Enterprise information security management system based on big data analysis

Abstract

The invention belongs to the technical field of enterprise information management, and particularly relates to an enterprise information security management system based on big data analysis, which comprises a data acquisition and processing module, a big data analysis module, an enterprise information security evaluation module, a risk defense module and a visual supervision module. The data acquisition and processing module acquires security data from an enterprise network and performs data preprocessing, the big data analysis module analyzes the preprocessed data by using a big data analysis technology to identify potential safety hazards, and the enterprise information security assessment module generates a security assessment report based on a big data analysis result. And the risk defense module takes corresponding defense measures according to the security assessment report to ensure the security of the enterprise information, and ensures the storage security and export security of the enterprise information by carrying out risk monitoring analysis on all storage devices and carrying out export monitoring on the enterprise information, thereby realizing effective supervision on the security of the enterprise information.

Description

Technical Field

[0001] The present invention relates to the technical field of enterprise information management, and in particular to an enterprise information security management system based on big data analysis. Background Art

[0002] With the rapid development of information technology, the degree of enterprise informatization is constantly improving, and enterprise data information has become the core asset of the enterprise. However, due to the frequent occurrence of information security incidents such as cyber attacks and data leaks, the operational security of enterprises is seriously threatened;

[0003] A Chinese invention patent with publication number CN114936176A discloses a security management system for enterprise information. The invention technical solution builds a comprehensive security management and control system, fully utilizes network management and control means and wireless communication technology, and realizes effective management and control of enterprise user terminal network access behavior and network access time period;

[0004] However, in actual application, the above-mentioned technical solution cannot effectively identify the potential security risks of the enterprise network and take timely defensive measures, and cannot reasonably analyze the storage risk and export risk of enterprise information and issue timely warnings, which is not conducive to ensuring the security of enterprise information and it is difficult to achieve effective supervision of enterprise information security.

[0005] In view of the above technical defects, a solution is now proposed. Summary of the invention

[0006] The purpose of the present invention is to provide an enterprise information security management system based on big data analysis, which solves the problem that the existing technology is unable to effectively identify security risks of enterprise networks and take timely defensive measures, and is unable to reasonably analyze the storage risks and export risks of enterprise information and issue timely warnings, making it difficult to achieve effective supervision of enterprise information security.

[0007] To achieve the above object, the present invention provides the following technical solutions:

[0008] The enterprise information security management system based on big data analysis includes a data collection and processing module, a big data analysis module, an enterprise information security assessment module, a risk defense module and a visual supervision module; the data collection and processing module collects security data from various security devices, network devices and application systems in the enterprise network, including structured data, semi-structured data and unstructured data, and cleans, converts the format and standardizes the collected data, and sends the pre-processed data packets to the big data analysis module;

[0009] The big data analysis module uses big data analysis technology to analyze the pre-processed data to identify potential security risks, and sends the analysis results to the enterprise information security assessment module;

[0010] Based on the results of big data analysis, the enterprise information security assessment module evaluates the security of enterprise information to generate a security assessment report, and sends the security assessment report to the risk defense module and the visual supervision module. The visual supervision module visualizes the security assessment report; the risk defense module takes corresponding defense measures according to the security assessment report, including encrypting enterprise information, setting firewall rules and isolating suspicious devices, and sends the defense operation information to the visual supervision module for display.

[0011] Furthermore, the analysis operations of the big data analysis module include attack detection, vulnerability mining and malicious code detection; among them, attack detection uses big data analysis technology to analyze network traffic and log data to find signs of network attacks;

[0012] Vulnerability mining can quickly discover vulnerabilities in network devices by analyzing their configuration information, operating system versions, and patch status; malicious code detection can mine the characteristics of malicious code samples in the network and classify unknown malicious code.

