Network information security defense detection method and system

Abstract

The invention discloses a network information security defense detection method and system, and relates to the technical field of network information security, and the system comprises a website security check module, a downloading security check module, an access security check module and a display execution module. In daily Internet surfing, net friends often encounter network security problems, for example, users may receive phishing mails disguised as banks or download malicious software in untrusted websites, resulting in data stealing. Identity embezzlement and data leakage increase privacy and financial risks, and man-in-the-middle attack may intercept sensitive information through an unencrypted Wi-Fi network. According to the method, security detection including domain name check, certificate verification, content scanning, integrity verification and the like is carried out on websites, downloading programs and external access equipment, so that security risks are found and processed in time; and meanwhile, by adopting a virtual machine isolation technology and behavior monitoring, the protection on malicious programs is enhanced, the security risk of external equipment is evaluated, and the security of a network environment and data is ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of network information security, and in particular to a network information security defense detection method and system. Background Art

[0002] Modern network information security defense detection systems combine advanced technologies such as big data analysis, artificial intelligence, and threat intelligence. By monitoring network traffic, user behavior, and system logs in real time, they establish accurate baseline behavior patterns and can quickly identify abnormal activities. These systems use a multi-layered defense architecture, from network boundaries to internal networks, to terminal devices and application layers, to form a comprehensive security barrier. In addition, the system also integrates global threat intelligence and updates defense strategies in a timely manner to respond to evolving network threats, ensuring that they can still quickly detect and respond to zero-day attacks and advanced persistent threats (APTs), thereby minimizing potential security risks.

[0003] However, when surfing the Internet on a daily basis, netizens will encounter a variety of network information security problems, including phishing attacks, malware, identity theft, data leakage and man-in-the-middle attacks. For example, users may receive phishing emails disguised as banks, asking them to update their account information, or download malware when browsing untrusted websites, resulting in data theft. Identity theft and data leakage further increase users' privacy and financial risks, while man-in-the-middle attacks may intercept sensitive information through unencrypted public Wi-Fi networks. These threats emphasize the importance of modern network information security defense detection systems, which provide users with a strong protection barrier through advanced technology and real-time response capabilities, ensuring that users' data and privacy can be protected to the greatest extent in the face of various complex network security threats. Summary of the invention

[0004] The purpose of the present invention is to solve the above-mentioned problems and to provide a network information security defense detection method and system.

[0005] The purpose of the present invention can be achieved through the following technical solutions:

[0006] In a first aspect, the present invention provides a network information security defense detection method, comprising:

[0007] Step 1: Perform network information security detection on the browsed website to obtain the website security value, and compare it with the preset threshold to display the security percentage;

[0008] Step 2: Perform network information security detection on the downloaded installation program. The specific process is as follows:

[0009] S201: Verify the integrity of the downloaded file: Use a digital signature or hash value to verify whether the downloaded file has been tampered with. If the hash value is inconsistent, a tampering alarm is triggered;

[0010] S202: Start the virtual machine isolation test: Use the virtualization tool to start the securely configured virtual machine, create an initial snapshot, and ensure isolation from the host network;

[0011] S203: Monitor the installation of the program: install the program with standard user privileges in the virtual machine, monitor the changes of files and registry in real time, calculate the change of file size and the change of registry value, calculate the comprehensive value, and compare it with the preset threshold. If the threshold is exceeded, trigger the installation alarm;

[0012] S204: analyzing the growth of the program: calculating the abnormal growth coefficient of the program to analyze the abnormality of resource usage growth. If the abnormal growth coefficient exceeds a preset threshold, an abnormal growth alarm is triggered;

[0013] Step 3: Perform network information security detection on external access data. The specific process is as follows:

[0014] When accessing external devices, the security risk factors of external access devices are determined by calculating the security risks of the external access devices, and the device connection type risk factor, operating system vulnerability density risk factor, malware infection probability, data encryption coverage and network behavior abnormality rate are obtained; each risk factor is weighted and summed according to different weights to obtain a security risk value; the security risk value is then matched with the preset interval; if the security risk value belongs to interval one, the current security measures are maintained and monitored regularly; if the security risk value FXZ belongs to interval two, the security measures of the device are strengthened, and it is updated and tested regularly.

