TWI667587B - Information security protection method - Google Patents

Abstract

An information security protection method is applicable to a to-be-monitored device, a data analysis platform, and a deployment platform, and includes the following steps: generating an instant usage record information by using the device to be monitored; Using the record information, a behavioral model is established in a machine learning manner; the deployment platform monitors an instant data stream information of the device to be monitored according to the behavior model; and when the deployment platform determines a real-time data of the device to be monitored The streaming information, when belonging to an abnormal behavior of the behavior model, blocks the transmission of the real-time data stream information of the device to be monitored. The method actively establishes a behavior model corresponding to the device to be monitored by means of machine learning, and implements an active and immediate information security protection architecture.

Description

Information security protection method

The invention relates to a protection method, in particular to an information security protection method.

An information security protection method for establishing a traditional information security defense architecture generally includes the following steps: setting a signature rule; blocking a network connection behavior that conforms to an abnormal signature; receiving a feedback message from a user; and determining that the feedback information displays a blocking network behavior When it is wrong (that is, when the networking behavior is not abnormal), modify the signature rules. In addition, the initial establishment or subsequent update of the signature rule may also be from an external information security related material, and is manually set. However, this rule-based information security protection method uses passive preparation and response, and there is still much room for improvement.

Accordingly, it is an object of the present invention to provide an active defense information security protection method.

Therefore, the information security protection method of the present invention is applicable to a to-be-monitored device, a data analysis platform, and a deployment platform, and includes steps (a) to (d).

In step (a), an instant usage record information is generated by the device to be monitored.

In step (b), the data analysis platform establishes a behavioral model in a machine learning manner according to the usage record information.

In step (c), the deployment platform monitors an instant data stream information of the device to be monitored according to the behavior model.

In the step (d), when the deployment platform determines that the real-time data stream information of the device to be monitored belongs to an abnormal behavior of the behavior model, blocking the transmission of the real-time data stream information of the device to be monitored.

In some implementations, the method is further applicable to a filtering platform, wherein, in the step (a), when the usage record information belongs to a first type of information, the device to be monitored directly transmits the usage record information to the data. Analysis platform. When the usage record information belongs to a second type of information, the device to be monitored directly transmits the usage record information to the filtering platform, and the filtering platform filters the usage record information and transmits the usage record information to the data analysis platform. The first type of information includes information that the data analysis platform needs to analyze and does not include a privacy information. The second type of information includes information that the data analysis platform needs to analyze and the private information.

In some implementations, in step (b), the data analysis platform monitors an accuracy rate of the behavior model according to a security record information of the device to be monitored and a result of the determination by the deployment platform.

In some implementations, wherein in step (a), the usage record information includes any one of a security device usage record, a network device usage record, and a server usage record.

The effect of the present invention is that the data analysis platform actively establishes the behavior model corresponding to the device to be monitored in a machine learning manner according to the usage record information of the device to be monitored, so that the deployment platform can be based on the behavior model. Instantly monitoring the real-time data stream information of the device to be monitored, thereby realizing an active and immediate information security protection architecture.

Before the present invention is described in detail, it should be noted that in the following description, similar elements are denoted by the same reference numerals.

Referring to FIG. 1 and FIG. 2, the information security protection method of the present invention is applicable to a to-be-monitored device 1, a data analysis platform 3, a deployment platform 4, and a filtering platform 2. For example, the monitoring device is an existing information infrastructure within the enterprise, such as a security defense device, a network device, a server host, a computer host, a network device, and the like, but is not limited thereto. The data analysis platform 3 is a technology that uses Big Data analysis and requires a computer cluster or a powerful single computer host to implement, and includes a monitoring module 31 and an analysis (Mining). ) Module 32. The deployment platform 4 belongs to an artificial intelligence engine (AI Engine). The filtering platform 2 is a type of collector, such as another computer host or another server host.

The information security protection method includes steps S1 to S4.

In step S1, an instant usage record information (Log) is generated by the device to be monitored 1 . The usage record information is different according to the device to be monitored 1, for example, including a security security device usage record, a network device usage record, and a server usage record, but is not limited thereto.

In addition, the usage record information can be divided into a first type of information and a second type of information, wherein the first type of information includes information to be analyzed by the data analysis platform 3 without including a privacy information, and the second type of information Contains the information and the privacy information that the data analysis platform 3 needs to analyze.

When the usage record information belongs to the first type of information, the device to be monitored 1 directly transmits the usage record information to the data analysis platform 3, such as path P2 of FIG. When the usage record information belongs to the second type of information, the to-be-monitored device 1 first transmits the usage record information to the filtering platform 2, and the filtering platform 2 filters the usage record information before the filtered usage is used. The record information is transmitted to the data analysis platform 3, such as paths P1 and P3 of FIG.

For example, the usage record information may be a network packet transmitted between computer hosts within a company (eg, a bank), and the content of the network packet includes some user's account number, password, or other personal privacy. The message, especially if it is not the information that the data analysis platform 3 needs to analyze, the filtering platform 2 will filter (delete) the unnecessary or redundant information to protect the related privacy content.