[0013] Furthermore, the visualization supervision module is connected to the storage hidden danger decision module and the file export monitoring module in communication, the enterprise information is stored through a number of storage devices, the storage hidden danger decision module performs risk monitoring and analysis on all storage devices, generates a storage high hidden danger signal or a storage low hidden danger signal of the corresponding storage device through analysis, and sends the storage high hidden danger signal or the storage low hidden danger signal of the corresponding storage device to the visualization supervision module;

[0014] The file export monitoring module monitors the export of enterprise information, determines the export risk before the user exports the corresponding file through the export device, and generates an export high-risk signal or an export low-risk signal accordingly. When the export low-risk signal is generated, the user is allowed to export the corresponding file. When the export high-risk signal is generated, the user is not allowed to export the corresponding file, and the export high-risk signal or the export low-risk signal is sent to the visualization supervision module.

[0015] Furthermore, the specific operation process of the storage hidden danger decision module includes:

[0016] Obtain a performance risk value of the corresponding storage device, compare the performance risk value with a preset performance risk threshold, and generate a storage high risk signal if the performance risk value exceeds the preset performance risk threshold;

[0017] If the performance risk value does not exceed the preset performance risk threshold, the deviation value of the real-time temperature of the corresponding storage device compared to the corresponding preset suitable temperature standard value is collected and marked as the storage temperature analysis value, the deviation value of the real-time humidity of the environment where the corresponding storage device is located compared to the corresponding preset suitable humidity standard value is marked as the storage humidity analysis value, and the vibration amplitude of the corresponding storage device and the dust concentration of the environment where the storage device is located are marked as the storage vibration analysis value and the storage pollution analysis value respectively;

[0018] The storage hidden danger actual measurement value is obtained by numerically calculating the storage temperature analysis value, the storage humidity analysis value, the storage vibration analysis value and the storage pollution analysis value, and the storage hidden danger actual measurement value is numerically compared with the preset storage hidden danger actual measurement threshold value. If the storage hidden danger actual measurement value exceeds the preset storage hidden danger actual measurement threshold value, it is judged that the corresponding storage device is in a risk alarm state;

[0019] The total duration of the corresponding storage device in the risk alarm state per unit time is obtained and marked as the measured value during the risk alarm, and the average of all the measured values ​​of storage hidden dangers of the corresponding storage device per unit time is calculated to obtain the storage hidden danger performance value, and a set of preset importance coefficients is set in advance for each storage device. The hidden danger decision coefficient is obtained by numerically calculating the measured value during the risk alarm, the storage hidden danger performance value and the preset importance coefficient, and the hidden danger decision coefficient is numerically compared with the preset hidden danger decision coefficient threshold. If the hidden danger decision coefficient exceeds the preset hidden danger decision coefficient threshold, a high storage hidden danger signal is generated; if the hidden danger decision coefficient does not exceed the preset hidden danger decision coefficient threshold, a low storage hidden danger signal is generated.

[0020] Furthermore, the storage hidden danger decision module is communicatively connected to the storage performance degradation analysis module, and the storage performance degradation analysis module predicts and analyzes the storage performance degradation status of the corresponding storage device, obtains the performance risk value of the corresponding storage device through analysis, and sends the performance risk value of the corresponding storage device to the storage hidden danger decision module.

[0021] Furthermore, the specific analysis process of the storage performance degradation analysis module is as follows:

[0022] The production date of the corresponding storage device is collected, and the interval between the current date and its production date is marked as the storage device production time value, and the total time that the corresponding storage device is in the risk alarm state in the historical stage is marked as the total risk alarm time value;

[0023] The total number of maintenance optimizations performed on the corresponding storage device in the historical stage is collected and marked as the maintenance optimization frequency, and the number of occurrences when the interval between two adjacent groups of maintenance optimizations exceeds the preset interval threshold is marked as the maintenance excellence table value; the performance risk value of the corresponding storage device is obtained by numerically calculating the storage device production time value, the total risk alarm time value, the maintenance optimization frequency and the maintenance excellence table value.

[0024] Furthermore, the analysis process of the file export monitoring module is as follows:

[0025] Before the user exports the corresponding file through the export device, the user's identity is verified to determine whether the user has the authority to export the corresponding file. If the user does not have the authority to export the corresponding file, a high-risk export signal is generated;

[0026] If the user has the authority to export the corresponding file, it is determined whether the corresponding export device is a registered device. If the corresponding export device is an unregistered device, an export high-risk signal is generated; if the corresponding export device is a registered device, the corresponding export device is scanned and analyzed to generate an export high-risk signal or an export low-risk signal.

