Client information management system based on enterprise information security monitoring

Abstract

The invention discloses a customer information management system based on enterprise information security monitoring, which relates to the technical field of information security management and comprises an information management center. The information management center is in communication connection with an information collection and storage module, an information synchronization and sharing module, a safety evaluation module, a data access monitoring module, an abnormal behavior analysis module and a risk management module, and all the modules are in electric signal connection; the information collection and storage module is used for receiving client information input by a client through a client terminal. According to the method, comprehensive risk assessment and early warning are provided by analyzing a comprehensive result of security assessment, data use monitoring and abnormal behavior analysis, so that an enterprise can identify and assess potential security risks in time and formulate corresponding risk management strategies, and the risk management efficiency is improved. The division of risk early warning levels provides a quantitative risk view for enterprises to assist the enterprises in identifying and coping with potential security threats.

Description

Technical Field

[0001] The present invention relates to the technical field of information security management, and in particular to a customer information management system based on enterprise information security monitoring. Background Art

[0002] With the rapid development of information technology, enterprises are increasingly relying on digitalization and networking for daily operations and management. However, this also makes enterprises face increasingly severe information security challenges. Information security not only concerns the company's business secrets and customer privacy, but also directly affects the company's reputation, economic interests and sustainable development capabilities. The customer information management system is a tool that helps companies centrally collect, store, manage and analyze customer information through technical means. It can help companies fully understand customer information, achieve precision marketing, improve sales efficiency, and enhance customer stickiness. Therefore, strengthening enterprise information security monitoring and building a safe and reliable customer information management system has become an indispensable and important task for enterprises.

[0003] For example, a customer information management system and method disclosed in Chinese Patent Publication No. CN108171527A relates to the field of information management technology. The customer information management system includes a main server and multiple sub-servers that are communicatively connected to the main server. Each sub-server is arranged on a different network node, and multiple network nodes constitute the underlying ring chain of the system. The customer information management system and method provided by the present invention share customer information on different network nodes, which is convenient for customers to query, and also avoids customers from frequently and repeatedly entering customer information on different network nodes, thereby improving the efficiency of information management.

[0004] In the prior art, customer information management systems have higher efficiency in sharing, updating and querying customer information. However, when processing, updating and querying customer information, there is a lack of assessment measures for data usage, system performance and security threats, and there is a lack of effective monitoring of abnormal customer behaviors, which in turn affects the company's monitoring of system status and risk management. For this reason, a customer information management system based on enterprise information security monitoring is proposed. Summary of the invention

[0005] The purpose of the present invention is to provide a customer information management system based on enterprise information security monitoring to solve the problems raised in the above background technology.

[0006] In order to solve the above technical problems, the technical solution adopted by the present invention is:

[0007] A customer information management system based on enterprise information security monitoring includes an information management center, wherein the information management center is communicatively connected with an information collection and storage module, an information synchronization and sharing module, a security assessment module, a data access monitoring module, an abnormal behavior analysis module, and a risk management module, wherein electrical signals are connected between the modules;

[0008] The information collection and storage module is used to receive customer information input by the customer through the customer terminal and save the information to the corresponding sub-database to ensure accurate collection and efficient storage of customer information, providing a basis for subsequent information processing;

[0009] The information synchronization and sharing module is used to monitor the customer information received by any sub-server, and synchronize the customer information to the sub-server authorized by the customer according to the authorization information, so as to realize the cross-network node sharing of customer information, avoid repeated input, and improve the efficiency of information management;

[0010] The security assessment module is used to regularly conduct security vulnerability assessment and scanning, monitor the performance indicators of system processing speed, response time and system load, obtain security assessment index, timely discover and repair potential security risks, enhance system security, and reduce security risks caused by system vulnerabilities;

[0011] The data access monitoring module is used to track and record the access behavior of customer information, record data usage logs, ensure the legal use of customer information, and prevent data leakage and abuse;

[0012] The abnormal behavior analysis module monitors and analyzes user behavior based on machine learning technology, obtains anomaly assessment indexes, identifies abnormal behavior patterns, and determines specific abnormal behavior types, prevents potential security risk behaviors, and enhances the system's prediction and defense capabilities;

[0013] The risk management module is used to obtain the risk warning coefficient and determine the specific risk warning level based on the results of security assessment, data usage monitoring and abnormal behavior analysis, formulate and implement risk management strategies of the corresponding risk warning level, effectively reduce the security risks faced by the system, and improve the company's information security management level.

[0014] A further improvement of the technical solution of the present invention is that: in the information collection and storage module, the process of saving the information to the corresponding sub-database is:

[0015] The customer logs in to the customer information management system through the customer terminal and enters personal information in the designated input interface, including but not limited to name, ID number, contact information, home address, work information, etc.;

[0016] Before information is submitted, the input data is formatted and logically verified on the front end to ensure the accuracy and completeness of the data, and sensitive information is encrypted. Sensitive information includes, but is not limited to, ID card number, home address, etc. Strong encryption algorithms are used to ensure the security of data during transmission.

