A smart campus security management and control platform based on big data technology

Abstract

The present invention discloses a smart campus security management and control platform based on big data technology. Based on the protection objects of the smart campus construction system, it follows the principles of safety and reliability, dynamic compatibility, integrated innovation, convenient management, coexistence of advanced and standard, and multiple protections. With data security as the core, it builds a cloud + terminal + boundary interconnected network security ecosystem, which has risk identification ability, security defense ability, security detection ability, security response ability and security recovery ability, and ultimately achieves the security goals of risk visibility, active defense, and automated operation, ensures the safety of school business, promotes the in-depth construction of smart campuses, and enhances the application of smart campuses.

Description

Technical Field

[0001] The present invention relates to the technical field of smart campus, and in particular to a smart campus security management and control platform based on big data technology. Background Art

[0002] At present, the network security design of colleges and universities is mainly limited to the security protection of a single aspect of the campus, while the smart campus is to deeply integrate scientific research, office, management, teaching, life and other businesses, and to interconnect and integrate the frequent interactions between people, people and things, and things and things. Security does not exist independently, but is mutually restricted. Traditional network security defense methods have become incapable of coping with the current campus network security threats under the background of big data.

[0003] To this end, how to effectively link the original decentralized security products at various levels or equipment systems of the smart campus to coordinate and cooperate to jointly protect the smart campus is an urgent problem that needs to be solved. Summary of the invention

[0004] In view of the above-mentioned problems, the present invention aims to provide a smart campus security management and control platform based on big data technology, through which the security products in the smart campus can work together.

[0005] In order to achieve the above object, the technical solution adopted by the present invention is as follows:

[0006] A smart campus security management and control platform based on big data technology, characterized in that the security management and control platform includes an infrastructure layer, a support platform layer, a smart application layer and a presentation layer;

[0007] The infrastructure layer is used to solve security issues such as server virtualization security and network boundary security in the smart campus;

[0008] The support platform layer is used to solve the code security problem of the smart campus system;

[0009] The smart application layer is used to solve problems such as application security management, user rights management, and account security management;

[0010] The presentation layer is used to solve the problems of terminal device security management and WEB page security protection.

[0011] Furthermore, the infrastructure layer is provided with a server security module and a boundary security module, wherein the server security module includes a virus defense module and a vulnerability protection module; the boundary security module includes a perception module, a detection and analysis module, and a disposal module;

[0012] The virus defense module adopts a virus defense mode that combines cloud detection and local detection, caches and shares scan results for virtual machines and servers, and uses an incremental scanning mode to improve scanning efficiency;

[0013] The vulnerability protection module scans and fixes vulnerabilities in operating systems such as Windows or Linux, and performs unified vulnerability management and updates;

[0014] The perception module is used to detect abnormal information in the system;

[0015] The detection and analysis module is used to detect and analyze the security policies that match each virtual machine;

[0016] The processing module is used to process data according to security policies.

[0017] Furthermore, the support platform layer sets up an intelligent code security management sub-platform, which is used to monitor the platform software and various interface application codes in the smart campus in real time. Once the source code changes, it will issue an early warning, automatically analyze the code and match it with the vulnerability library, and issue an early warning in time if there is a vulnerability in the code; and it can link with more than two mature third-party code security reinforcement software to detect code changes or vulnerabilities, and will call the third-party code security reinforcement software to repair the code, while performing code obfuscation and code reinforcement on the code.

[0018] Furthermore, the presentation layer is provided with a terminal threat protection module, an intelligent WEB security protection module, a security operation management module and an early warning module;

[0019] The terminal threat protection module is implemented based on the honeypot principle. The first layer is the lure layer, which allocates idle IPs to the honeypot service and redirects the attacker's traffic to the honeypot environment in the isolated network, thereby protecting the real IP from intrusion while collecting attacker information. The second layer is the dynamic virtual layer. When the attacker finds out that the IP is not their real target and tries to change the attack route, the real IP is switched to the hot standby IP according to the captured attacker log, and the original real IP is dynamically constructed into a virtual environment, in order to lengthen the attacker's attack path and capture more attack behavior data of the attacker.