[0027] Furthermore, the specific analysis process of scanning and analyzing the corresponding export devices is as follows:

[0028] Scan the corresponding export device with a virus vulnerability scanning tool to identify the virus vulnerability of the export device. If there is no virus vulnerability in the export device, generate an export low risk signal; if there is a virus vulnerability in the export device, classify the identified virus vulnerabilities, and set each type of virus vulnerability to correspond to a set of preset risk weight values ​​in advance, and mark the product of the number of virus vulnerabilities of the corresponding type and the corresponding preset risk weight value as the virus vulnerability class inspection value;

[0029] And the virus vulnerability class detection values ​​of all types of virus vulnerabilities existing in the corresponding export device are summed up to obtain the scanning risk coefficient, and the scanning risk coefficient is numerically compared with the preset scanning risk coefficient threshold. If the scanning risk coefficient exceeds the preset scanning risk coefficient threshold, an export high risk signal is generated; if the scanning risk coefficient does not exceed the preset scanning risk coefficient threshold, an export low risk signal is generated.

[0030] Furthermore, the operation process of the file export monitoring module also includes:

[0031] When the user exports the corresponding file, the user information, file information, export device information and export time are recorded, and a detection period is set. The number of file exports of the corresponding user during the detection period and the amount of exported file data are marked as file pilot values ​​and file inspection values, respectively. The user suspicion coefficient is obtained by numerically calculating the file pilot value and the file inspection value. The user suspicion coefficient is numerically compared with a preset user suspicion coefficient threshold. If the user suspicion coefficient exceeds the preset user suspicion coefficient threshold, the corresponding user is marked as a suspicious user, and the suspicious user is sent to the visualization supervision module.

[0032] Compared with the prior art, the present invention has the following beneficial effects:

[0033] 1. In the present invention, the data collection and processing module collects security data from the enterprise network and performs data preprocessing. The big data analysis module uses big data analysis technology to analyze the preprocessed data to identify potential security risks. The enterprise information security assessment module generates a security assessment report based on the results of the big data analysis. The risk defense module takes corresponding defense measures according to the security assessment report to ensure the security of enterprise information.

[0034] 2. In the present invention, risk monitoring and analysis are performed on all storage devices through the storage risk decision module. When a storage high risk signal is generated, control and processing measures are taken on the corresponding storage devices to ensure the safe and stable operation of all storage devices. The export of enterprise information is monitored through the file export monitoring module, and the export risk is judged before export, thereby realizing effective supervision of enterprise information security with a high degree of intelligence. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to facilitate understanding by those skilled in the art, the present invention is further described below in conjunction with the accompanying drawings;

[0036] Figure 1 This is a system block diagram of Embodiment 1 of the present invention;

[0037] Figure 2 This is a system block diagram of Embodiment 2 and Embodiment 3 of the present invention. DETAILED DESCRIPTION

[0038] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0039] Embodiment 1: Figure 1As shown, the enterprise information security management system based on big data analysis proposed in the present invention includes a data acquisition and processing module, a big data analysis module, an enterprise information security assessment module, a risk defense module and a visual supervision module; the data acquisition and processing module collects security data from various security devices, network devices and application systems in the enterprise network, including structured data (such as database records), semi-structured data (such as XML, JSON) and unstructured data (such as text, images, audio and video), and cleans, converts the format and standardizes the collected data to ensure the quality and consistency of the data, and sends the pre-processed data packets to the big data analysis module.

[0040] The big data analysis module uses big data analysis technology (such as Hadoop, etc.) to analyze the pre-processed data, including attack detection, vulnerability mining and malicious code detection, to identify potential security risks, and send the analysis results to the enterprise information security assessment module;

[0041] Attack detection: By using big data analysis technology to analyze network traffic and log data, we can find signs of network attacks, such as abnormal behavior, scanning behavior, sniffing behavior, and DDoS attacks;

[0042] Vulnerability mining: quickly discover vulnerabilities in network devices by analyzing their configuration information, operating system versions, and patches;

[0043] Malicious code detection: By analyzing malicious code samples in the network, mining their characteristics and classifying unknown malicious codes, real-time detection is achieved.

