CN118890213B

CN118890213B - A data asset security monitoring method

Info

Publication number: CN118890213B
Application number: CN202411320881.5A
Authority: CN
Inventors: 孙宁; 邹胜伟; 夏庆锋; 吴庆干; 毛坤; 盛振亮; 丁苑; 毛伟民; 夏浩然; 陈国涵; 孙一平
Original assignee: Wuxi Jianghong Information Technology Co ltd; Wuxi University
Current assignee: Wuxi Jianghong Information Technology Co ltd; Wuxi University
Priority date: 2024-09-23
Filing date: 2024-09-23
Publication date: 2025-01-24
Anticipated expiration: 2044-09-23
Also published as: CN118890213A

Abstract

The invention discloses a data asset security monitoring method, which belongs to the technical field of network security and comprises the following steps of detecting data assets, analyzing returned data packets, constructing a data asset information base, constructing an attack tree model based on the data asset information base, calculating risk values of all attack paths in the attack tree model through a decision tree algorithm, and formulating a data asset monitoring strategy according to the risk values. The data asset security monitoring method provided by the invention can realize data risk assessment aiming at the power system, and meanwhile, realize attack path risk assessment of the attack tree model network, and formulate a data asset monitoring strategy according to the risk assessment result, so that the hysteresis of data protection can be effectively solved.

Description

Data asset security monitoring method

Technical Field

The invention belongs to the technical field of network security, and particularly relates to a data asset security monitoring method.

Background

In recent years, due to rapid development of information technology and international environmental change, network security events are endless, and security situation is getting more severe. Network attack on the electric power protection system can form serious threat to people's production and life, economic development, social stability, national security and the like.

Considering the stability of the operation of the electric power protection system, the network security protection upgrading work can not be carried out in the system after the operation of the system, the loopholes existing in the system can not be treated in time, the loopholes library and the virus library in the antivirus software can not be updated in time, the existing boundary protection equipment such as an industrial firewall, an intrusion detection system, an industrial isolation gatekeeper and the like can not completely isolate malicious attacks, once the malicious attacks invade the system, the unprocessed risk points existing in the system for a long time can be easily utilized, and serious consequences are caused.

In order to improve the network security protection level of the electric power protection system and solve the hysteresis problem existing in the existing protection method, it is necessary to perform data asset security monitoring on the electric power protection system so as to timely find out and process risk points in the system when an attack does not occur yet. The traditional network risk assessment method is not fully applicable to the power protection system, and cannot predict an attack path with the largest risk, so that the protection is performed in a targeted manner.

Disclosure of Invention

In order to solve the technical problems, the invention provides a data asset security monitoring method to solve the problems that the existing protection method in the prior art has hysteresis and cannot predict an attack path with the largest risk.

In order to achieve the above object, the present invention provides a data asset security monitoring method, comprising the steps of:

detecting data assets, analyzing returned data packets, and constructing a data asset information base;

Constructing an attack tree model based on the data asset information base, and calculating risk values of all attack paths in the attack tree model through a decision tree algorithm;

and formulating a data asset monitoring strategy according to the risk value.

Preferably, the method for constructing the attack tree model based on the data asset information base comprises the following steps:

Taking the data asset to be protected as a root node of the tree;

collecting a database of data asset information about system architecture, data flows, security measures, and potential vulnerabilities;

Determining an attack path based on the root node and a data asset information base;

and representing the root node, the attack path and the attack means by a graphical method to obtain an attack tree model.

Preferably, the means of attack include, but are not limited to, packet theft, identity theft, and data tampering.

Preferably, the method for calculating the risk value of each attack path in the attack tree model includes:

collecting historical data and extracting data characteristics of the historical data;

constructing a decision tree model based on the data characteristics of the historical data;

calculating the success rate of each attack path based on the decision tree model, and evaluating the influence degree according to the potential influence of the attack path;

and calculating a risk value based on the success rate and the influence degree.

Preferably, the method for constructing the decision tree model comprises the following steps:

taking the success rate and the influence degree of the attack path as target variables;

extracting data features affecting a target variable from the data features of the historical data to obtain a training set;

And training the initial decision tree model through the training set to obtain a trained decision tree model.

Preferably, the method for extracting the data features of the historical data comprises the following steps:

zero-equalizing the historical data to obtain a preprocessed data set;

calculating a covariance matrix of the preprocessed data set, and solving eigenvalues and corresponding eigenvectors from the covariance matrix;

sorting the feature vectors according to the feature values, and selecting the feature vectors corresponding to the first n largest feature values as main components;

The history data is projected into a low-dimensional space composed of principal components, and data features of the history data.

Preferably, the influence degree comprises the influence degree of acquiring sensitive information through intercepting a data packet, the influence degree of attacking through stealing identity information and the influence degree of unauthorized modification data.