[0017] The encrypted data is transmitted to the enterprise's internal sub-server through a secure communication channel, and a unique identifier is created based on the key fields of the customer's input information as an index of customer information to improve query efficiency;

[0018] The customer information and its identifier are stored in a sub-database corresponding to the customer information, and each sub-database is usually located on a different network node to ensure distributed storage and security of the data;

[0019] Log information recording the receipt and storage of customer information, including receipt time, customer information summary, and processing status.

[0020] A further improvement of the technical solution of the present invention is that in the information synchronization sharing module, the process of synchronizing customer information to the customer authorized sub-server is as follows:

[0021] After a customer enters or updates personal information on any sub-server, that sub-server acts as a source sub-server to receive and store the relevant information and monitor the status of customer information reception on all sub-servers;

[0022] For the received customer information, preliminary data analysis is performed to confirm the completeness and accuracy of the information. Before synchronizing the customer information, the authorization field in the customer information is checked to confirm whether the customer agrees to synchronize the information to other sub-servers. If the customer has authorized it, the customer's authorization scope is further matched with the sub-server to be synchronized. Only when the authority match is successful, the next step of synchronization is performed;

[0023] After the permissions are matched successfully, the synchronization and sharing mechanism is triggered, and the customer information is encrypted to ensure the security of the information during transmission. According to the authorization information, the customer information is synchronized to the sub-server with receiving permissions;

[0024] After receiving the customer information, the target sub-server stores it in the corresponding sub-database, updates the local data, and updates the information index on the target sub-server to ensure that the latest synchronized customer information can be quickly retrieved;

[0025] Record the log of the synchronization operation, including time, source server, target server, and synchronized data summary, check whether the synchronized data is consistent on all authorized sub-servers, and feedback the synchronization results to the source sub-server and the information management center to confirm the success or failure of the synchronization operation.

[0026] A further improvement of the technical solution of the present invention is that in the safety assessment module, the process of obtaining the safety assessment index is as follows:

[0027] Preset a periodic security scanning plan, use vulnerability scanners and penetration testing tools to perform comprehensive security vulnerability scans, including network vulnerability scans, system vulnerability scans, and application vulnerability scans, and regularly conduct vulnerability assessments on the system to identify possible security vulnerabilities and weaknesses;

[0028] Collect performance indicator data based on security performance indicators such as system processing speed, response time, and system load, and analyze the collected data to identify system performance bottlenecks and potential problems;

[0029] Based on the vulnerability assessment results and performance indicator data, the severity and potential interference of the number of vulnerabilities and security performance indicators on the system are comprehensively analyzed to obtain the security assessment index. Based on the analysis results, a detailed security assessment report is generated, listing the existing security vulnerabilities, performance issues and improvement suggestions;

[0030] According to the severity of the vulnerabilities in the security assessment report and their impact on the system, determine the priority of the repair work, formulate corresponding repair plans and timetables, and repair the vulnerabilities in a timely manner, including applying security patches, updating configurations, and strengthening access controls. According to the performance monitoring results, optimize and adjust the system to improve the system's processing speed and response capabilities;

[0031] Establish a user feedback mechanism to collect problems and suggestions encountered by users during use, and improve the system security and user experience in a targeted manner.

[0032] A further improvement of the technical solution of the present invention is that the calculation formula of the safety assessment index is:

[0033]

[0034] Where SAI is the security assessment index, n is the number of vulnerabilities assessed, and V i is the severity score of the ith vulnerability, V i The value of is usually determined by the severity of the vulnerability, with smaller values ​​representing more severe vulnerabilities. m is the number of performance indicators, P j is the score of the jth performance indicator, P j Higher values ​​indicate better performance based on processing speed, response time, and system load. It represents the sum of the reciprocals of the severity scores of all vulnerabilities. The reciprocal is used to make smaller V i (representing more severe vulnerabilities) contribute more to the total, Indicates that the average value of the inverse of vulnerability severity is calculated, which refers to the average impact of each vulnerability on system security. It is the sum of performance indicators, reflecting the comprehensive score of system performance. As a denominator, it is used to normalize the sum of the performance indicators to ensure that the number of performance indicators does not disproportionately affect the final index. The weighted sum of the performance indicators is converted into a coefficient for adjusting the safety assessment index.

[0035] A further improvement of the technical solution of the present invention is that in the data access monitoring module, the process of tracking and recording customer information access behavior is:

[0036] Monitor all access behaviors and requests to customer information and check whether the requester has the authority to access customer information. Access behaviors and requests include but are not limited to access time, access user, access data type, and query, modification, deletion and other operation types;

[0037] Set up a logging function to record all access activities, including visitor identity, access time, access data type and access results, monitor data usage in real time, including data reading, copying, modifying and deleting operations, store user behavior data and mark them;

[0038] Set up regular tasks to analyze log data and establish a normal behavior baseline for each user, compare it with the actual behavior, and identify access deviations.