[0044] The enterprise information security assessment module evaluates the security of enterprise information based on the results of big data analysis to generate a security assessment report, and sends the security assessment report to the risk defense module and the visual supervision module. The visual supervision module visualizes the security assessment report;

[0045] The risk defense module takes corresponding defense measures according to the security assessment report, including encrypting enterprise information, setting firewall rules and isolating suspicious devices, so as to improve the security protection of enterprise information, and sends the defense operation information to the visual supervision module for display, which is conducive to the supervisory personnel to grasp the defense operation status in detail and manually make corresponding defense measures Adjustment and optimization, further ensuring the security of enterprise information.

[0046] Embodiment 2: Figure 2As shown, the difference between this embodiment and the first embodiment is that the visualization supervision module is communicatively connected to the storage hidden danger decision module, the enterprise information is stored through a plurality of storage devices, the storage hidden danger decision module performs risk monitoring and analysis on all storage devices, generates a storage high hidden danger signal or a storage low hidden danger signal of the corresponding storage device through analysis, and sends the storage high hidden danger signal or the storage low hidden danger signal of the corresponding storage device to the visualization supervision module;

[0047] When the visual supervision module receives a high storage risk signal, it issues a corresponding warning to remind supervisors to take corresponding control measures on the corresponding storage devices, ensure the safe and stable operation of all storage devices, and reduce the storage risk of the stored enterprise information. The specific operation process of the storage risk decision module is as follows:

[0048] The performance risk value FM of the corresponding storage device is obtained, and the performance risk value FM is numerically compared with the preset performance risk threshold. If the performance risk value FM exceeds the preset performance risk threshold, it indicates that the performance of the corresponding storage device is likely to be seriously degraded, which is not conducive to ensuring the storage security of the stored enterprise information, and a storage high risk signal is generated;

[0049] If the performance risk value FM does not exceed the preset performance risk threshold, indicating that the possibility of serious performance degradation of the corresponding storage device is small, then the deviation value of the real-time temperature of the corresponding storage device compared to the corresponding preset suitable temperature standard value is collected and marked as the storage temperature analysis value, the deviation value of the real-time humidity of the environment where the corresponding storage device is located compared to the corresponding preset suitable humidity standard value is marked as the storage humidity analysis value, and the vibration amplitude of the corresponding storage device and the dust concentration of the environment where the storage device is located are marked as the storage vibration analysis value and the storage pollution analysis value respectively;

[0050] The storage temperature analysis value HN, the storage humidity analysis value QY, the storage vibration analysis value ZF and the storage pollution analysis value WP are numerically calculated by the formula HX=(sq1*HN+sq2*QY+sq3*ZF+sq4*WP) / 4 to obtain the storage hidden danger measured value HX; wherein sq1, sq2, sq3, sq4 are preset proportional coefficients with values ​​greater than zero, and the larger the value of the storage hidden danger measured value HX, the worse the real-time condition of the corresponding storage device is;

[0051] Compare the actual storage hidden danger value HX with the preset storage hidden danger threshold. If the actual storage hidden danger value HX exceeds the preset storage hidden danger threshold, it indicates that the real-time status of the corresponding storage device is poor, and the corresponding storage device is judged to be in a risk alarm state.