Preferably, the calculation expression of the risk value is:

G=S*I

In the formula, G represents a risk value, S represents a success rate, and I represents an influence degree.

Compared with the prior art, the invention has the following advantages and technical effects:

The invention discloses a data asset security monitoring method, which belongs to the technical field of network security and comprises the following steps of detecting data assets, analyzing returned data packets, constructing a data asset information base, constructing an attack tree model based on the data asset information base, calculating risk values of all attack paths in the attack tree model through a decision tree algorithm, and formulating a data asset monitoring strategy according to the risk values. The data asset security monitoring method provided by the invention can realize data risk assessment aiming at the power system, and meanwhile, realize attack path risk assessment of the attack tree model network, and formulate a data asset monitoring strategy according to the risk assessment result, so that the hysteresis of data protection can be effectively solved. And the attack path with the maximum risk can be predicted through calculating the risk value, so that basic conditions are provided for further formulating the protection strategy.

Drawings

The accompanying drawings, which are included to provide a further understanding of the application and are incorporated in and constitute a part of this specification, illustrate embodiments of the application and together with the description serve to explain the application. In the drawings:

FIG. 1 is a flow chart of a method according to an embodiment of the invention.

Detailed Description

It should be noted that, without conflict, the embodiments of the present application and features of the embodiments may be combined with each other. The application will be described in detail below with reference to the drawings in connection with embodiments.

It should be noted that the steps illustrated in the flowcharts of the figures may be performed in a computer system such as a set of computer executable instructions, and that although a logical order is illustrated in the flowcharts, in some cases the steps illustrated or described may be performed in an order other than that illustrated herein.

Examples

As shown in fig. 1, the method for monitoring the security of the data asset provided in this embodiment includes the following steps:

and formulating a data asset monitoring strategy according to the risk value.

Further, the method for constructing the attack tree model based on the data asset information base comprises the following steps:

the data asset to be protected is taken as the root node of the tree, and firstly, the data asset to be protected is required to be identified and defined and taken as the root node of the attack tree. This root node represents the security target of the whole system around which all analyses are deployed.

Collecting a database of data assets regarding system architecture, data flows, security measures, and potential vulnerabilities, at this step, a comprehensive collection and analysis of the architecture of the system, data flows, implemented security measures, and potential vulnerabilities is required. This includes, but is not limited to, network topology, manner of interaction of applications, manner of data storage and transmission, user access rights, and the like.

An attack path is determined based on the root node and the data asset information base by analyzing possible attack vectors and vulnerabilities that an attacker may exploit based on the collected information. An attack path is a series of steps that an attacker must go through in order to reach a target. This requires a thorough understanding of the weaknesses of the system and an accurate prediction of the possible patterns of behavior of the attacker.

Represented by a graphical method, using a graphical tool to represent the attack tree model, obtaining the attack tree model. This includes the root node, individual attack paths, and possible attack means. The graphical representation helps to intuitively expose the structure of the attack tree so that non-professionals can also understand the security risk of the system.

And may further refine the attack means, i.e. on the attack path, the possible attack means. These means may be technical, such as exploiting software vulnerabilities, denial of service attacks, etc., or non-technical, such as socioeconomic attacks. The potential impact and likelihood of each means of attack is evaluated.

Further, the means of attack include, but are not limited to, packet theft, identity theft, and data tampering.

Further, the method for calculating the risk value of each attack path in the attack tree model comprises the following steps:

Further, the method for constructing the decision tree model comprises the following steps:

First, the success rate and the influence degree of the attack path are clearly defined as target variables. Success rate refers to the possibility that an attacker successfully implements the attack, and the influence degree refers to the damage degree to the system after the attack is successful. These two variables can be determined by historical data and expert evaluation.

Key data features affecting the target variable are extracted from the historical data. These features may include, but are not limited to, attack type, attack means, system vulnerabilities, effectiveness of security measures, user behavior patterns, and the like. By analyzing these features, the success rate and extent of impact of the attack path can be better understood.

And combining the extracted data characteristics and the target variables into a training set. The training set is a data set for training a decision tree model that contains a large number of instances, each containing features and corresponding target variable values.

The initial decision tree model is trained using a training set. Decision trees are a commonly used machine learning algorithm that predicts the value of a target variable by building a tree structure. During the training process, the model learns how to predict the success rate and the influence degree of the attack path according to the input characteristics.

After training is completed, the model is evaluated and optimized. The evaluation can be performed by a cross-validation method, a confusion matrix method and the like, so that the prediction accuracy and generalization capability of the model are ensured. The optimization can improve the performance of the model by adjusting the model parameters, selecting different decision tree algorithms and the like.