In step S2, the data analysis platform 3 establishes a behavior model in a machine learning manner according to the usage record information. The method of machine learning applied to the security analysis includes the first classification method, such as Logistic Regression, Decision Tree, Random Forest, Xgboost, Deep Learning, etc., to judge the connection between malicious and normal. Or archives, the second clustering method, such as k-means algorithm, density-based clustering algorithm (Dbscan), etc., to group files or behavior patterns. The above various machine learning methods can be implemented by analyzing software or program modules, such as R language, Python language, TensorFlow, SAS, etc., and the behavior can be established by one or a combination of the above various methods. model.

In more detail, in the embodiment, the monitoring module 31 of the data analysis platform 3 is based on the usage record information of the device to be monitored 1 (paths P2 and P3 of FIG. 2) and one of the deployment platforms 4. Judging the result (as shown in Figure 2, P7), monitoring the overall information security status and the accuracy of the behavior model. The analysis module 32 of the data analysis platform 3 performs further data exploration on the use record information, and finds a specific behavior pattern through machine learning to establish the behavior model. In other embodiments, the monitoring module 31 of the data analysis platform 3 can also monitor the overall information according to the usage record information and the security record information of the device to be monitored 1 and the judgment result of the deployment platform 4. The current state of information security and the accuracy of the behavioral model.

In addition, in the embodiment, the analysis module 32 of the data analysis platform 3 establishes the behavior model according to the usage record information. In other embodiments, the analysis module 32 may also establish the behavior model based on the user record information (path P8 of FIG. 2) and external information from an external information source 5. The external information source is, for example, another website, and the external information is, for example, information content including a blacklist and a whitelist.

In step S3, the deployment platform 4 monitors an instant data stream information of the device to be monitored 1 according to the behavior model (path P4 of FIG. 2) (such as paths P1 and P5 of FIG. 2). That is to say, the real-time data stream information monitored by the deployment platform 4 is filtered through the filtering platform 2 to remove confidential or sensitive private content, and then monitored in real time.

In addition, in this embodiment, the deployment platform 4 monitors the real-time data stream information according to the behavior model, and in other embodiments, the deployment platform may be based on the external information source according to the behavior model. Another model is also used to monitor the live data stream information. In other words, the information security protection method of this case can be operated simultaneously with the existing security protection mechanism without conflict.

In step S4, when the deployment platform 4 determines that the real-time data stream information of the device to be monitored 1 belongs to an abnormal behavior of the behavior model, blocking the transmission of the real-time data stream information of the device to be monitored 1, such as Path P6 of Figure 2. When the deployment platform 4 determines the instant data stream information and does not belong to the abnormal behavior of the behavior model, the monitoring and judgment are continuously maintained.

The information security architecture established by the information security protection method of the present invention can be operated separately, and can also assist the existing security equipment to operate together to check whether there is a potential network threat. For example, the device to be monitored 1 is a computer host in the enterprise, and the usage record information includes information related to the connection time and the connection target when the host computer is used, and the data analysis platform 3 according to the connection time. And the connection target, establishing a plurality of behavior models corresponding to the device 1 to be monitored, the first behavior model is whether the connection target of the computer host is abnormal, and the second behavior model is related to the computer host. Whether the line time is abnormal, the third behavior model is related to whether the host computer connects a specific internal or external webpage (or system) in a predetermined time interval, and the fourth behavior model is related to the computer host. Whether there is an abnormal jump when linking to a website, the fifth behavior model is related to whether the platform connected to the host computer belongs to a suspected blacklist or a similar normal website (ie, a phishing website).

In more detail, the fifth behavioral model is a Long Short-Term Memory (LSTM) model related to the Domain Name. Long-term and short-term memory is a kind of time recurrent neural network (RNN). By establishing a model with "memory and forgetting" mechanism to analyze the correlation of vocabulary in the context, the semantic analysis is made.

The Long-Term and Short-Term Memory (LSTM) model is a known technique that uses a binary classification model established by a neural network-like framework. The process of its establishment is briefly described as follows. The host will mark multiple domain names that belong to a whitelist and mark them as samples of normal domain names. The host also marks multiple domain names belonging to a blacklist and marks them as samples of the abnormal domain name. The whitelist can be obtained by an existing whitelisted website on the network, which can be generated by known multiple sets of domain generation algorithms (DGA), but not limited to this. For example, domain names that are whitelisted, such as google.com, esunbank.com, yahoo.com, etc., are blacklisted domain names such as xyafilk.com, uiteeraab.com, and so on.

The host computer will first extract the first eight characters of the longest string in each of the whitelist and blacklist domain names, such as google, esunbank, yahoo, xyafilk, uiteeraa, and so on. The host computer then converts each of the retrieved strings into a vector, that is, each character is mapped to a predetermined value, and when the length of the character is less than eight, the value is filled with a value of 0, according to the above example. For example, convert a, b, c, ..., z, ..., -, _ to values 1, 2, 3, ..., 26, ..., 36, 37, etc., then google, esunbank, yahoo, xyafilk, uiteeraa Converted to vectors [7,15,15,7,12,5,0,0], [5,19,21,14,2,1,14,11], [25,1,8, 15, respectively 15,0,0,0], [24,25,1,6,9,12, 11,0], [21,9,20,5,5,18,1,1].