[0052] The total time that the corresponding storage device is in the risk alarm state within a unit time is obtained and marked as the measured value during the risk alarm, and the average of all the measured values ​​of the storage hidden dangers of the corresponding storage device within a unit time is calculated to obtain the storage hidden danger performance value, and a set of preset importance coefficients corresponding to each storage device is set in advance; wherein, the higher the importance level of the corresponding storage device, the greater the value of the preset importance coefficient matching it, and the values ​​of the preset importance coefficients are all positive numbers;

[0053] The risk alarm measurement value NP, the storage hidden danger performance value GS and the preset importance coefficient α are numerically calculated by the formula LP=α*(uy1*NP+uy2*GS) to obtain the hidden danger decision coefficient LP; wherein uy1 and uy2 are preset proportional coefficients with values ​​greater than zero, and the larger the value of the hidden danger decision coefficient LP is, the greater the storage risk of the corresponding storage device is in general;

[0054] The hidden danger decision coefficient is numerically compared with the preset hidden danger decision coefficient threshold. If the hidden danger decision coefficient exceeds the preset hidden danger decision coefficient threshold, it indicates that the storage risk of the corresponding storage device is relatively large overall, and a storage high hidden danger signal is generated; if the hidden danger decision coefficient does not exceed the preset hidden danger decision coefficient threshold, it indicates that the storage risk of the corresponding storage device is relatively small overall, and a storage low hidden danger signal is generated.

[0055] Furthermore, the storage risk decision module is in communication connection with the storage performance degradation analysis module, and the storage performance degradation analysis module predicts and analyzes the storage performance degradation status of the corresponding storage device, and obtains the performance risk value FM of the corresponding storage device through analysis;

[0056] And sending the performance risk value FM of the corresponding storage device to the storage hidden danger decision module can not only reasonably predict the performance degradation degree of the corresponding storage device, but also provide data support for the analysis process of the storage hidden danger decision module to ensure the accuracy of its analysis results; the specific analysis process of the storage performance degradation analysis module is as follows:

[0057] The production date of the corresponding storage device is collected, and the interval between the current date and its production date is marked as the storage device production time value, and the total time that the corresponding storage device is in the risk alarm state in the historical stage is marked as the total risk alarm time value;

[0058] The total number of maintenance optimizations performed on the corresponding storage device in the historical stage is collected and marked as the maintenance optimization frequency, and the number of occurrences when the interval duration between two adjacent groups of maintenance optimizations exceeds the preset interval duration threshold is marked as the maintenance excellence table value;

[0059] By formula The storage device production time value FW, the total risk alarm time value FN, the maintenance optimization frequency FL and the maintenance excellence table value FS are numerically calculated to obtain the performance risk value FM of the corresponding storage device; among them, sw1, sw2, sw3, and sw4 are preset proportional coefficients whose values ​​are greater than zero, and when the value of the performance risk value FM is too large, it indicates that the performance of the corresponding storage device is likely to be seriously degraded.

[0060] Embodiment 3: Figure 2 As shown, the difference between this embodiment and the first and second embodiments is that the visualization supervision module is connected to the file export monitoring module in communication, and the file export monitoring module monitors the export of enterprise information, and determines the export risk before the user exports the corresponding file through the export device, and generates an export high risk signal or an export low risk signal accordingly;

[0061] When a low-risk export signal is generated, the user is allowed to export the corresponding file. When a high-risk export signal is generated, the user is not allowed to export the corresponding file. The high-risk export signal or the low-risk export signal is sent to the visual supervision module, so that the supervisor can grasp the export status of the enterprise information in detail and ensure the export security of the enterprise information. The analysis process of the file export monitoring module is as follows:

[0062] Before an enterprise user exports a corresponding file through an export device (such as a computer device, etc.), the user's identity is verified (identity verification methods include fingerprint verification, facial recognition authentication, mobile phone verification code verification, etc.) to determine whether the user has the authority to export the corresponding file. If the user does not have the authority to export the corresponding file, a high-risk export signal is generated;

[0063] If the user has the authority to export the corresponding file, determine whether the corresponding export device is a registered device (register the export device in advance, mark the export device that has completed registration in the enterprise as a registered device, and the export device that has not been registered as an unregistered device). If the corresponding export device is an unregistered device, generate an export high risk signal;

[0064] If the corresponding export device is a registered device, the corresponding export device is scanned and analyzed, and the corresponding export device is scanned by a virus vulnerability scanning tool to identify the virus vulnerability of the export device. If there is no virus vulnerability in the export device, a low-risk export signal is generated;