[0039] A further improvement of the technical solution of the present invention is that in the abnormal behavior analysis module, the process of obtaining the abnormal evaluation index is:

[0040] Obtain the original data of user behavior data from the data access monitoring module, and pre-process the collected data to remove invalid, redundant and erroneous data to ensure the accuracy and completeness of the data;

[0041] Extract behavioral analysis features based on the pre-processed user behavior data, which are behavioral features, user features, and system features. Behavioral features include timestamp, operation interval, access frequency, access type, and access data type. User features include user role, permission level, and historical behavior records. System features include system load, network delay, and system error log.

[0042] Based on machine learning technology, we build an abnormal behavior model in combination with the acquired user behavior data to detect abnormal behavior. We also calculate the abnormal evaluation index based on the output of the model to evaluate the abnormal degree of user behavior.

[0043] Preset an evaluation threshold of the abnormal evaluation index, and classify the detected abnormal behavior according to the preset abnormal behavior type to determine the specific abnormal behavior type;

[0044] Based on the type of abnormal behavior determined, an alarm is triggered and relevant managers are notified to investigate the abnormal behavior and take appropriate response measures.

[0045] A further improvement of the technical solution of the present invention is that the calculation formula of the abnormal evaluation index is:

[0046]

[0047] Where AAI is the anomaly assessment index, z is the number of observed behavioral features, and f g is the scoring function of the g-th behavior feature, c is the number of user features, t h is the score of the hth user feature, p is the number of system features, e k is the score of the kth system feature, μl is the average severity score of the system error log, w is the weight parameter used to adjust the intensity of the impact of the system feature, X is a base greater than 1, used to adjust the sensitivity of the logarithmic function, B g is the actual behavior feature value of the user, θ is the expected value of the determined behavior feature, that is, the typical value under normal behavior mode, u is the coefficient that controls the sensitivity of the scoring function, which determines how fast the score changes when it deviates from the expected value, and e is the base of the natural logarithm. g When f is equal to θ, g Close to 0.5, indicating that the behavior is considered normal, when B g When the value deviates greatly from θ, f g will be close to 0 or 1, indicating that the behavior is considered abnormal. The larger the value of u, the more likely B g A small deviation from f g Large changes occur, making the model more sensitive to small deviations.

[0048] A further improvement of the technical solution of the present invention is that in the risk management module, the process of determining the risk warning coefficient and the risk warning level is as follows:

[0049] Collect relevant data from the security assessment module, data access monitoring module and abnormal behavior analysis module, and integrate the assessment results of each module to assess the risk level faced by the current system;

[0050] Based on the results of security assessment, data usage monitoring and abnormal behavior analysis, the risk warning coefficient is calculated to reflect the severity of the risk;

[0051] According to the size of the risk warning coefficient, the risk is divided into different risk warning levels, namely low risk warning level, medium risk warning level and high risk warning level, and a corresponding risk warning threshold is set for each risk warning level to determine the current risk warning level;

[0052] Formulate corresponding risk management strategies and measures for different levels of risks, and implement risk management strategies according to the determined risk warning levels;

[0053] Continuously monitor risks, supervise the effective implementation of risk management strategies, analyze the accuracy of risk warnings, risk handling efficiency, and system security incident reduction rate, and evaluate the effectiveness of risk management;

[0054] Based on the evaluation results of risk management effectiveness, the risk management strategy is optimized, and a risk management report is generated and sent to relevant personnel. The risk management report includes the risk warning level, the implementation status of the risk management strategy, and the risk management effectiveness evaluation.

[0055] A further improvement of the technical solution of the present invention is that the calculation formula of the risk warning coefficient is:

[0056]

[0057] Among them, RAC is the risk warning coefficient, r is the number of safety assessment index, SAI i is the value of the ith safety assessment index, μ SAI is the average value of the safety assessment index, σ SAI is the standard deviation of the safety assessment index, y is the number of abnormal assessment indices, AAI j is the value of the jth anomaly assessment index, μ AAI is the average value of the anomaly assessment index, σ AAI is the standard deviation of the anomaly assessment index, N is the total number of users in the system, and is the parameter used in the logarithmic function, affecting the scale of the overall risk;

[0058] The plurality of risk warning levels correspond to the plurality of risk warning thresholds, wherein the risk warning thresholds include an upper threshold and a lower threshold;

[0059] The multiple risk warning levels and the multiple risk warning thresholds satisfy the following relationship:

[0060] Low risk warning level RAC <RAC df , the risk level is low, continue to monitor and review regularly;

[0061] Medium risk warning level RAC df ≤RAC<RAC zf , the risk level is medium, increase the frequency of security audits, and optimize access control policies;

[0062] High risk warning level RAC>RAC zf , the risk level is high, and the emergency response process is immediately initiated to block suspicious accounts and conduct in-depth investigations into potential security incidents;

[0063] Among them, RAC is the risk warning coefficient, RAC df The lower threshold corresponding to the medium risk warning level and the upper threshold corresponding to the low risk warning level, RAC zf It is the lower threshold corresponding to the high risk warning level and the upper threshold corresponding to the risk warning level.