And applying the trained decision tree model to actual security risk assessment. The model can help to predict success rates and influence degrees of different attack paths, so that basis is provided for the establishment of security policies. Meanwhile, the model is continuously adjusted and optimized through feedback in practical application, so that the model is more accurate and effective.

Further, the method for extracting the data characteristics of the historical data comprises the following steps:

1. Data preprocessing, namely zero-averaging historical data, which means that the data is adjusted so that the average value of each dimension is 0. The specific operation is to subtract the mean value of the corresponding dimension from each data point. The purpose of this centering process is to eliminate the average of the data, ensuring that the focus of the PCA analysis is on the degree of data dispersion.

2. Calculating a covariance matrix, namely calculating a covariance matrix of the data set, wherein the covariance matrix measures correlation among different dimensions of the data. Covariance matrices help to understand whether there is a linear relationship between data dimensions and are the basis for finding principal components. Covariance of one dimension with respect to itself is its variance, and covariance that is not between the same dimensions is indicative of their strength of linear relationship.

3. And solving the eigenvalue and the eigenvector, namely solving the eigenvalue and the corresponding eigenvector from the covariance matrix. The eigenvectors define new coordinate axes and the eigenvalues represent the degree of data dispersion on these new coordinate axes. The larger the eigenvalue, the larger the variance of the data in the direction of the corresponding eigenvector, i.e., the more scattered the data in this direction.

4. Selecting principal components and constructing a projection matrix:

And selecting a main component, namely sorting the feature vectors according to the sizes of the feature values, and selecting the feature vectors corresponding to the first n largest feature values as the main component. These principal components can maximally retain information in the dataset.

And constructing a projection matrix according to the selected eigenvectors. This matrix will be used to project the raw data into a low dimensional space.

5. And (3) performing dimension reduction by using a projection matrix, namely projecting the historical data into a low-dimensional space formed by main components to obtain a dimension reduced data expression, namely the data characteristics of the historical data. This step involves transforming the original dataset with a projection matrix, resulting in a mapping of the historical data in a new low-dimensional coordinate system, resulting in data features of the historical data.

Further, the influence degree comprises the influence degree of acquiring sensitive information through intercepting a data packet, the influence degree of attacking through stealing identity information and the influence degree of unauthorized modification data.

Further, the calculation expression of the risk value is:

G=S*I

The present application is not limited to the above-mentioned embodiments, and any changes or substitutions that can be easily understood by those skilled in the art within the technical scope of the present application are intended to be included in the scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A data asset security monitoring method, characterized in that it includes the following steps:

Conduct data asset detection, parse returned data packets, and build a data asset information database;

Building an attack tree model based on the data asset information library, and calculating the risk value of each attack path in the attack tree model through a decision tree algorithm;

The method for constructing an attack tree model based on the data asset information library includes:

The data assets that need to be protected are taken as the root nodes of the tree;

Gather a data asset repository of information on system architecture, data flows, security measures, and potential vulnerabilities;

Determine an attack path based on the root node and the data asset information library;

The root node, attack path and attack means are represented by a graphical method to obtain an attack tree model;

The method for calculating the risk value of each attack path in the attack tree model includes:

Collect historical data and extract data features of historical data;

Building a decision tree model based on the data features of the historical data;

Calculate the success rate of each attack path based on the decision tree model, and evaluate the impact according to the potential impact of the attack path;

Calculating a risk value based on the success rate and impact level;

The method for constructing a decision tree model comprises:

The success rate and impact of the attack path are used as target variables;

Extracting data features that affect the target variable from the data features of the historical data to obtain a training set;

Training the initial decision tree model using the training set to obtain a trained decision tree model;

Methods for extracting data features of historical data include:

Perform zero mean processing on historical data to obtain a preprocessed data set;

Calculating the covariance matrix of the preprocessed data set, and solving the eigenvalues and corresponding eigenvectors from the covariance matrix;

Sort the eigenvectors according to the size of the eigenvalues, and select the eigenvectors corresponding to the first n largest eigenvalues as the principal components;

Project the historical data into a low-dimensional space composed of principal components to obtain the data features of the historical data;

Develop a data asset monitoring strategy based on the risk value.

2. The data asset security monitoring method according to claim 1, characterized in that:

The attack methods include but are not limited to data packet theft, identity theft and data tampering.

3. The data asset security monitoring method according to claim 1, characterized in that:

The impact levels include: the impact level of obtaining sensitive information by intercepting data packets; the impact level of attacking by stealing identity information; and the impact level of modifying data without authorization.

4. The data asset security monitoring method according to claim 1, characterized in that:

The calculation expression of the risk value is:

G=S*I; where G represents the risk value, S represents the success rate, and I represents the degree of impact.