Information management method and system based on network security

Abstract

The invention discloses an intelligence management method and system based on network security, and relates to the technical field of network security, and the method comprises the steps: setting a firewall between a client network and a server network; performing encryption processing on the key data by using a key encryption algorithm; carrying out virus detection and intrusion detection, and applying an intrusion detection technology and vulnerability scanning in a server network; user identity verification is carried out, a user login process is designed, and login operation of the user is controlled and managed; tracking and positioning the source of the security problem; corresponding server network data processing authority is given to the user; double servers and a disk array are adopted for data storage, and the data are automatically backed up every preset backup cycle. The information collection module and the information management module are arranged to effectively block illegal invasion and virus spreading programs, so that the safety of user information and information is protected, and the confidentiality of the information in the transmission and storage process is ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to an intelligence management method and system based on network security. Background Art

[0002] The world's major developed countries have always attached great importance to intelligence work, and regard it as an important means to maintain the level of national defense science and technology and improve the effectiveness of weapons and equipment. They have invested a lot of manpower, material and financial resources to strengthen intelligence management and establish an intelligence management system that is both coordinated with the national science and technology intelligence system and relatively independent. At the same time, they have adopted various measures to strengthen the effective management of intelligence work plans, policies, projects, and supervision.

[0003] With the rapid development of information networks, intelligence management methods have gradually shifted from traditional manual methods to network methods. This shift has brought many conveniences, such as improved work efficiency and resource sharing. However, networking has also brought severe security challenges. Illegal intrusions, virus transmission, data leakage and other problems have emerged in an endless stream, seriously threatening the security of user information and data. Therefore, how to ensure the security of intelligence management methods has become an urgent problem to be solved. Summary of the invention

[0004] In order to solve the above technical problems, a network security-based intelligence management method and system are provided. This technical solution solves the problems raised in the above background technology.

[0005] In order to achieve the above purpose, the technical solution adopted by the present invention is: A network security-based intelligence management method, comprising: Set up a firewall between the client network and the server network to block illegal intrusion and spread of virus programs, and protect the security of user information and data; Use key encryption algorithms to encrypt key data to ensure confidentiality during data transmission and storage. The key data includes user passwords, user IP information, and access records. Conduct virus detection and intrusion detection, and use intrusion detection technology and vulnerability scanning in the server network to promptly detect and respond to potential security threats; Before users access the network, perform user identity authentication, design user login processes, and control and manage user login operations; Record the user's login time and login station name information, and output it as the user's access record. When a security problem occurs in the system, the source of the security problem can be tracked and located by querying the access records of all users; The server network grants users corresponding server network data processing permissions based on their departments and work requirements; All data in the server network is stored on the server, using dual servers and disk arrays for data storage, and the data is automatically backed up every preset backup cycle.

[0006] Preferably, the setting of a firewall between the client network and the server network to block illegal intrusion and spread of virus programs and protect the security of user information and data specifically includes: Set up a packet filtering firewall to filter packets based on their source address, destination address, port number, and protocol type; Set up a stateful inspection firewall to obtain the state information of data packets by checking the data packets themselves and the correlation between data packets; Set up an application layer firewall, which controls network traffic at the application layer; Define trusted and untrusted zones, define the server network as the trusted zone and the client network as the untrusted zone; Set up access control policies to allow only HTTP and HTTP Security protocols to pass through the firewall when data is transferred from the untrusted zone to the trusted zone; Enable the logging function of the firewall to record all traffic and events passing through the firewall; Use real-time monitoring tools to monitor and alarm the status of the firewall in real time.