[0064] Due to the adoption of the above technical solution, the present invention has the following technical advances compared with the prior art:

[0065] 1. The present invention provides a customer information management system based on enterprise information security monitoring. By analyzing the comprehensive results of security assessment, data usage monitoring and abnormal behavior analysis, it provides comprehensive risk assessment and early warning, so that enterprises can timely identify and evaluate potential security risks and formulate corresponding risk management strategies. The division of risk warning levels provides enterprises with a quantitative risk view to assist enterprises in identifying and responding to potential security threats.

[0066] 2. The present invention provides a customer information management system based on enterprise information security monitoring. By integrating a security assessment module, a data access monitoring module and an abnormal behavior analysis module, the security status of the system is comprehensively monitored and evaluated. The security assessment module can scan the system for security vulnerabilities and conduct risk assessments regularly or in real time to promptly discover potential security threats. The data access monitoring module monitors data access behavior in real time to ensure the legality and security of the data. The abnormal behavior analysis module can identify abnormal access patterns and potential security incidents, and together enhance the information security protection capabilities of the system, effectively preventing the occurrence of security incidents such as data leakage and illegal access. BRIEF DESCRIPTION OF THE DRAWINGS

[0067] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0068] Figure 1 It is a module diagram of the present invention;

[0069] Figure 2 A flowchart for obtaining the safety assessment index of the present invention;

[0070] Figure 3The flowchart of obtaining the abnormal evaluation index of the present invention is as follows;

[0071] Figure 4 The present invention is a flow chart for determining the risk warning coefficient and the risk warning level. DETAILED DESCRIPTION

[0072] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0073] Embodiment 1, as Figure 1-3 As shown, the present invention provides a customer information management system based on enterprise information security monitoring, including an information management center, the information management center is communicatively connected with an information collection and storage module, an information synchronization and sharing module, a security assessment module, a data access monitoring module, an abnormal behavior analysis module and a risk management module, wherein the modules are connected by electrical signals;

[0074] The information collection and storage module is used to receive customer information input by the customer through the customer terminal, and save the information to the corresponding sub-database to ensure the accurate collection and efficient storage of customer information, and provide a basis for subsequent information processing. The customer logs in to the customer information management system through the customer terminal, and enters personal information in the designated input interface, including but not limited to name, ID number, contact information, home address, work information, etc. Before the information is submitted, the front-end format and logic verification of the input data is performed to ensure the accuracy and completeness of the data, and sensitive information is encrypted. Sensitive information includes, but is not limited to, ID number, home address, etc., and a strong encryption algorithm is used to ensure the security of data during transmission. To ensure the security of data during transmission, the encrypted data is transmitted to the sub-server within the enterprise through a secure communication channel, and a unique identifier is created based on the key fields of the customer input information as a customer information index to improve query efficiency. The customer information and its identifier are saved in the sub-database corresponding to the customer information. Each sub-database is usually located on a different network node to ensure the distributed storage and security of the data, and the log information of the reception and storage of customer information is recorded, including the reception time, customer information summary, and processing status;

[0075] The information synchronization and sharing module is used to monitor the customer information received by any sub-server, and synchronize the customer information to the sub-server authorized by the customer according to the authorization information, so as to realize the cross-network node sharing of customer information, avoid repeated input, and improve the efficiency of information management. After the customer enters or updates personal information on any sub-server, the sub-server receives and stores the relevant information as the source sub-server, and monitors the reception status of customer information on all sub-servers. For the received customer information, preliminary data analysis is performed to confirm the completeness and accuracy of the information, and before synchronizing the customer information, the authorization field in the customer information is checked to confirm whether the customer agrees to synchronize the information to other sub-servers. If the customer has authorized it, the authorization scope of the customer is further matched with the sub-server to be synchronized to see if it is consistent. If the authority matching is successful, the next step of synchronization is carried out. After the authority matching is successful, the synchronization sharing mechanism is triggered, and the customer information is encrypted to ensure the security of the information during transmission. According to the authorization information, the customer information is synchronized to the sub-server with receiving authority. After the target sub-server receives the customer information, it stores it in the corresponding sub-database, updates the local data, and updates the information index on the target sub-server to ensure that the latest synchronized customer information can be quickly retrieved. The log of the synchronization operation is recorded, including the time, source server, target server, and synchronized data summary. It is checked whether the synchronized data is consistent on all authorized sub-servers, and the synchronization results are fed back to the source sub-server and the information management center to confirm the success or failure of the synchronization operation;

