechanism;

and constructing a ternary relationship according to the subject attribute decision tree, the object attribute decision tree, the corresponding security mechanisms of the subject attribute decision tree and the object attribute decision tree, and the information gain rate of each attribute of each security mechanism.

5. An apparatus for dynamic management of security mechanisms, comprising:

the extraction unit is used for extracting the subject attribute and the object attribute of the access data stream;

the matching unit is used for determining a security mechanism component required by the access data stream according to a preset ternary relationship, and the subject attribute and the object attribute of the access data stream; the three-element relation is the relation among the subject attribute, the object attribute and the safety mechanism attribute;

the combination unit is used for combining the determined safety mechanism components to generate a safety protection system;

the matching unit is configured to:

respectively determining a subject attribute of an access data stream and a safety demand protection template corresponding to the object attribute according to a preset ternary relationship; the security requirement protection template is a set of at least one security attribute;

matching a plurality of safety mechanism components for the safety mechanism demand protection template by adopting a sag matching algorithm;

the combination unit matches a plurality of safety mechanism components for the safety mechanism requirement protection template;

the combining the determined safety mechanisms to generate a safety protection system includes:

abstracting each security mechanism component into an index state machine;

establishing a security mechanism flow by utilizing the index state machine;

and configuring corresponding safety equipment and/or safety systems according to the safety mechanism flow so as to generate a safety protection system.

6. The apparatus of claim 5, further comprising:

the attribute decision tree establishing unit is used for respectively establishing a subject attribute decision tree, an object attribute decision tree and a security mechanism attribute decision tree according to a subject attribute set, an object attribute set and a security mechanism attribute set in a preset sample set by adopting a decision tree method;

the ternary relationship construction unit is used for constructing a ternary relationship according to a preset safety protection log, the subject attribute decision tree, the object attribute decision tree and the safety mechanism decision tree; the three-element relation is the relation among the subject attribute, the object attribute and the safety mechanism attribute.

Images