[0065] If there are virus vulnerabilities in the export device, the identified virus vulnerabilities are classified, and a set of preset risk weight values ​​corresponding to each type of virus vulnerability is set in advance, wherein the values ​​of the preset risk weight values ​​are all positive numbers, and the greater the security risks brought by the corresponding type of virus vulnerability, the greater the value of the preset risk weight value matching it; the product of the number of the corresponding type of virus vulnerabilities and the corresponding preset risk weight value is marked as the virus vulnerability class inspection value;

[0066] And the virus vulnerability class detection values ​​of all types of virus vulnerabilities existing in the corresponding export device are summed up to calculate the scanning risk coefficient, and the scanning risk coefficient is numerically compared with the preset scanning risk coefficient threshold. If the scanning risk coefficient exceeds the preset scanning risk coefficient threshold, it indicates that the scanning risk of the corresponding export device is high, which is not conducive to ensuring the security of the exported files, and an export high-risk signal is generated; if the scanning risk coefficient does not exceed the preset scanning risk coefficient threshold, it indicates that the scanning risk of the corresponding export device is low, and an export low-risk signal is generated.

[0067] Furthermore, when a user exports a corresponding file, the file export monitoring module records the user information, file information, export device information, export time, etc. and sends them to the visualization supervision module, and sets a detection period, preferably, the detection period is seven days; the number of file exports of the corresponding user during the detection period and the amount of exported file data are marked as file pilot value and file pilot inspection value respectively;

[0068] The file pilot value YS and the file inspection value YM are numerically calculated by the formula YL=wq1*YS+wq2*YM to obtain the user suspicious coefficient YL, wherein wq1 and wq2 are preset proportional coefficients, wq1>wq2>0; and the larger the value of the user suspicious coefficient YL, the more suspicious the export behavior of the corresponding user during the detection period;

[0069] The user suspicion coefficient YL is numerically compared with the preset user suspicion coefficient threshold. If the user suspicion coefficient YL exceeds the preset user suspicion coefficient threshold, it indicates that the export behavior of the corresponding user during the detection period is suspicious. The corresponding user is marked as a suspicious user and sent to the visual supervision module. The supervisor promptly inquires and investigates the corresponding suspicious user to further ensure the export security of corporate information.

[0070] The working principle of the present invention is as follows: when in use, security data is collected from various security devices, network devices and application systems in the enterprise network through the data acquisition and processing module and data preprocessing is performed; the big data analysis module uses big data analysis technology to analyze the preprocessed data to identify potential security risks; the enterprise information security assessment module evaluates the security of enterprise information based on the results of big data analysis to generate a security assessment report; the visualization supervision module visualizes the security assessment report; the risk defense module takes corresponding defense measures according to the security assessment report to ensure the security of enterprise information; and the storage risk decision module performs risk monitoring and analysis on all storage devices; when a storage high risk signal is generated, regulation and processing measures are taken for the corresponding storage device to ensure the safe and stable operation of all storage devices and reduce the storage risk of the stored enterprise information; and the file export monitoring module monitors the export of enterprise information, judges the export risk and issues a timely warning before the user exports the corresponding file through the export device, so as to further ensure the export security of enterprise information.

[0071] The above formulas are all dimensionless and numerical calculations. The formula is a formula obtained by collecting a large amount of data and performing software simulation to obtain the most recent real situation. The preset parameters in the formula are set by technicians in this field according to actual conditions. The preferred embodiments of the present invention disclosed above are only used to help explain the present invention. The preferred embodiments do not describe all the details in detail, nor do they limit the invention to only specific implementation methods. Obviously, many modifications and changes can be made according to the contents of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the present invention, so that technicians in the relevant technical field can understand and use the present invention well. The present invention is only limited by the claims and their full scope and equivalents.

Claims

1. Enterprise information security management system based on big data analysis, characterized by: It includes data collection and processing module, big data analysis module, enterprise information security assessment module, risk defense module and visual supervision module; the data collection and processing module collects security data from various security devices, network devices and application systems in the enterprise network, cleans, converts the format and standardizes the collected data, and sends the pre-processed data packets to the big data analysis module; The big data analysis module uses big data analysis technology to analyze the pre-processed data to identify potential security risks, and sends the analysis results to the enterprise information security assessment module; The enterprise information security assessment module evaluates the security of enterprise information based on the results of big data analysis to generate a security assessment report, and the visual supervision module visualizes the security assessment report; The risk defense module takes corresponding defense measures according to the security assessment report and sends the defense operation information to the visual supervision module for display.