[0076] The security assessment module is used to regularly assess and scan security vulnerabilities, monitor the performance indicators of system processing speed, response time and system load, obtain the security assessment index, timely discover and repair potential security risks, enhance system security, and reduce security risks caused by system vulnerabilities. It presets a periodic security scanning plan, uses vulnerability scanners and penetration testing tools to perform comprehensive security vulnerability scans, including network vulnerability scans, system vulnerability scans and application vulnerability scans, regularly assesses the system for vulnerabilities, discovers possible security vulnerabilities and weaknesses, collects performance indicator data based on the security performance indicators of system processing speed, response time and system load, analyzes the collected data, identifies system performance bottlenecks and potential problems, and Based on the vulnerability assessment results and performance indicator data, the severity and potential interference of the number of vulnerabilities and security performance indicators on the system are comprehensively analyzed to obtain the security assessment index. Based on the analysis results, a detailed security assessment report is generated, listing the existing security vulnerabilities, performance issues and improvement suggestions. According to the severity of the vulnerabilities in the security assessment report and the impact on the system, the priority of the repair work is determined, and a corresponding repair plan and schedule are formulated to repair the vulnerabilities in a timely manner, including applying security patches, updating configurations and strengthening access control. According to the performance monitoring results, the system is optimized and adjusted to improve the system's processing speed and response capabilities. A user feedback mechanism is established to collect problems and suggestions encountered by users during use, and to improve the system's security and user experience in a targeted manner;

[0077] Furthermore, the calculation formula of the safety assessment index is:

[0078]

[0079] Where SAI is the security assessment index, n is the number of vulnerabilities assessed, and V i is the severity score of the ith vulnerability, V i The value of is usually determined by the severity of the vulnerability, with smaller values ​​representing more severe vulnerabilities. m is the number of performance indicators, P j is the score of the jth performance indicator, P j Higher values ​​indicate better performance based on processing speed, response time, and system load. It represents the sum of the reciprocals of the severity scores of all vulnerabilities. The reciprocal is used to make smaller V i (representing more severe vulnerabilities) contribute more to the total, Indicates that the average value of the inverse of vulnerability severity is calculated, which refers to the average impact of each vulnerability on system security. It is the sum of performance indicators, reflecting the comprehensive score of system performance. As a denominator, it is used to normalize the sum of the performance indicators to ensure that the number of performance indicators does not disproportionately affect the final index. The weighted sum of the performance indicators is converted into a coefficient to adjust the safety assessment index. It should be noted that V i The inverse of means that more serious vulnerabilities have a greater impact on SAI. i The value range is (0,1], the closer to 1, the less serious the vulnerability. As n increases, if V i The average value remains unchanged or decreases, that is, the severity of the vulnerability decreases, SAI tends to a stable value, and the sum of the performance indicators It will affect the speed of index decline. The better the performance, the slower the index declines. When the number of vulnerabilities n increases or the severity of the vulnerability V i When the performance index P increases, SAI will decrease, indicating that the system security is reduced. j When it is improved, the SAI will increase, indicating that the improvement of system performance helps improve security;

[0080] Data access monitoring module, used to track and record access behaviors to customer information, record data usage logs, ensure the legal use of customer information, prevent data leakage and abuse, monitor all access behaviors and requests to customer information, and check whether the requester has the authority to access customer information. Access behaviors and requests include but are not limited to access time, access users, access data types, and query, modification, deletion and other operation types. Set up a log recording function to record all access activities, including visitor identity, access time, access data type and access results, monitor data usage in real time, including data reading, copying, modification and deletion operations, store user behavior data and mark it, set up regular tasks to analyze log data, and establish a normal behavior baseline for each user, compare it with the actual behavior, and determine access deviations;

[0081] The abnormal behavior analysis module monitors and analyzes user behavior based on machine learning technology, obtains abnormal evaluation indexes, identifies abnormal behavior patterns, and determines specific abnormal behavior types, prevents potential security risk behaviors, and enhances the system's prediction and defense capabilities. It obtains the original data of user behavior data from the data access monitoring module, and preprocesses the collected data to remove invalid, redundant and erroneous data to ensure the accuracy and completeness of the data. It extracts behavior analysis features based on the preprocessed user behavior data, which are behavior features, user features and system features. Among them, behavior features include timestamps, operation intervals, access frequencies, access types and access data types. User features include user roles, authority levels, historical behavior records, and system features include system load, network delay, and system error logs. Based on machine learning technology, an abnormal behavior model is established in combination with the acquired user behavior data to perform abnormal behavior detection. Based on the output results of the model, the abnormal evaluation index is calculated to evaluate the abnormal degree of user behavior, and the evaluation threshold of the abnormal evaluation index is preset. The detected abnormal behavior is classified according to the preset abnormal behavior type to determine the specific abnormal behavior type. According to the determined abnormal behavior type, an alarm is triggered and the relevant management personnel are notified to investigate the abnormal behavior and take corresponding response measures.