[0007] Preferably, the key data is encrypted using a key encryption algorithm to ensure the confidentiality of the data during transmission and storage, specifically including: Use a one-way encryption algorithm to encrypt user passwords. Only encryption operations can be performed, not decryption operations. Store encrypted user passwords in the database to deny unauthorized access; When a user logs in, it is determined whether the password entered by the user is consistent with the stored encrypted ciphertext after being encrypted using a one-way encryption algorithm. If so, the user is allowed to access; if not, the user is denied access. Use an asymmetric encryption algorithm to encrypt user IP information, perform encryption operations through a preset public key, and use the corresponding private key for decryption operations; During data transmission, encrypted user IP information is used for communication; Store the encrypted user IP information in the database for subsequent analysis and auditing; Use a symmetric encryption algorithm to encrypt access records, and use the same key for encryption and decryption operations; The encrypted access records are stored in the database.

[0008] Preferably, the virus detection and intrusion detection, and the use of intrusion detection technology and vulnerability scanning in the server network to timely discover and respond to potential security threats specifically include: Collect relevant information of the server network, including IP address, domain name and service port information; Configure the intrusion detection process based on system requirements and network environment; Set up intrusion detection rules, which describe various malicious behaviors and attack features in the historical database; Configure alarm thresholds. When network traffic, number of connections, or abnormal behavior exceeds the preset alarm thresholds, the system triggers an alarm. Intrusion detection systems monitor network traffic and system logs in real time; Through feature matching technology, based on intrusion detection rules, malicious attack behaviors in data groups are detected and recorded; Analyze historical log data, discover changes in attack trends and conduct event statistics, and adjust security policies in real time; When a potential intrusion activity is detected, the intrusion detection system generates an alarm message, which includes an audible alarm and an email alarm; Determine the targets for vulnerability scanning, which may be individual hosts, applications, or entire server networks; Collecting target related information, including IP address, domain name, network topology, operating system type and service port; Select vulnerability scanning tools based on scanning objectives and requirements; Configure the scanning mode to passive scanning, set the scanning range, and specify the scanning strategy; Start a vulnerability scanning tool to scan. The scanning tool sends a request to the target and checks the response status of the target to find potential vulnerabilities, including operating system vulnerabilities, application program vulnerabilities and configuration errors; Generates a vulnerability report detailing the scan results, discovered vulnerabilities, risk assessment, and recommended remediation actions.

[0009] Preferably, the recording of the user's login time and login station name information and outputting it as the user's access record, when a security problem occurs in the system, by querying the access records of all users, the source of the security problem is tracked and located specifically including: In the system design, the user's login time and login station name information are recorded through the information filled in by the user when logging into the system and the information automatically obtained by the system; When a user logs into the system, he needs to enter his username and password. At the same time, the system automatically records the date and time when the user logs in, obtains the user's IP address and resolves it to the corresponding site name; The user's login time and login station name information is stored in the system's database as part of the user's access record; When a security problem occurs in the system, the system administrator and security personnel can track and locate the source of the security problem by querying the access records of each user. The security problem includes data leakage and illegal access. By analyzing the user's access records, abnormal user operations are obtained, and the abnormal user operations include illegal login attempts, abnormal access time and location.

[0010] Preferably, storing all the data of the server network on the server, using dual servers and a disk array for data storage, and automatically backing up the data every preset backup period specifically includes: Introduce two servers to form a master-slave load balancing architecture; The master server is responsible for processing daily data read and write requests, and the slave server serves as a backup for data backup and failover; When the main server fails, the slave server quickly takes over the service to ensure network continuity and data availability; Adopt disk array technology to combine multiple physical disks into a logical disk group to improve data storage performance; Select data redundancy and performance optimization strategies based on the disk array level; The first-level disk array provides data mirroring to ensure complete data redundancy; The five-level disk array provides data distribution and verification, improving read and write performance and fault tolerance; Set the backup cycle based on the update frequency and importance of the data; During the backup cycle, the server network automatically performs backup operations and backs up the current data to the specified disk array.