[0020] The intelligent WEB security protection module includes intelligent monitoring, intelligent analysis, and intelligent processing function modules, which are used to protect against WEB attacks on the network;

[0021] The security operation management module includes a data collection module, a perception module, a data processing and analysis module, and a decision-making and disposal module, which are used to realize the linkage of various layers of security protection, unified management and analysis of security logs and behavioral data, so that managers can fully perceive the security issues of the smart campus and deal with security risks in a timely manner;

[0022] The early warning module uses big data technology to perform analysis and is used to issue early warnings for various abnormal conditions of the platform.

[0023] Furthermore, the smart application layer is provided with a smart access control module, a smart behavior security management module and a smart security brain;

[0024] The intelligent access control module is used to uniformly recover the accounts of each application system, centrally manage them, and realize unified application entry authentication; and to recover the access rights of each application system, realize unified management of application rights, establish an access control list including the corresponding accounts and application rights, and realize fine-grained access rights control;

[0025] The intelligent behavior security management module is used to manage user access behavior or application software usage behavior, perform intelligent analysis based on access risk behavior and abnormal information, timely update user identity and authority information, and send behavior logs for risk analysis and evaluation to the early warning module.

[0026] Furthermore, the data collection module collects various types of security data by installing flow probes at the network exits such as the campus network exit, the data center exit, and each convergence layer to monitor the traffic and generate traffic logs, and by deploying data collectors at each layer of the smart campus to capture the log data and behavior data of security devices and software at each layer;

[0027] The perception module is used to pre-process the data collected by the collector and the stream probe, convert it according to a unified normalized data format, and transfer it to the smart security brain data center;

[0028] The data processing and analysis module is used to use the intelligent security brain data center to distribute and index the data collected by the perception module, perform data fusion and association analysis, identify and understand attack behaviors and attack intentions based on the analysis results, and generate an analysis report;

[0029] The decision-making and handling module is used to predict threat trends based on the assessed security risk level in the analysis report.

[0030] The beneficial effects of the present invention are:

[0031] The present invention provides a smart campus security management and control platform based on big data technology, which can realize three-dimensional security protection of smart campus, effectively solve the security island of smart campus, realize the coordinated protection of each module and each layer, give full play to the protection ability of each layer of security equipment, and greatly reduce the security construction cost of smart campus. It can realize intelligent security management, use big data technology to perform data fusion analysis, timely analyze and deal with security threats, predict smart campus security risks, fully perceive the security situation of smart campus, realize the automation of smart campus security protection, greatly reduce the level of smart campus security operation and maintenance management, and effectively solve the problem of lack of security management personnel in smart campuses of colleges and universities. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 Design a hierarchical structure diagram for the smart campus system;

[0033] Figure 2 This is the structural diagram of the smart campus security management and control platform. DETAILED DESCRIPTION

[0034] In order to enable those skilled in the art to better understand the technical solution of the present invention, the technical solution of the present invention is further described below in conjunction with embodiments.

[0035] The smart campus security management and control platform is based on the smart campus system. The hierarchical structure of the smart campus system is shown in the attached Figure 1 As shown in the figure, the smart campus system can be divided into the infrastructure layer, the support platform layer, the smart application layer and the presentation layer. The infrastructure layer mainly includes wired network, wireless network, Internet of Things and cloud storage. According to the characteristics of the infrastructure layer, it can be seen that this layer mainly has security issues such as server virtualization security and network boundary security.

[0036] The support platform layer includes various application engines, development platforms, data centers, authentication platforms, etc., which support smart campus applications and services. Therefore, this layer mainly has security issues such as code security and the defense capabilities of various support platforms.

[0037] The smart application layer mainly includes various applications in the smart campus, providing smart applications and services for users at all levels. Most of these applications and services adopt micro-application and micro-service architecture. Each micro-application and micro-service can provide services independently. Therefore, this layer mainly has application system code security and system application security issues, as well as user identity authentication security and behavior security issues;

[0038] The presentation layer uses various terminal devices and WEB systems to collect and display information, so the security of this layer mainly includes the security of terminal devices, WEB systems, new media, and remote access and work security of mobile terminals.