[0015] As a preferred implementation of the present invention, the specific process of performing network information security detection on the browsed website to obtain the website security value is as follows:

[0016] S101: Check the domain name and URL of the browsed website: Use the threat intelligence library to check the visited domain name and URL. If it is related to a known malicious or phishing website, issue a warning and record it as a threat value of L1. If there is no correlation, check whether there are suspicious characters or overly long subdomains in the URL. If so, issue a warning and record it as L1.

[0017] S102: Verify the HTTPS certificate of the browsed website: verify the certificate authority and the validity of the certificate. If the certificate is untrustworthy or expired / revoked, issue a warning and record it as the authentication value L2 and the validity value L3 respectively;

[0018] S103: Scan the website content of the browsed website: Use a tool to check whether the website contains malicious code or suspicious plug-ins. If so, warn and record it as content scanning value L4; otherwise, run the dynamic content in the sandbox, if there is abnormality or maliciousness, warn and record it as L4;

[0019] S104: Calculate the website security value to obtain the website security value, compare it with the preset threshold value, and display the security percentage for the user to decide.

[0020] As a preferred implementation of the present invention, the specific process of calculating the website security value to obtain the website security value WZZ is:

[0021] Obtain corresponding values ​​generated by the information security warning, including: threat value L1, authentication value L2, validity value L3 and content scanning value L4; perform comprehensive calculation on the corresponding values, and output the website security value WZZ through the set weighted calculation formula: WZZ=L1k×a1+L2×a2+L3×a3+L4×a4, wherein a1, a2, a3 and a4 are preset weights corresponding to the threat value, authentication value, validity value and content scanning value, respectively, and a1+a2+a3+a4=1; if no corresponding value is generated, the corresponding value is 0, and if the browsing website does not contain malicious code, script or suspicious plug-in, and there is no abnormality or malice, the content scanning value L4=0.

[0022] As a preferred implementation of the present invention, the specific process of monitoring the installation of the program is as follows:

[0023] Run the installer in the virtual machine with standard user privileges, follow the installation wizard provided by the program, and record the installation path, options, and user interactions; after the program is installed, monitor and record the files created, modified, or deleted during the installation process in real time, and track the registry changes during the installation process, perform before-and-after comparisons, and identify newly added or modified registry entries; for changes in file size, use the established formula: Output file size change value ΔF, S 新 , S 旧 They are the file sizes before and after installation; for the registry value changes: Output the modification amplitude value of the registry value change ΔR, V 新 is the latest value of the registry key, V 旧 is the original value of the registry key, W F is the weight factor;

[0024] The file size change amplitude value ΔF is combined with the modification amplitude value ΔR of the registry value change, and the comprehensive amplitude value ZFZ is output through the established formula: ZFZ=ΔF×b1+ΔR×b2, where b1 and b2 are the corresponding preset correction factors respectively.

[0025] As a preferred embodiment of the present invention, the specific process of the abnormal growth coefficient AGC of the calculation program is:

[0026] Calculation formula: Output abnormal growth coefficient AGC, where ΔR t is the change in resource usage (such as memory or CPU) within the time interval T, μ R is the historical average change in resource use, σ R is the historical standard deviation of resource use changes, used to measure the normal fluctuation range; ΔR t By regularly monitoring and recording the resource usage values ​​of the program at different time points R t , calculate the resource change in each time interval T, through the formula: ΔR t =R t+T -R t ; Then use historical data to calculate the average value of resource usage change μ R and standard deviation σ R , through the formula Where n is the number of samples of historical data.

[0027] As a preferred implementation of the present invention, the specific process of obtaining the device connection type risk factor, the operating system vulnerability density risk factor, the malware infection probability, the data encryption coverage rate and the network behavior abnormality rate is as follows:

[0028] Calculate the device connection type risk factor YZ1, set the wired connection risk factor YZ1 to 0.1, and the wireless connection risk factor YZ1 to 0.3; calculate the operating system vulnerability density risk factor YZ2, the vulnerability density is the ratio of the number of known vulnerabilities of the operating system version to the number of installations of that version of the operating system Calculate the malware infection probability YZ3 to determine whether the device is at risk of malware infection based on the device's historical records, known malware samples, and security measures; directly obtain the device's historical probability of being infected as the malware infection probability YZ3; calculate the data encryption coverage YZ4 to calculate the proportion of encrypted data stored on the device: Calculate the network behavior abnormality rate YZ5, and calculate the abnormal traffic ratio through the device's network traffic data:

[0029] As a preferred embodiment of the present invention, the specific process of obtaining the security risk value FXZ by weighted summing up the risk factors according to different weights is as follows:

[0030] The risk factors are weighted and summed according to different weights to obtain the preset weight of each factor; through the set formula: Output the security risk value FXZ, where cj is the preset weight of the jth factor, and m=5.