[0011] Furthermore, a network security-based intelligence management system is proposed, which is used to implement the network security-based intelligence management method as described above, including: Intelligence collection module, which is used to set up a firewall between the client network and the server network to block illegal intrusion and spread of virus programs, protect the security of user information and data, encrypt key data using a key encryption algorithm to ensure the confidentiality of data during transmission and storage, perform virus detection and intrusion detection, and use intrusion detection technology and vulnerability scanning in the server network to promptly discover and respond to potential security threats, perform user identity authentication before users access the network, design user login processes, and control and manage user login operations; Intelligence management module, the intelligence management module is used to record the user's login time and login station name information, and output it as the user's access record. When a security problem occurs in the system, the source of the security problem is tracked and located by querying the access records of all users. The server network grants users corresponding server network data processing permissions based on user departments and work requirements, stores all server network data on the server, uses dual servers and disk arrays for data storage, and automatically backs up data every preset backup cycle.

[0012] Optionally, the intelligence management module specifically includes: A source tracking unit, which is used to record the user's login time and login station name information and output it as the user's access record. When a security problem occurs in the system, the source of the security problem is tracked and located by querying the access records of all users; The permission setting unit is used for granting the user corresponding server network data processing permissions according to the user's department and work requirements; The intelligence storage unit is used to store all the data of the server network on the server, using dual servers and disk arrays for data storage, and the data is automatically backed up every preset backup period.

[0013] Compared with the prior art, the present invention has the following beneficial effects: By setting up a firewall between the client network and the server network, illegal intrusions and the spread of virus programs can be effectively blocked, thereby protecting the security of user information and data. Using key encryption algorithms to encrypt key data can ensure the confidentiality of data during transmission and storage, and prevent the data from being obtained by unauthorized personnel. Virus detection and intrusion detection can promptly detect and respond to potential security threats, help reduce the risk of security vulnerabilities being exploited, and improve system security. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 The flowchart of the network security-based intelligence management method of the present invention is as follows; Figure 2 A flow chart of a method for setting a firewall between a client network and a server network of the present invention; Figure 3 This is a flow chart of a method for encrypting key data using a key encryption algorithm according to the present invention; Figure 4 A flow chart of the method for using intrusion detection technology and vulnerability scanning in a server network according to the present invention; Figure 5A flow chart of a method for tracking and locating the source of a security problem by querying access records of all users of the present invention; Figure 6 This is a flow chart of a method for storing data using dual servers and a disk array and automatically backing up data every preset backup period according to the present invention. DETAILED DESCRIPTION

[0015] The following description is used to disclose the present invention so that those skilled in the art can implement the present invention. The preferred embodiments described below are only examples, and those skilled in the art may think of other obvious variations.

[0016] Reference Figure 1 As shown, a network security-based intelligence management method includes: Set up a firewall between the client network and the server network to block illegal intrusion and spread of virus programs, and protect the security of user information and data; Use key encryption algorithms to encrypt key data to ensure confidentiality during data transmission and storage. The key data includes user passwords, user IP information, and access records. Conduct virus detection and intrusion detection, and use intrusion detection technology and vulnerability scanning in the server network to promptly detect and respond to potential security threats; Before users access the network, perform user identity authentication, design user login processes, and control and manage user login operations; Record the user's login time and login station name information, and output it as the user's access record. When a security problem occurs in the system, the source of the security problem can be tracked and located by querying the access records of all users; The server network grants users corresponding server network data processing permissions based on their departments and work requirements; All data in the server network is stored on the server, using dual servers and disk arrays for data storage, and the data is automatically backed up every preset backup cycle.

[0017] Reference Figure 2 As shown in the figure, a firewall is set up between the client network and the server network to block illegal intrusion and spread of virus programs, and to protect the security of user information and data. The specific details include: Set up a packet filtering firewall to filter packets based on their source address, destination address, port number, and protocol type; Set up a stateful inspection firewall to obtain the state information of data packets by checking the data packets themselves and the correlation between data packets; Set up an application layer firewall, which controls network traffic at the application layer; Define trusted and untrusted zones, define the server network as the trusted zone and the client network as the untrusted zone; Set up access control policies to allow only HTTP and HTTP Security protocols to pass through the firewall when data is transferred from the untrusted zone to the trusted zone; Enable the logging function of the firewall to record all traffic and events passing through the firewall; Use real-time monitoring tools to monitor and alarm the status of the firewall in real time.