[0082] Furthermore, the calculation formula of the abnormal assessment index is:

[0083]

[0084] Where AAI is the anomaly assessment index, z is the number of observed behavioral features, and f g is the scoring function of the g-th behavior feature, c is the number of user features, t h is the score of the hth user feature, p is the number of system features, e k is the score of the kth system feature, μl is the average severity score of the system error log, w is the weight parameter used to adjust the intensity of the impact of the system feature, X is a base greater than 1, used to adjust the sensitivity of the logarithmic function, B g is the actual behavior feature value of the user, θ is the expected value of the determined behavior feature, that is, the typical value under normal behavior mode, u is the coefficient that controls the sensitivity of the scoring function, which determines how fast the score changes when it deviates from the expected value, and e is the base of the natural logarithm. g When f is equal to θ, g Close to 0.5, indicating that the behavior is considered normal, when B g When the value deviates greatly from θ, f g will be close to 0 or 1, indicating that the behavior is considered abnormal. The larger the value of u, the more likely B g A small deviation from f gThe model is more sensitive to small deviations. g and t h The value range is (0, 1], the smaller the value, the more abnormal the feature. k The value range of and μl is [0, 1]. The larger the value, the better the system condition. w is a positive constant, which is used to adjust the influence of system characteristics in the entire evaluation. X is usually greater than 1, which affects the growth rate of the logarithmic function. The larger the AAI, the more abnormal the user behavior. The abnormal score f of the behavior characteristic g The higher the value (i.e. the smaller the value), the smaller the denominator, the larger the exponent, and the user feature score t h The higher the value, the larger the denominator, which will reduce the AAI value, indicating that the user characteristics are relatively normal and the system characteristic score is e k and the average error log severity μl affects the input value of the logarithmic function, which further affects the exponential;

[0085] The risk management module is used to obtain the risk warning coefficient and determine the specific risk warning level based on the results of security assessment, data usage monitoring and abnormal behavior analysis, formulate and implement risk management strategies for the corresponding risk warning level, effectively reduce the security risks faced by the system, and improve the company's information security management level.

[0086] Embodiment 2, as Figure 4 As shown, based on Example 1, the present invention provides a technical solution: Preferably, in the risk management module, the process of determining the risk warning coefficient and the risk warning level is:

[0087] Collect relevant data from the security assessment module, data access monitoring module and abnormal behavior analysis module, and integrate the assessment results of each module to assess the risk level faced by the current system. According to the results of security assessment, data usage monitoring and abnormal behavior analysis, calculate the risk warning coefficient to reflect the severity of the risk. According to the size of the risk warning coefficient, divide the risk into different risk warning levels, namely low risk warning level, medium risk warning level and high risk warning level, and set a corresponding risk warning threshold for each risk warning level to judge the current risk warning level. According to the risks of different levels, formulate corresponding risk management strategies and measures, and implement risk management strategies according to the determined risk warning level, continuously monitor risks, supervise the effective implementation of risk management strategies, analyze the accuracy of risk warning, risk handling efficiency, and system security incident reduction rate, evaluate the risk management effect, optimize the risk management strategy according to the evaluation results of the risk management effect, and generate a risk management report and send it to relevant personnel. The risk management report includes the risk warning level, the implementation of the risk management strategy, and the risk management effect evaluation;

[0088] Furthermore, the calculation formula of the risk warning coefficient is:

[0089]

[0090] Among them, RAC is the risk warning coefficient, r is the number of safety assessment index, SAI i is the value of the ith safety assessment index, μ SAI is the average value of the safety assessment index, σ SAI is the standard deviation of the safety assessment index, y is the number of abnormal assessment indices, AAI j is the value of the jth anomaly assessment index, μ AAI is the average value of the anomaly assessment index, σ AAI is the standard deviation of the anomaly assessment index, N is the total number of users in the system, and is used as a parameter in the logarithmic function, affecting the scale of the overall risk; it should be noted that SAI i and AAI j The value of is usually between 0 and 1, with 1 indicating the highest risk. represents the standardized score of the safety assessment index, It represents the weighted standardized score of the abnormal assessment index. When N increases, log(N) increases, resulting in a decrease in the value of RAC, reflecting the impact of scale effect on risk assessment. The standard deviation term σ SAI and σ AAI Used to normalize the variability of risk;

[0091] Furthermore, multiple risk warning levels correspond to multiple risk warning thresholds, wherein the risk warning thresholds include an upper threshold and a lower threshold;

[0092] Multiple risk warning levels and multiple risk warning thresholds satisfy the following relationship:

[0093] Low risk warning level RAC <RAC df , the risk level is low, continue to monitor and review regularly;

[0094] Medium risk warning level RAC df ≤RAC <RAC zf , the risk level is medium, increase the frequency of security audits, and optimize access control policies;

[0095] High risk warning level RAC>RAC zf , the risk level is high, and the emergency response process is immediately initiated to block suspicious accounts and conduct in-depth investigations into potential security incidents;

[0096] Among them, RAC is the risk warning coefficient, RAC df The lower threshold corresponding to the medium risk warning level and the upper threshold corresponding to the low risk warning level, RAC zfIt is the lower threshold corresponding to the high risk warning level and the upper threshold corresponding to the risk warning level.