2. The enterprise information security management system based on big data analysis according to claim 1 is characterized in that: The analysis operations of the big data analysis module include attack detection, vulnerability mining and malicious code detection.

3. The enterprise information security management system based on big data analysis according to claim 1 is characterized in that: The visualization supervision module is connected to the storage hidden danger decision module and the file export monitoring module in communication. The storage hidden danger decision module performs risk monitoring and analysis on all storage devices to generate a storage high hidden danger signal or a storage low hidden danger signal for the corresponding storage device. The file export monitoring module monitors the export of enterprise information, determines the export risk before the user exports the corresponding file through the export device, and generates a high-risk export signal or a low-risk export signal accordingly.

4. The enterprise information security management system based on big data analysis according to claim 3 is characterized in that: The specific operation process of the storage risk decision module includes: Obtaining the performance risk value of the corresponding storage device, if the performance risk value exceeds the preset performance risk threshold, generating a storage high risk signal; If the performance risk value does not exceed the preset performance risk threshold, the measured value at the time of risk alarm, the stored hidden danger performance value and the preset importance coefficient are numerically calculated to obtain the hidden danger decision coefficient. If the hidden danger decision coefficient exceeds the preset hidden danger decision coefficient threshold, a high hidden danger signal is generated and stored; if the hidden danger decision coefficient does not exceed the preset hidden danger decision coefficient threshold, a low hidden danger signal is generated and stored.

5. The enterprise information security management system based on big data analysis according to claim 4 is characterized in that: The storage hidden danger decision module is communicatively connected to the storage performance degradation analysis module. The storage performance degradation analysis module predicts and analyzes the storage performance degradation status of the corresponding storage device to obtain the performance risk value of the corresponding storage device, and sends the performance risk value of the corresponding storage device to the storage hidden danger decision module.

6. The enterprise information security management system based on big data analysis according to claim 5 is characterized in that: The specific analysis process of the storage performance degradation analysis module is as follows: The performance risk value of the corresponding storage device is obtained by numerically calculating the storage device production time value, total risk alarm time value, maintenance optimization frequency and maintenance excellence table value.

7. The enterprise information security management system based on big data analysis according to claim 3 is characterized in that: The analysis process of the file export monitoring module is as follows: Before the user exports the corresponding file through the export device, if the user does not have the authority to export the corresponding file, an export high risk signal is generated; if the user has the authority to export the corresponding file, it is determined whether the corresponding export device is a registered device, and if the corresponding export device is an unregistered device, an export high risk signal is generated; If the corresponding export device is a registered device, a scan analysis is performed on the corresponding export device to generate an export high risk signal or an export low risk signal through the scan analysis.

8. The enterprise information security management system based on big data analysis according to claim 7 is characterized in that: The specific analysis process of scanning and analyzing the corresponding export devices is as follows: Scan the corresponding export device with a virus vulnerability scanning tool to identify the virus vulnerability of the export device. If there is no virus vulnerability in the export device, a low-risk export signal is generated; If there is a virus vulnerability in the export device, the virus vulnerability class detection values ​​of all types of virus vulnerabilities existing in the corresponding export device are summed up to obtain a scanning risk coefficient. If the scanning risk coefficient exceeds a preset scanning risk coefficient threshold, an export high risk signal is generated; If the scan risk factor does not exceed the preset scan risk factor threshold, a low risk signal is generated.

9. The enterprise information security management system based on big data analysis according to claim 7 is characterized in that: The operation process of the file export monitoring module also includes: When the user exports the corresponding file, the user information, file information, export device information and export time are recorded. If the user's suspicious coefficient exceeds the preset user suspicious coefficient threshold, the corresponding user will be marked as a suspicious user and sent to the visual supervision module.

Images