[0018] Deploy packet filtering firewall devices at the boundary between the client network and the server network; deploy stateful inspection firewall devices, which can check the data packets themselves and the correlation between data packets; deploy application layer firewalls at the network boundary, which control network traffic at the application layer, and configure application layer firewalls to identify and filter specific application layer protocols and traffic; regularly update and review firewall rules to ensure that they adapt to the ever-changing network environment and security needs.

[0019] Reference Figure 3 As shown in the figure, key data is encrypted using a key encryption algorithm to ensure the confidentiality of data during transmission and storage. Specifically, the following steps are included: Use a one-way encryption algorithm to encrypt user passwords. Only encryption operations can be performed, not decryption operations. Store encrypted user passwords in the database to deny unauthorized access; When a user logs in, it is determined whether the password entered by the user is consistent with the stored encrypted ciphertext after being encrypted using a one-way encryption algorithm. If so, the user is allowed to access; if not, the user is denied access. Use an asymmetric encryption algorithm to encrypt user IP information, perform encryption operations through a preset public key, and use the corresponding private key for decryption operations; During data transmission, encrypted user IP information is used for communication; Store the encrypted user IP information in the database for subsequent analysis and auditing; Use a symmetric encryption algorithm to encrypt access records, and use the same key for encryption and decryption operations; The encrypted access records are stored in the database.

[0020] The characteristic of a one-way encryption algorithm is that it can only perform encryption operations, but cannot decrypt the original password from the encrypted ciphertext. The encrypted user password is stored in the database. Due to the irreversibility of the one-way encryption algorithm, even if the database is illegally accessed, it is difficult for the attacker to recover the original password from the encrypted password.

[0021] Reference Figure 4 As shown, virus detection and intrusion detection are performed, and intrusion detection technology and vulnerability scanning are used in the server network to timely discover and respond to potential security threats. Specifically, they include: Collect relevant information of the server network, including IP address, domain name and service port information; Configure the intrusion detection process based on system requirements and network environment; Set up intrusion detection rules, which describe various malicious behaviors and attack features in the historical database; Configure alarm thresholds. When network traffic, number of connections, or abnormal behavior exceeds the preset alarm thresholds, the system triggers an alarm. Intrusion detection systems monitor network traffic and system logs in real time; Through feature matching technology, based on intrusion detection rules, malicious attack behaviors in data groups are detected and recorded; Analyze historical log data, discover changes in attack trends and conduct event statistics, and adjust security policies in real time; When a potential intrusion activity is detected, the intrusion detection system generates an alarm message, which includes an audible alarm and an email alarm; Determine the targets for vulnerability scanning, which may be individual hosts, applications, or entire server networks; Collecting target related information, including IP address, domain name, network topology, operating system type and service port; Select vulnerability scanning tools based on scanning objectives and requirements; Configure the scanning mode to passive scanning, set the scanning range, and specify the scanning strategy; Start a vulnerability scanning tool to scan. The scanning tool sends a request to the target and checks the response status of the target to find potential vulnerabilities, including operating system vulnerabilities, application program vulnerabilities and configuration errors; Generates a vulnerability report detailing the scan results, discovered vulnerabilities, risk assessment, and recommended remediation actions.

[0022] Set the scanning mode to passive scanning to reduce the impact on the target system, set the scanning range, specify the ports and services to be scanned, and specify the scanning strategy based on the characteristics and security requirements of the target system.

[0023] Reference Figure 5 As shown, the user's login time and login station name information are recorded and output as the user's access record. When a security problem occurs in the system, the source of the security problem is tracked and located by querying the access records of all users. The specific details include: In the system design, the user's login time and login station name information are recorded through the information filled in by the user when logging into the system and the information automatically obtained by the system; When a user logs into the system, he needs to enter his username and password. At the same time, the system automatically records the date and time when the user logs in, obtains the user's IP address and resolves it to the corresponding site name; The user's login time and login station name information is stored in the system's database as part of the user's access record; When a security problem occurs in the system, the system administrator and security personnel can track and locate the source of the security problem by querying the access records of each user. The security problem includes data leakage and illegal access. By analyzing the user's access records, abnormal user operations are obtained, and the abnormal user operations include illegal login attempts, abnormal access time and location.