[0039] The smart campus security management and control platform proposed in the present invention carries out security protection design for the security issues faced by each layer of the above-mentioned smart campus system, deploys sensors at each layer of the smart campus and stream probes at key network ports, and collects data from sensors and stream probes in a timely manner through data collectors, which are sent to the smart security brain after pre-processing, so as to provide data support for the smart operation and management platform to comprehensively perceive the security situation of the smart campus, timely analyze and deal with security threats, and predict security risks of the smart campus.

[0040] Therefore, corresponding to the stratification of the smart campus system, the smart campus security management and control platform of the present invention is also divided into four layers, specifically including: infrastructure layer, support platform layer, smart application layer and presentation layer. Each layer is explained below.

[0041] (1) Infrastructure layer security design

[0042] The infrastructure layer is both the first and the bottom line of defense for smart campuses, and there are mainly security issues such as server virtualization security and network boundary security. In the face of security risks in the big data era, it is far from enough to rely solely on local high-performance, multi-functional security products to protect the security of the basic layer. It is necessary to shift from traditional passive protection to active defense with multiple security lines, collect a large amount of network data, conduct intelligent analysis through the smart security brain in the smart application layer, dynamically perceive security threats, and actively defend against attacks.

[0043] The infrastructure layer includes a server security module and a boundary security module. The server security module includes a vulnerability protection module and a virus defense module. The boundary security module includes a perception module, a detection and analysis module, and a disposal module.

[0044] Server security: A smart campus virtualizes physical server resources to build a cloud data center, which is not isolated by physical boundaries, builds dynamic resource pools for computing and storage, and implements centralized management of applications. First, it is necessary to design an intelligent virus detection function. After the server is virtualized, attackers usually directly invade the virtual machine through applications and implant Trojan viruses. Therefore, the present invention sets up a virus defense module, adopts a virus defense mode that combines cloud detection and local detection, caches and shares scan results for virtual machines and servers, and uses an incremental scanning mode to improve scanning efficiency. Second, the security protection of the physical host focuses on the design of vulnerabilities in operating systems such as Windows or Linux, and sets up a vulnerability protection module to scan and patch vulnerabilities, and conducts unified management and updates.

[0045] Boundary security: It is the first line of defense for the smart campus network. It mainly protects the campus network from the outside to the inside, protects campus resources from external attacks, and prevents external network attacks from the inside to the outside. Traditional boundary security deployments include security products such as firewalls, behavior auditing, VPN systems, and intrusion detection systems. The focus is on blocking attacks at the entrances and exits of university networks. However, the physical entrances and exits of the network are not the only way for attackers to enter the network. There are many optional ways and breakthroughs to invade the network, such as PCs, smart terminals, teachers and students, application software, network services, etc., which will become the entrances and breakthroughs for attackers to attack. Therefore, the security boundary of the network is a logical boundary, not a traditional physical boundary. Its security design ideas: First, set up multi-level protection, extend the attack route and attack time, let the attacker expose as many abnormal behaviors as possible, obtain attack behavior data, rely on big data analysis to discover and analyze threats in advance, and take the initiative to attack; second, design refined user access control strategies and data entry and exit strategies. Immediately install threat perception modules at each logical boundary, and work with the intelligent security brain and cloud-based threat detection center to form a three-dimensional analysis and detection system to detect and analyze incoming and outgoing data and user access requests, respond in a timely manner, and take measures and provide protection.

[0046] Therefore, the present invention sets up a boundary security module, uses the perception module to transmit the perception information back to the intelligent security brain, and matches the security policy of each virtual machine through the intelligent security brain. The security policy includes multi-level protection, refined user access control policy and data entry and exit policy. The disposal module is used to dispose of the data according to the results, thereby effectively solving the problem of mutual attacks between virtual machines caused by virtual machine drift.