[0097] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A customer information management system based on enterprise information security monitoring, including an information management center, characterized in that: The information management center is communicatively connected with an information collection and storage module, an information synchronization and sharing module, a security assessment module, a data access monitoring module, an abnormal behavior analysis module, and a risk management module, wherein electrical signals are connected between the modules; The information collection and storage module is used to receive customer information input by the customer through the customer terminal and save the information to the corresponding sub-database; The information synchronization and sharing module is used to monitor the customer information received by any sub-server and synchronize the customer information to the sub-server authorized by the customer according to the authorization information; The security assessment module is used to regularly conduct security vulnerability assessment and scanning, monitor the performance indicators of system processing speed, response time and system load, obtain security assessment index, and promptly discover and repair potential security risks; The data access monitoring module is used to track and record the access behavior of customer information and record data usage logs; The abnormal behavior analysis module monitors and analyzes user behavior based on machine learning technology, obtains an abnormal evaluation index, identifies abnormal behavior patterns, and determines specific abnormal behavior types; The risk management module is used to obtain the risk warning coefficient based on the results of security assessment, data usage monitoring and abnormal behavior analysis, and to determine the specific risk warning level, and to formulate and implement the risk management strategy of the corresponding risk warning level.

2. A customer information management system based on enterprise information security monitoring according to claim 1, characterized in that: In the information collection and storage module, the process of saving information to the corresponding sub-database is as follows: The customer logs in to the customer information management system through the customer terminal and enters personal information in the designated input interface; Before information is submitted, the input data is formatted and logically verified on the front end, and sensitive information is encrypted; The encrypted data is transmitted to the enterprise's internal sub-server through the communication channel, and a unique identifier is created based on the key fields of the customer's input information as an index of customer information; storing the customer information and its identifier in a sub-database corresponding to the customer information; Log information recording the receipt and storage of customer information, including receipt time, customer information summary, and processing status.

3. A customer information management system based on enterprise information security monitoring according to claim 2, characterized in that: In the information synchronization and sharing module, the process of synchronizing customer information to the customer authorized sub-server is as follows: After a customer enters or updates personal information on any sub-server, that sub-server acts as a source sub-server to receive and store the relevant information and monitor the status of customer information reception on all sub-servers; For the received customer information, preliminary data analysis is performed, and before synchronizing the customer information, the authorization field in the customer information is checked to confirm whether the customer agrees to synchronize the information to other sub-servers. If the customer has authorized it, further matching is performed to see whether the customer's authorization scope is consistent with the sub-server to be synchronized; After the permissions are matched successfully, the synchronization and sharing mechanism is triggered, and the customer information is encrypted and synchronized to the sub-server with receiving permissions according to the authorization information; After receiving the customer information, the target sub-server stores it in the corresponding sub-database, updates the local data, and updates the information index on the target sub-server; Record the log of the synchronization operation, including time, source server, target server, and synchronized data summary, check whether the synchronized data is consistent on all authorized sub-servers, and feedback the synchronization results to the source sub-server and the information management center to confirm the success or failure of the synchronization operation.

4. A customer information management system based on enterprise information security monitoring according to claim 3, characterized in that: In the safety assessment module, the process of obtaining the safety assessment index is as follows: Preset a periodic security scanning plan, use vulnerability scanners and penetration testing tools to perform security vulnerability scans, including network vulnerability scans, system vulnerability scans, and application vulnerability scans, and regularly assess system vulnerabilities; Collect performance indicator data based on security performance indicators such as system processing speed, response time, and system load, and analyze the collected data to identify system performance bottlenecks and potential problems; Based on the vulnerability assessment results and performance indicator data, the severity and potential interference of the number of vulnerabilities and security performance indicators on the system are comprehensively analyzed to obtain the security assessment index. Based on the analysis results, a detailed security assessment report is generated, listing the existing security vulnerabilities, performance issues and improvement suggestions; According to the severity of the vulnerabilities in the security assessment report and their impact on the system, determine the priority of the repair work, formulate corresponding repair plans and schedules, repair the vulnerabilities in a timely manner, and optimize and adjust the system according to the performance monitoring results; Establish a user feedback mechanism to collect problems and suggestions encountered by users during use, and improve the system security and user experience in a targeted manner.

5. A customer information management system based on enterprise information security monitoring according to claim 4, characterized in that: The calculation formula of the safety assessment index is: Where SAI is the security assessment index, n is the number of vulnerabilities assessed, and V i is the severity score of the ith vulnerability, m is the number of performance indicators, P j is the score of the jth performance indicator, It means to sum the reciprocals of the severity scores of all vulnerabilities. Indicates that the average value of the inverse of vulnerability severity is calculated, which refers to the average impact of each vulnerability on system security. is the sum of the performance indicators, As the denominator, used to normalize the sum of performance indicators, The weighted sum of the performance indicators is converted into a coefficient for adjusting the safety assessment index.