[0024] Illegal login attempts refer to multiple attempts to log into the same user account using incorrect passwords. A threshold is set and an alarm is triggered when a user fails to log in multiple times within a certain period of time. Abnormal access time and location refer to users logging in during non-working hours or at abnormal locations.

[0025] Reference Figure 6 As shown, all data of the server network is stored on the server, dual servers and disk arrays are used for data storage, and the data is automatically backed up every preset backup cycle, including: Introduce two servers to form a master-slave load balancing architecture; The master server is responsible for processing daily data read and write requests, and the slave server serves as a backup for data backup and failover; When the main server fails, the slave server quickly takes over the service to ensure network continuity and data availability; Adopt disk array technology to combine multiple physical disks into a logical disk group to improve data storage performance; Select data redundancy and performance optimization strategies based on the disk array level; The first-level disk array provides data mirroring to ensure complete data redundancy; The five-level disk array provides data distribution and verification, improving read and write performance and fault tolerance; Set the backup cycle based on the update frequency and importance of the data; During the backup cycle, the server network automatically performs backup operations and backs up the current data to the specified disk array.

[0026] The first-level disk array implements data mirroring, that is, all data is completely copied on two or more disks, providing the highest level of data protection, but the cost is higher and the storage space utilization is halved; the fifth-level disk array provides data distribution and verification, and at least one additional disk is required to store verification information. It can recover data when a single disk fails, while providing better read and write performance and higher storage space utilization.

[0027] Further, based on the same inventive concept as the above-mentioned network security-based intelligence management method, the present solution also proposes a network security-based intelligence management system, including: Intelligence collection module, which is used to set up a firewall between the client network and the server network to block illegal intrusion and spread of virus programs, protect the security of user information and data, encrypt key data using a key encryption algorithm to ensure the confidentiality of data during transmission and storage, perform virus detection and intrusion detection, and use intrusion detection technology and vulnerability scanning in the server network to promptly discover and respond to potential security threats, perform user identity authentication before users access the network, design user login processes, and control and manage user login operations; Intelligence management module, the intelligence management module is used to record the user's login time and login station name information, and output it as the user's access record. When a security problem occurs in the system, the source of the security problem is tracked and located by querying the access records of all users. The server network grants users corresponding server network data processing permissions based on user departments and work requirements, stores all server network data on the server, uses dual servers and disk arrays for data storage, and automatically backs up data every preset backup cycle.

[0028] The intelligence management module specifically includes: A source tracking unit, which is used to record the user's login time and login station name information and output it as the user's access record. When a security problem occurs in the system, the source of the security problem is tracked and located by querying the access records of all users; The permission setting unit is used for granting the user corresponding server network data processing permissions according to the user's department and work requirements; The intelligence storage unit is used to store all the data of the server network on the server, using dual servers and disk arrays for data storage, and the data is automatically backed up every preset backup period.

[0029] Furthermore, the present solution also proposes a computer-readable storage medium on which a computer-readable program is stored, and when the computer-readable program is called, the above-mentioned network security-based intelligence management method is executed.

[0030] It is understandable that the storage medium may be a magnetic medium, such as a floppy disk, a hard disk, or a magnetic tape; an optical medium, such as a DVD; or a semiconductor medium, such as a solid state drive (SSD).

[0031] To sum up, the advantages of the present invention are: by setting up a firewall between the client network and the server network, illegal intrusion and the spread of virus programs can be effectively blocked, thereby protecting the security of user information and data; by using a key encryption algorithm to encrypt key data, the confidentiality of the data during transmission and storage can be ensured, and the data can be prevented from being obtained by unauthorized personnel; virus detection and intrusion detection can timely discover and respond to potential security threats, help reduce the risk of security vulnerabilities being exploited, and improve the security of the system.