[0031] In a second aspect, the present invention provides a network information security defense detection system, including: a website security inspection module, a download security inspection module, an access security inspection module and a display execution module;

[0032] The website security inspection module performs security checks on websites browsed by users, mainly by checking the website's domain name and URL, verifying the credibility of the HTTPS certificate, scanning the website to see if it contains malicious code or suspicious plug-ins, and finally generating and outputting the website's security assessment results;

[0033] The download security module verifies the integrity of files downloaded by users to ensure that the files have not been tampered with. It uses virtual machines to isolate and monitor the installation process, track file and registry changes, and calculate potential security risks.

[0034] The access security inspection module analyzes the security risks when external devices are connected to the system, calculates the device connection type, operating system vulnerabilities, malware infection risk factors, and comprehensively calculates the security risk value of the device;

[0035] The display execution module is responsible for displaying the evaluation results of each security detection module by displaying security alerts and risk values.

[0036] Compared with the prior art, the present invention has the following beneficial effects:

[0037] 1. The present invention combines a multi-level detection mechanism and a comprehensive computing system to effectively identify and respond to various network threats. Through security detection of browsing websites, downloading installation programs, and external access devices, the present invention uses domain name and URL checks, HTTPS certificate verification, content scanning, file integrity verification, etc. to ensure that different types of security risks are discovered and handled in a timely manner; at the same time, combined with virtual machine isolation technology and behavior monitoring, it prevents malicious programs from directly endangering the host system, thereby improving the overall security protection capabilities.

[0038] 2. The present invention calculates the security risk value of the device by analyzing the security of external access devices, taking into account multiple risk factors, such as connection type, operating system vulnerabilities, malware infection probability, etc., and takes corresponding protective measures according to different risk levels; through abnormal behavior analysis and resource usage growth monitoring, the present invention enhances the ability to prevent unknown threats and ensures the security of the network environment and the protection of data. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to facilitate understanding by those skilled in the art, the present invention is further described below with reference to the accompanying drawings.

[0040] Figure 1 It is a diagram of the method steps of the present invention;

[0041] Figure 2 It is a principle block diagram of the present invention. DETAILED DESCRIPTION

[0042] The technical solution of the present invention will be clearly and completely described below in conjunction with the embodiments. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0043] Example 1

[0044] See also Figure 1 As shown, a network information security defense detection method includes:

[0045] Step 1: Perform network information security detection on the website you browse. The specific process is as follows:

[0046] S101: Check the domain name and URL of the browsed website: Use the threat intelligence library to match the visited domain name and URL to detect whether it is related to a known malicious or phishing website. If it is related to a known malicious or phishing website, directly issue an information security warning, match the corresponding preset value one, and record it as the threat value L11; if it is not related, use the corresponding tool to identify whether the URL contains suspicious characters or an overly long subdomain name, indicating that it is a feature of a phishing or malicious website; if it contains suspicious characters or an overly long subdomain name, issue an information security warning, and similarly, match the corresponding preset value two, and record it as the threat value L12;

[0047] S102: Verify the HTTPS certificate of the browsed website: first verify the certificate authority to ensure that the HTTPS certificate is issued by a trusted certificate authority (CA); then check the validity of the certificate to check whether the certificate is expired or revoked, and whether the domain name is consistent with the actual access domain name; if the HTTPS certificate is verified to be issued by an untrusted certificate authority (CA), an information security warning is issued, matching the corresponding preset value three, recorded as the authentication value L2; if the validity check shows that the certificate is expired or revoked, an information security warning is issued, matching the corresponding preset value four, recorded as the validity value L3;

[0048] S103: Scan the website content of the browsed website: Use a security scanning tool to detect whether the website contains malicious code, scripts or suspicious plug-ins; if the browsed website contains malicious code, scripts or suspicious plug-ins, an information security warning is issued, matching the corresponding preset value of five, recorded as the content scanning value L4; otherwise, the dynamic content of the website is run in a sandbox environment to observe whether its behavior is abnormal or malicious; if there is abnormality or maliciousness, an information security warning is issued, and similarly, recorded as the content scanning value L4;