The long-and short-term memory model uses the two samples belonging to the normal domain name and the abnormal domain name as input data to train the model to determine whether the domain name is normal, and performs forward propagation and backpropagation by using recursion. ), and then modify the model through a given optimization algorithm. In addition, during the establishment of the model, the model is used to determine the accuracy of the domain name (Precision), recall rate (Recall), and parameters (F1-value) and other commonly used mathematical evaluation indicators to evaluate the accuracy of the model.

The deployment platform 4 monitors the real-time data stream information of the device 1 to be monitored according to the long-term and short-term memory model. More specifically, the computer host captures the longest string of the domain names of each detected packet, and when the longest string is greater than eight characters, it is reduced to eight characters. Then it is numerically converted to obtain a vector. The long-term and short-term memory model receives the vector and determines whether it belongs to a malicious domain name (ie, an abnormal domain name), and outputs a number between 0 and 1 as a judgment value, such as 0.4, 0.98, etc. Wait. The long-term and short-term memory model has a preset threshold value, for example, 0.9. When the judgment value is less than the threshold value, such as 0.4<0.9, it is determined that the domain name does not belong to a malicious domain name. Conversely, when the judgment value is greater than the threshold, such as 0.98>0.9, it is determined that the domain name belongs to a malicious domain name.

In addition, in this embodiment, for convenience of description, the device to be monitored 1 to which the information security protection method is applied is represented by only one device to be monitored, and in fact, the information security protection method is also It can be applied to multiple devices to be monitored, such as multiple computer hosts, server mains, network devices, networking devices, etc. within the enterprise, by which the data analysis platform 3 establishes corresponding behavior according to the waiting monitoring device. The model, for example, establishes the same behavior model according to the same unit or computer equipment of the same business nature, and can also establish a respective behavior model according to each computer device, and deploy each behavior model by the deployment platform 4. The same effect can be achieved by each of the corresponding monitoring devices.

That is to say, the information security architecture established by the information security protection method of the present invention belongs to an active security defense, and can establish a behavior model by analyzing similar networking behaviors of the same or multiple devices to be monitored, and In the verification of suspicious behavior cases, the hypothetical conditions of the behavioral model are revised, and the normal behavior and abnormal behavior of the behavioral model are defined to block the illegal networking behavior and to conduct an event investigation, and then feedback the mechanism of blocking the network.

In summary, the data analysis platform actively establishes the behavior model corresponding to the device to be monitored in an artificially intelligent machine learning manner according to the usage record information of the device to be monitored, so that the deployment platform can perform the behavior according to the behavior. The model monitors the real-time data stream information of the device to be monitored in real time. In addition, by filtering the confidential or sensitive information in the usage record information by the filtering platform, the personal information confidentiality can also be well controlled, so the object of the present invention can be achieved.

However, the above is only the embodiment of the present invention, and the scope of the invention is not limited thereto, and all the simple equivalent changes and modifications according to the scope of the patent application and the patent specification of the present invention are still Within the scope of the invention patent.

S1~S4‧‧‧ steps

1‧‧‧Monitoring equipment

2‧‧‧Filter platform

3‧‧‧Data Analysis Platform

31‧‧‧Monitor module

32‧‧‧Analysis module

4‧‧‧Deployment platform

5‧‧‧External information sources

P1~P9‧‧‧ Path

Other features and advantages of the present invention will be apparent from the embodiments of the present invention, wherein: Figure 1 is a flow chart illustrating an embodiment of the information security protection method of the present invention; Figure 2 is a block diagram showing an aspect to which the embodiment is applied.

Claims (3)

An information security protection method is applicable to a to-be-monitored device, a data analysis platform, a filtering platform, and a deployment platform, and includes the following steps: (a) generating an instant usage record information by the device to be monitored; b) establishing, by the data analysis platform, a behavioral model in a machine learning manner according to the usage record information; (c) monitoring, by the deployment platform, an instant data stream information of the device to be monitored according to the behavior model; And (d) when the deployment platform determines that the real-time data stream information of the device to be monitored belongs to an abnormal behavior of the behavior model, blocking transmission of the real-time data stream information of the device to be monitored; wherein, in the step (a), when the usage record information belongs to a first type of information, the device to be monitored transmits the usage record information directly to the data analysis platform, and when the usage record information belongs to a second type of information, the The monitoring device directly transmits the usage record information to the filtering platform, and the filtering platform filters the usage record information and transmits the usage record information to the data analysis platform. The first information includes information required to analyze the data analysis platform does not contain a private information, the second type of information comprises the information and private information required to analyze the data analysis platform. The information security protection method according to claim 1, wherein in step (b), the data analysis platform further monitors the behavior model according to a security record information of the device to be monitored and a result of the judgment of the deployment platform. An accuracy rate. The information security protection method according to claim 2, wherein, in the step (a), the usage record information includes any one of a security device usage record, a network device usage record, and a server usage record. By.