[0032] The above shows and describes the basic principles, main features and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The above embodiments and descriptions only describe the principles of the present invention. The present invention may be subject to various changes and improvements without departing from the spirit and scope of the present invention. These changes and improvements fall within the scope of the present invention. The scope of protection claimed by the present invention is defined by the attached claims and their equivalents.

Claims

1. A network security-based intelligence management method, characterized in that: include: Set up a firewall between the client network and the server network to block illegal intrusion and spread of virus programs, and protect the security of user information and data; Use key encryption algorithms to encrypt key data to ensure confidentiality during data transmission and storage. The key data includes user passwords, user IP information, and access records. Conduct virus detection and intrusion detection, and use intrusion detection technology and vulnerability scanning in the server network to promptly detect and respond to potential security threats; Before users access the network, perform user identity authentication, design user login processes, and control and manage user login operations; Record the user's login time and login station name information, and output it as the user's access record. When a security problem occurs in the system, the source of the security problem can be tracked and located by querying the access records of all users; The server network grants users corresponding server network data processing permissions based on their departments and work requirements; All data in the server network is stored on the server, using dual servers and disk arrays for data storage, and the data is automatically backed up every preset backup cycle.

2. The method for network security-based intelligence management according to claim 1, characterized in that: The firewall is set between the client network and the server network to block illegal intrusion and spread of virus programs, and protect the security of user information and data, specifically including: Set up a packet filtering firewall to filter packets based on their source address, destination address, port number, and protocol type; Set up a stateful inspection firewall to obtain the state information of data packets by checking the data packets themselves and the correlation between data packets; Set up an application layer firewall, which controls network traffic at the application layer; Define trusted and untrusted zones, define the server network as the trusted zone and the client network as the untrusted zone; Set up access control policies to allow only HTTP and HTTP Security protocols to pass through the firewall when data is transferred from the untrusted zone to the trusted zone; Enable the logging function of the firewall to record all traffic and events passing through the firewall; Use real-time monitoring tools to monitor and alarm the status of the firewall in real time.

3. The method for network security-based intelligence management according to claim 2, characterized in that: The key data is encrypted using a key encryption algorithm to ensure the confidentiality of the data during transmission and storage, specifically including: Use a one-way encryption algorithm to encrypt user passwords. Only encryption operations can be performed, not decryption operations. Store encrypted user passwords in the database to deny unauthorized access; When a user logs in, it is determined whether the password entered by the user is consistent with the stored encrypted ciphertext after being encrypted using a one-way encryption algorithm. If so, the user is allowed to access; if not, the user is denied access. Use an asymmetric encryption algorithm to encrypt user IP information, perform encryption operations through a preset public key, and use the corresponding private key for decryption operations; During data transmission, encrypted user IP information is used for communication; Store the encrypted user IP information in the database for subsequent analysis and auditing; Use a symmetric encryption algorithm to encrypt access records, and use the same key for encryption and decryption operations; The encrypted access records are stored in the database.

4. The method for network security-based intelligence management according to claim 3, characterized in that: The virus detection and intrusion detection mentioned above, and the use of intrusion detection technology and vulnerability scanning in the server network to timely discover and respond to potential security threats, specifically include: Collect relevant information of the server network, including IP address, domain name and service port information; Configure the intrusion detection process based on system requirements and network environment; Set up intrusion detection rules, which describe various malicious behaviors and attack features in the historical database; Configure alarm thresholds. When network traffic, number of connections, or abnormal behavior exceeds the preset alarm thresholds, the system triggers an alarm. Intrusion detection systems monitor network traffic and system logs in real time; Through feature matching technology, based on intrusion detection rules, malicious attack behaviors in data groups are detected and recorded; Analyze historical log data, discover changes in attack trends and conduct event statistics, and adjust security policies in real time; When a potential intrusion activity is detected, the intrusion detection system generates an alarm message, which includes an audible alarm and an email alarm; Determine the targets for vulnerability scanning, which may be individual hosts, applications, or entire server networks; Collecting target related information, including IP address, domain name, network topology, operating system type and service port; Select vulnerability scanning tools based on scanning objectives and requirements; Configure the scanning mode to passive scanning, set the scanning range, and specify the scanning strategy; Start a vulnerability scanning tool to scan. The scanning tool sends a request to the target and checks the response status of the target to find potential vulnerabilities, including operating system vulnerabilities, application program vulnerabilities and configuration errors; Generates a vulnerability report detailing the scan results, discovered vulnerabilities, risk assessment, and recommended remediation actions.