[0049] S104: When obtaining the information security warning, the corresponding values ​​generated include: threat value L1, authentication value L2, validity value L3 and content scanning value L4; and the corresponding values ​​are comprehensively calculated, and the website security value WZZ is output through the set weighted formula: WZZ=L1k×a1+L2×a2+L3×a3+L4×a4, wherein a1, a2, a3 and a4 are the preset weights corresponding to the threat value, authentication value, validity value and content scanning value, respectively, and a1+a2+a3+a4=1, k=1 or 2; if the corresponding value is not generated, the corresponding value is 0, for example, when the browsing website does not contain malicious code, script or suspicious plug-in, and there is no abnormality or malice, the content scanning value L4=0; then the website security value WZZ is compared with the preset website security threshold to obtain the percentage of the website security value WZZ to the preset website security threshold, which is recorded as the website security percentage, and the website security percentage is displayed in a pop-up window on the display unit, and the user makes a decision;

[0050] Step 2: Perform network information security detection on the downloaded installation program. The specific process is as follows:

[0051] S201: Use the provided digital signature or hash value to verify the integrity of the downloaded file to ensure that the file has not been tampered with: obtain the digital signature or hash value (such as SHA-256 or MD5) associated with the downloaded file from a trusted source; the hash value is usually provided on the file download page or in the official documentation; perform hash calculation on the downloaded file, and use a hash tool or command line (such as shasum, md5sum) to generate the hash value of the file; compare the calculated hash value with the original hash value obtained from the trusted source, if the two hash values ​​are consistent, it means that the file is complete and has not been tampered with; on the contrary, if the two hash values ​​are inconsistent, it means that the file has been tampered with or an error occurred during the download process, and a network security tampering alarm and display are issued; if the user insists on downloading, proceed to the next step;

[0052] S202: Start an isolated virtual machine: First, select a reliable virtualization tool, such as VMware, VirtualBox, or Hyper-V, and install a securely configured operating system. At the same time, ensure that the virtual machine is isolated from the host network through NAT mode or disconnecting the network; create an initial snapshot before running any program to record the initial state of the virtual machine, and properly save the snapshot to provide protection for subsequent system recovery;

[0053] S203: running the installation program with standard user privileges in the virtual machine, following the installation wizard provided by the program, and recording the installation path, options, and user interactions;

[0054] After the program is installed, it monitors and records in real time the files created, modified, or deleted during the installation process, and tracks the registry changes during the installation process, compares before and after, and identifies the newly added or modified registry entries; through the established formula, for the changes in file size: Output file size change amplitude value ΔF, where S 新 , S 旧 They are the file sizes before and after installation; for the registry value changes: Output the modification amplitude value ΔR of the registry value change, where V 新 is the latest value of the registry key, V 旧 is the original value of the registry key, W F is the weight factor, reflecting the influence of different factors on the change; W F is a weight set according to different factors, W F =W 安装 +W 设置 +W 驱动 +W 恶意软件 +W 用户操作 +W 崩溃 +W 自动化 +W 配置 +W 清理 , and each weight represents the influence of the corresponding factor, and its value range is between 0 and 1, reflecting the importance of the factor to the change of the registry entry. The specific value is set by relevant technicians in this field;

[0055] The file size change amplitude value ΔF is combined with the registry value change modification amplitude value ΔR, and the comprehensive amplitude value ZFZ is output through the established formula: ZFZ = ΔF × b1 + ΔR × b2, where b1 and b2 are respectively the corresponding preset correction factors; and the comprehensive amplitude value ZFZ is compared with the preset amplitude threshold. If the comprehensive amplitude value ZFZ is greater than the preset amplitude threshold, it means that there are files created, modified or deleted after the program is installed, there are registry changes, and a network security installation alarm and display are performed; proceed to the next step;

[0056] S204: Perform growth analysis (including potential growth analysis) on the downloaded or installed program. The specific process is as follows:

[0057] Calculate the abnormal growth coefficient of the program. The abnormal growth coefficient AGC is used to evaluate whether the growth of resource usage is abnormal. The calculation formula is: Output abnormal growth coefficient AGC, where ΔR t is the change in resource usage (such as memory or CPU) within the time interval T, μ R is the historical average change in resource use, σ R is the historical standard deviation of resource use changes, used to measure the normal fluctuation range; ΔR t By regularly monitoring and recording the resource usage values ​​of the program at different time points R t , calculate the resource change in each time interval T, through the formula: ΔR t =R t+T -R t ; Then use historical data to calculate the average value of resource usage change μ R and standard deviation σ R , through the formula Where n is the number of samples of historical data;