[0047] (2) Support platform layer security design

[0048] The security of the smart campus support platform layer is far from enough to rely solely on the security protection of the infrastructure layer, and it cannot solve its own code security problems. Therefore, the present invention sets up an intelligent code security management sub-platform at this layer to manage the code security of the security control platform. The intelligent code security management sub-platform first has an automatic code security detection mechanism, which can monitor the platform software and various interface application codes in real time. Once the source code changes, it will issue an early warning, automatically analyze the code and match it with the vulnerability library, and issue an early warning in time if there is a vulnerability in the code; second, it has an automatic source code security reinforcement mechanism. The intelligent code security management platform links more than two mature third-party code security reinforcement software, detects code changes or vulnerabilities, and calls the third-party code security reinforcement software to repair the code, while performing code obfuscation and code reinforcement on the code.

[0049] (3) Smart application layer security design

[0050] With the advancement of the construction of smart campuses in colleges and universities, school application systems are constantly enriched. In order to solve the numerous user accounts and facilitate user use, smart campuses adopt a unified identity authentication system, but it also makes various application security management and user authority management extremely difficult. The present invention sets an intelligent access control module and an intelligent behavior security management module at this layer to solve the problems of application security management, user authority management, account security management, etc., and sets a smart security brain as a data center and a computing center.

[0051] The intelligent access control module implements access control to application software through the intelligent identity authentication function. It provides unified user identity management services and permission management services. First, it unifies and centrally manages the accounts of various application systems to achieve unified application entry authentication; second, it unifies the access rights of various application systems to achieve unified management of application rights, establishes an access control list corresponding to accounts and application rights, and achieves fine-grained access control; third, the execution process. After receiving the access request (including account information and access application), the intelligent identity authentication will verify the user identity information of the visitor. After the verification is passed, the intelligent permission management module will verify the application identity and match its access rights from the access control list. Then, the intelligent permission management module acts as a proxy to establish application / API access services with the application system and provide authorized access. Although the account may have multiple application access rights, the content that has not been applied for access this time does not have access rights, realizing one application and one access.

[0052] The intelligent behavior security management module is used to manage user access behaviors or application software usage behaviors. First, it uses the intelligent perception function to perceive various behaviors during the user access process, and conducts risk analysis and assessment through behavior logs such as user requests, identity authentication, access authorization, application access, and other behavioral changes, and issues timely warnings. It conducts intelligent analysis based on access risk behaviors and abnormal information, and updates the user's identity and permission information in a timely manner, achieving self-learning capabilities and continuously improving risk prevention capabilities. Secondly, it can send the collected data such as user Internet behavior, network equipment, and application system logs to the early warning module of the presentation layer;

[0053] The smart security brain includes a data center and a computing center. The data center includes security logs, behavioral data, security vulnerabilities generated by various devices, software and people in the smart campus, as well as virus libraries, vulnerability libraries, incorrect word libraries, public opinion libraries, etc. connected to third parties; the computing center includes data statistics, data intelligent analysis, data mining, data fusion computing, data update computing, AI computing, security policy update computing, etc., which are used for various data operations on the platform.

[0054] (4) Presentation layer security design

[0055] The presentation layer is the entrance for users to experience various applications of smart campus using various terminals. The large number and variety of terminal devices in the university intranet and the wide variety of users pose huge security risks to the smart campus network. Therefore, it is necessary to ensure the security of terminal devices and WEB pages. Therefore, this layer includes terminal threat protection module, intelligent WEB security protection module, security operation management module and early warning module. The terminal threat protection module adopts the honeypot principle to design a multi-level terminal threat protection mechanism.

[0056] The first layer of the multi-level terminal threat protection mechanism is the lure layer, which allocates idle IPs to the honeypot service and redirects the attacker's traffic to the honeypot environment in the isolated network, thereby protecting the real IP from intrusion and collecting attacker information at the same time; the second layer is the dynamic virtual layer. When the attacker finds out that the IP is not their real target and that the attacker is trying to change the attack route, the real IP is switched to the hot standby IP based on the captured attacker log, and the original real IP is dynamically constructed into a virtual environment. In order to lengthen the attacker's attack path and capture more attack behavior data of the attacker, the dynamic virtual layer will automatically construct multiple layers based on the actual situation until the attacker can be effectively killed by analyzing the attack behavior data.