5. The method for network security-based intelligence management according to claim 4, characterized in that: The recording of the user's login time and login station name information and outputting it as the user's access record, when a security problem occurs in the system, by querying the access records of all users, the source of the security problem is tracked and located specifically including: In the system design, the user's login time and login station name information are recorded through the information filled in by the user when logging into the system and the information automatically obtained by the system; When a user logs into the system, he needs to enter his username and password. At the same time, the system automatically records the date and time when the user logs in, obtains the user's IP address and resolves it to the corresponding site name; The user's login time and login station name information is stored in the system's database as part of the user's access record; When a security problem occurs in the system, the system administrator and security personnel can track and locate the source of the security problem by querying the access records of each user. The security problem includes data leakage and illegal access. By analyzing the user's access records, abnormal user operations are obtained, and the abnormal user operations include illegal login attempts, abnormal access time and location.

6. The method for network security-based intelligence management according to claim 5, characterized in that: The method of storing all the data of the server network on the server, using dual servers and a disk array for data storage, and automatically backing up the data every preset backup period specifically includes: Introduce two servers to form a master-slave load balancing architecture; The master server is responsible for processing daily data read and write requests, and the slave server serves as a backup for data backup and failover; When the main server fails, the slave server quickly takes over the service to ensure network continuity and data availability; Adopt disk array technology to combine multiple physical disks into a logical disk group to improve data storage performance; Select data redundancy and performance optimization strategies based on the disk array level; The first-level disk array provides data mirroring to ensure complete data redundancy; The five-level disk array provides data distribution and verification, improving read and write performance and fault tolerance; Set the backup cycle based on the update frequency and importance of the data; During the backup cycle, the server network automatically performs backup operations and backs up the current data to the specified disk array.

7. An information management system based on network security, used to implement the information management method based on network security as described in any one of claims 1 to 6, characterized in that: include: Intelligence collection module, which is used to set up a firewall between the client network and the server network to block illegal intrusion and spread of virus programs, protect the security of user information and data, encrypt key data using a key encryption algorithm to ensure the confidentiality of data during transmission and storage, perform virus detection and intrusion detection, and use intrusion detection technology and vulnerability scanning in the server network to promptly discover and respond to potential security threats, perform user identity authentication before users access the network, design user login processes, and control and manage user login operations; Intelligence management module, the intelligence management module is used to record the user's login time and login station name information, and output it as the user's access record. When a security problem occurs in the system, the source of the security problem is tracked and located by querying the access records of all users. The server network grants users corresponding server network data processing permissions based on user departments and work requirements, stores all server network data on the server, uses dual servers and disk arrays for data storage, and automatically backs up data every preset backup cycle.

8. The network security-based intelligence management system according to claim 7, characterized in that: The intelligence management module specifically includes: A source tracking unit, which is used to record the user's login time and login station name information, and output it as the user's access record. When a security problem occurs in the system, the source of the security problem is tracked and located by querying the access records of all users; The permission setting unit is used for granting the user corresponding server network data processing permissions according to the user's department and work requirements; The intelligence storage unit is used to store all the data of the server network on the server, using dual servers and disk arrays for data storage, and the data is automatically backed up every preset backup period.

Images