6. A customer information management system based on enterprise information security monitoring according to claim 5, characterized in that: In the data access monitoring module, the process of tracking and recording customer information access behavior is as follows: Monitor all access and requests to customer information and check whether the requester has the authority to access customer information; Set up a logging function to record all access activities, including visitor identity, access time, access data type and access results, monitor data usage in real time, store user behavior data and mark it; Set up regular tasks to analyze log data and establish a normal behavior baseline for each user, compare it with the actual behavior, and identify access deviations.

7. A customer information management system based on enterprise information security monitoring according to claim 6, characterized in that: In the abnormal behavior analysis module, the process of obtaining the abnormal evaluation index is as follows: Obtain the raw data of user behavior data from the data access monitoring module and pre-process the collected data; Extract behavioral analysis features based on the pre-processed user behavior data, which are behavioral features, user features, and system features. Behavioral features include timestamp, operation interval, access frequency, access type, and access data type. User features include user role, permission level, and historical behavior records. System features include system load, network delay, and system error log. Based on machine learning technology, we build an abnormal behavior model in combination with the acquired user behavior data to detect abnormal behavior. We also calculate the abnormal evaluation index based on the output of the model to evaluate the abnormal degree of user behavior. Preset an evaluation threshold of the abnormal evaluation index, and classify the detected abnormal behavior according to the preset abnormal behavior type to determine the specific abnormal behavior type; Based on the type of abnormal behavior determined, an alarm is triggered and relevant managers are notified to investigate the abnormal behavior and take appropriate response measures.

8. A customer information management system based on enterprise information security monitoring according to claim 7, characterized in that: The calculation formula of the abnormal assessment index is: Where AAI is the anomaly assessment index, z is the number of observed behavioral features, and f g is the scoring function of the g-th behavior feature, c is the number of user features, t h is the score of the hth user feature, p is the number of system features, e k is the score of the kth system feature, μl is the average severity score of the system error log, w is the weight parameter used to adjust the intensity of the impact of the system feature, X is a base greater than 1, used to adjust the sensitivity of the logarithmic function, B g is the actual behavior feature value of the user, θ is the expected value of the determined behavior feature, that is, the typical value under the normal behavior mode, u is the coefficient that controls the sensitivity of the scoring function, and e is the base of the natural logarithm.

9. A customer information management system based on enterprise information security monitoring according to claim 8, characterized in that: In the risk management module, the process of determining the risk warning coefficient and the risk warning level is as follows: Collect relevant data from the security assessment module, data access monitoring module and abnormal behavior analysis module, and integrate the assessment results of each module to assess the risk level faced by the current system; Based on the results of security assessment, data usage monitoring and abnormal behavior analysis, the risk warning coefficient is calculated to reflect the severity of the risk; According to the size of the risk warning coefficient, the risk is divided into different risk warning levels, namely low risk warning level, medium risk warning level and high risk warning level, and a corresponding risk warning threshold is set for each risk warning level to determine the current risk warning level; Formulate corresponding risk management strategies and measures for different levels of risks, and implement risk management strategies according to the determined risk warning levels; Continuously monitor risks, supervise the effective implementation of risk management strategies, analyze the accuracy of risk warnings, risk handling efficiency, and system security incident reduction rate, and evaluate the effectiveness of risk management; Based on the evaluation results of risk management effectiveness, the risk management strategy is optimized, and a risk management report is generated and sent to relevant personnel. The risk management report includes the risk warning level, the implementation status of the risk management strategy, and the risk management effectiveness evaluation.

10. A customer information management system based on enterprise information security monitoring according to claim 9, characterized in that: The calculation formula of the risk warning coefficient is: Among them, RAC is the risk warning coefficient, r is the number of safety assessment index, SAI i is the value of the ith safety assessment index, μ SAI is the average value of the safety assessment index, σ SAI is the standard deviation of the safety assessment index, y is the number of abnormal assessment indices, AAI j is the value of the jth anomaly assessment index, μ AAI is the average value of the anomaly assessment index, σ AAI is the standard deviation of the anomaly assessment index, N is the total number of users in the system; The plurality of risk warning levels correspond to the plurality of risk warning thresholds, wherein the risk warning thresholds include an upper threshold and a lower threshold; The multiple risk warning levels and the multiple risk warning thresholds satisfy the following relationship: Low risk warning level RAC <RAC df ; Medium risk warning level RAC df ≤RAC <RAC zf ; High risk warning level RAC>RAC zf ; Among them, RAC is the risk warning coefficient, RAC df The lower threshold corresponding to the medium risk warning level and the upper threshold corresponding to the low risk warning level, RAC zf It is the lower threshold corresponding to the high risk warning level and the upper threshold corresponding to the risk warning level.

Images