[0057] At present, university application systems all adopt B / S architecture and directly interact with users through WEB pages. Therefore, WEB pages have become the first target of attackers. Data leakage, page tampering, black links, and sensitive content errors often occur. In combination with the current WEB attack content, big data analysis technology is used to build an intelligent WEB security protection module based on the public cloud. The module includes functional modules such as intelligent monitoring, intelligent analysis, and intelligent processing. Intelligent monitoring is a 7*24-hour service mode. It monitors the changes in website content in real time, such as whether it has been tampered with, whether the website has external links, whether there are sensitive pictures, potential problems, etc., matches it with the original content template, and generates a website content security monitoring report; relying on a third-party cloud security big data resource library, the intelligent analysis module uses big data technology to analyze the website content security monitoring report and proposes a feasible solution to the manager, who performs manual processing through a wizard method.

[0058] Various security devices are deployed at all levels of the smart campus, and a large amount of security logs and behavioral data are collected. In order to achieve the linkage of security protection at all levels, unified management and analysis of security logs and behavioral data, a security operation management module is built based on the smart security brain. This module enables managers to fully perceive the security issues of the smart campus and deal with security risks in a timely manner. It includes data collection module, perception module, data processing and analysis module, and decision-making and disposal module.

[0059] The main function of the data collection module is to collect various types of security data. First, by installing flow probes at the campus network exit, data center exit, and each convergence layer network exit to monitor traffic, real-time perception of network traffic changes, and production of traffic logs; second, by deploying data collectors at each layer of the smart campus, the log data and behavior data of security devices and software at each layer are captured;

[0060] The perception module is used to pre-process the data collected by the collector and flow probe, convert it into a unified normalized data format, and transfer it to the intelligent security brain data center to provide data support for subsequent security incident analysis, threat presentation, tracking and tracing.

[0061] The data processing and analysis module is used to utilize the intelligent security brain data center to perform distributed storage and indexing on the data collected by the perception module, and to perform data fusion and association analysis using the data relationship rule engine, resource management engine, data search engine, statistical analysis engine, etc. Based on data fusion analysis, it uses deep learning, machine learning, reinforcement learning and other technologies to analyze, identify and understand attack behaviors and attack intentions, generate analysis reports, and respond to alarms in a timely manner.

[0062] The main task of the decision-making and disposal module is to evaluate the security risk level and predict threat trends based on the analysis report. First, according to the level of security risk, generate linkage strategies and send them to network security devices such as firewalls, IPS, and WAF to adopt corresponding execution strategies; second, based on the security threat trend analysis, generate a set of command sets to trigger relevant network security devices or software to update security protection strategies and strengthen security defenses; third, through association rule analysis, homology analysis, machine learning and other technologies, the flow and log data are mined, and the associated flow metadata, behavior, and log data of different attack stages are analyzed to reshape the attacker's entire attack chain, thereby restoring the original appearance of the attack and accurately reflecting the attacked network resources, attacker information, victim information, etc.;

[0063] The early warning module uses big data technology for analysis. First, it is used for campus public opinion early warning. Through the analysis of teachers' and students' online behavior data, it can timely discover abnormal dynamics of teachers and students, such as late return, high consumption, online loan trends, addiction to the Internet, ideological dynamics, etc., and take timely measures to avoid public opinion incidents on campus; second, business early warning. Through the analysis of student learning, book resources and other data, early warnings such as student performance and resource utilization efficiency can be achieved; third, equipment failure early warning. Through the analysis of equipment log data, equipment abnormalities can be analyzed in advance, maintenance can be done in advance, and uninterrupted operation of equipment can be guaranteed.

[0064] The above shows and describes the basic principles, main features and advantages of the present invention. It should be understood by those skilled in the art that the present invention is not limited to the above embodiments, and the above embodiments and descriptions are only for explaining the principles of the present invention. Without departing from the spirit and scope of the present invention, the present invention may have various changes and improvements, which fall within the scope of the present invention to be protected. The scope of protection of the present invention is defined by the attached claims and their equivalents.