[0058] The abnormal growth coefficient AGC is compared with the preset normal growth threshold. If the abnormal growth coefficient AGC is greater than the preset normal growth threshold, it is determined to be abnormal growth, and an abnormal growth alarm and display are performed;

[0059] Step 3: Perform network information security detection on external access data. The specific process is as follows:

[0060] External access data includes: external network access data and external device access data;

[0061] When accessing the external network, the corresponding alarm is obtained through analysis of the above steps 1 and 2.

[0062] When connecting to external devices, the security risks of external connected devices are calculated, specifically:

[0063] S301: Determine the security risk factor of the external access device; the security risk factor of each external access device is composed of multiple different technical indicators, including: device connection type risk factor YZ1, operating system vulnerability density risk factor YZ2, malware infection probability YZ3, data encryption coverage rate YZ4 and network behavior abnormality rate YZ5;

[0064] Calculate the risk factor YZ1 of the device connection type, set the risk factor YZ1 of wired connection to 0.1, and the risk factor YZ1 of wireless connection to 0.3; if the device uses other connection methods, define the risk factor according to the actual situation.

[0065] Calculate the operating system vulnerability density risk factor YZ2. The vulnerability density is the ratio of the number of known vulnerabilities in an operating system version to the number of installations of that version of the operating system: The higher the vulnerability density is set, the higher the risk factor of the device;

[0066] Calculate the malware infection probability YZ3. Whether the device is at risk of malware infection is mainly based on the device's historical records, known malware samples, and security protection measures. Directly obtain the device's historical probability of infection as the malware infection probability YZ3.

[0067] Calculate the data encryption coverage YZ4 and calculate the percentage of encrypted data stored on the device: If the encryption coverage is low, it means the security risk of the device is high;

[0068] Calculate the network behavior anomaly rate YZ5 (whether the device has abnormal network behavior, such as frequent communication with external unauthorized IP addresses, access to unknown or sensitive resources, etc.), and calculate the proportion of abnormal traffic through the device's network traffic data:

[0069] S302: Perform weighted summation on each risk factor according to different weights to obtain the preset weight of each factor; by setting the formula: Output the security risk value FXZ, where cj is the preset weight of the jth factor, j=1, 2, 3, 4, 5; then match the obtained security risk value FXZ with the preset intervals, which include interval 1, interval 2, and interval 3; if the security risk value FXZ belongs to interval 1, maintain the current security measures and monitor regularly; if the security risk value FXZ belongs to interval 2, strengthen the security measures of the equipment, and update and test regularly;

[0070] If the security risk value FXZ belongs to interval three, isolation, in-depth inspection and other measures will be taken immediately to prevent potential threats, and abnormal data will be alarmed and displayed.

[0071] Example 2

[0072] See also Figure 2 As shown, a network information security defense detection system includes: a website security inspection module, a download security inspection module, an access security inspection module and a display execution module;

[0073] The website security inspection module performs security checks on websites browsed by users, mainly by checking the website's domain name and URL, verifying the credibility of the HTTPS certificate, scanning the website to see if it contains malicious code or suspicious plug-ins, and finally generating and outputting the website's security assessment results;

[0074] The download security module verifies the integrity of files downloaded by users to ensure that the files have not been tampered with. It uses virtual machines to isolate and monitor the installation process, track file and registry changes, calculate potential security risks, and ensure that the program installation process does not pose a threat to the system.

[0075] The access security inspection module analyzes the security risks when external devices are connected to the system, calculates multiple risk factors such as device connection type, operating system vulnerabilities, malware infection, etc., and comprehensively calculates the security risk value of the device to determine whether security protection measures need to be taken;

[0076] The display execution module is responsible for displaying the evaluation results of each security detection module. By displaying security alerts and risk values, it helps users to understand the system security status in a timely manner and make corresponding decisions and countermeasures based on the displayed security information.

[0077] The preferred embodiments of the present invention disclosed above are only used to help explain the present invention. The preferred embodiments do not describe all the details in detail, nor do they limit the invention to only specific implementation methods. Obviously, many modifications and changes can be made according to the content of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the present invention, so that those skilled in the art can understand and use the present invention well. The present invention is limited only by the claims and their full scope and equivalents.