Claims

1. A smart campus safety management and control platform based on big data technology, characterized in that: The security management and control platform includes an infrastructure layer, a support platform layer, a smart application layer, and a presentation layer; The infrastructure layer is used to solve the security issues of server virtualization security and network boundary security in the smart campus; The support platform layer is used to solve the code security problem of the smart campus system; The smart application layer is used to solve the problems of application security management, user authority management, and account security management; The presentation layer is used to solve the security management of terminal devices and the security protection of WEB pages; in: The infrastructure layer is provided with a server security module and a boundary security module, wherein the server security module includes a virus defense module and a vulnerability protection module; the boundary security module includes a perception module, a detection and analysis module, and a disposal module; The virus defense module adopts a virus defense mode that combines cloud detection and local detection, caches and shares scan results for virtual machines and servers, and uses an incremental scanning mode to improve scanning efficiency; The vulnerability protection module scans and fixes vulnerabilities in Windows or Linux operating systems, and performs unified vulnerability management and updates; The perception module is used to detect abnormal information in the system; The detection and analysis module is used to detect and analyze the security policies that match each virtual machine; The processing module is used to process the data according to the security policy; The support platform layer is equipped with an intelligent code security management sub-platform, which is used to monitor the platform software and various interface application codes in the smart campus in real time. Once the source code changes, it will issue an early warning, automatically analyze the code and match it with the vulnerability library, and issue an early warning in time if there is a vulnerability in the code; and it can link more than two mature third-party code security reinforcement software to detect code changes or vulnerabilities, and call the third-party code security reinforcement software to repair the code, and at the same time perform code obfuscation and code reinforcement on the code; The presentation layer is equipped with a terminal threat protection module, an intelligent WEB security protection module, a security operation management module and an early warning module; The terminal threat protection module is implemented based on the honeypot principle. The first layer is the lure layer, which allocates idle IPs to the honeypot service and redirects the attacker's traffic to the honeypot environment in the isolated network, thereby protecting the real IP from intrusion while collecting attacker information. The second layer is the dynamic virtual layer. When the attacker finds out that the IP is not their real target and tries to change the attack route, the real IP is switched to the hot standby IP according to the captured attacker log, and the original real IP is dynamically constructed into a virtual environment, in order to lengthen the attacker's attack path and capture more attack behavior data of the attacker. The intelligent WEB security protection module includes intelligent monitoring, intelligent analysis, and intelligent processing function modules, which are used to protect against WEB attacks on the network; The security operation management module includes a data collection module, a perception module, a data processing and analysis module, and a decision-making and disposal module, which are used to realize the linkage of various layers of security protection, unified management and analysis of security logs and behavioral data, so that managers can fully perceive the security issues of the smart campus and deal with security risks in a timely manner; The early warning module uses big data technology to analyze and warn of various abnormal conditions of the platform; The smart application layer is provided with a smart access control module, a smart behavior security management module and a smart security brain; The intelligent access control module is used to uniformly recover the accounts of each application system, centrally manage them, and realize unified application entry authentication; and to recover the access rights of each application system, realize unified management of application rights, establish an access control list including the corresponding accounts and application rights, and realize fine-grained access rights control; The intelligent behavior security management module is used to manage user access behavior or application software usage behavior, perform intelligent analysis based on access risk behavior and abnormal information, timely update user identity and authority information, and send behavior logs for risk analysis and evaluation to the early warning module.

2. A smart campus safety management and control platform based on big data technology as claimed in claim 1, characterized in that: The data collection module collects various types of security data by installing flow probes at the campus network exit, data center exit, and network exits of each convergence layer to monitor traffic and generate traffic logs, and by deploying data collectors at each layer of the smart campus to capture log data and behavior data of security devices and software at each layer; The perception module is used to pre-process the data collected by the collector and the stream probe, convert it according to a unified normalized data format, and transfer it to the smart security brain data center; The data processing and analysis module is used to use the intelligent security brain data center to distribute and index the data collected by the perception module, perform data fusion and association analysis, identify and understand attack behaviors and attack intentions based on the analysis results, and generate an analysis report; The decision-making and handling module is used to predict threat trends based on the assessed security risk level in the analysis report.

Images