Claims

1. A network information security defense detection method, characterized in that: include: Step 1: Perform network information security detection on the browsed website to obtain the website security value, and compare it with the preset threshold to display the security percentage; Step 2: Perform network information security detection on the downloaded installation program. The specific process is as follows: S201: Verify the integrity of the downloaded file: Use a digital signature or hash value to verify whether the downloaded file has been tampered with. If the hash value is inconsistent, a tampering alarm is triggered; S202: Start the virtual machine isolation test: Use the virtualization tool to start the securely configured virtual machine, create an initial snapshot, and ensure isolation from the host network; S203: Monitor the installation of the program: install the program with standard user privileges in the virtual machine, monitor the changes of files and registry in real time, calculate the change of file size and the change of registry value, calculate the comprehensive value, and compare it with the preset threshold. If the threshold is exceeded, trigger the installation alarm; S204: analyzing the growth of the program: calculating the abnormal growth coefficient of the program to analyze the abnormality of resource usage growth. If the abnormal growth coefficient exceeds a preset threshold, an abnormal growth alarm is triggered; Step 3: Perform network information security detection on external access data. The specific process is as follows: When accessing external devices, the security risk factors of external access devices are determined by calculating the security risks of the external access devices, and the risk factors of device connection type, operating system vulnerability density, malware infection probability, data encryption coverage, and network behavior abnormality rate are obtained; each risk factor is weighted and summed according to different weights to obtain the security risk value; Then match the security risk value with the preset interval; if the security risk value belongs to interval one, maintain the current security measures and monitor regularly; if the security risk value FXZ belongs to interval two, strengthen the security measures of the equipment, update and test regularly.

2. A network information security defense detection method according to claim 1, characterized in that: The specific process of performing network information security detection on the browsed website to obtain the website security value is as follows: S101: Check the domain name and URL of the browsed website: Use the threat intelligence library to check the visited domain name and URL. If it is related to a known malicious or phishing website, a warning will be issued and recorded as a threat value L1; If there is no correlation, check whether there are suspicious characters or too long subdomains in the URL. If so, warn and record it as L1; S102: Verify the HTTPS certificate of the browsed website: verify the certificate authority and the validity of the certificate. If the certificate is untrustworthy or expired / revoked, issue a warning and record it as the authentication value L2 and the validity value L3 respectively; S103: Scan the website content of the browsed website: Use a tool to check whether the website contains malicious code or suspicious plug-ins. If so, warn and record it as content scanning value L4; otherwise, run the dynamic content in the sandbox, if there is abnormality or maliciousness, warn and record it as L4; S104: Calculate the website security value to obtain the website security value, compare it with the preset threshold value, and display the security percentage for the user to decide.

3. A network information security defense detection method according to claim 2, characterized in that: The specific process of calculating the website security value to obtain the website security value WZZ is as follows: Obtain the corresponding values ​​generated by the information security warning, including: threat value L1, authentication value L2, validity value L3 and content scanning value L4; perform weighted calculation on the corresponding values ​​to output the website security value. If no corresponding value is generated, the corresponding value is zero.

4. A network information security defense detection method according to claim 1, characterized in that: The specific process of monitoring the installation of the program is as follows: Run the installer in the virtual machine with standard user privileges, follow the installation wizard provided by the program, and record the installation path, options, and user interactions; after the program is installed, monitor and record the files created, modified, or deleted during the installation process in real time, and track registry changes during the installation process, perform before-and-after comparisons, and identify newly added or modified registry entries; for changes in file size: Output file size change value ΔF, S 新 , S 旧 They are the file sizes before and after installation; for the registry value changes: Output the modification amplitude value of the registry value change ΔR, V 新 is the latest value of the registry key, V 旧 is the original value of the registry key, W F is the weight factor; The file size change amplitude value ΔF and the registry value change modification amplitude value ΔR are output as a comprehensive amplitude value ZFZ through the established formula: ZFZ=ΔF×b1+ΔR×b2, where b1 and b2 are the corresponding preset correction factors respectively.

5. A network information security defense detection method according to claim 1, characterized in that: The specific process of the abnormal growth coefficient AGC of the calculation program is: Calculation formula: Output abnormal growth coefficient AGC, where ΔR t is the change in resource usage within the time interval T, μ R is the historical average change in resource use, σ R is the historical standard deviation of resource use changes, used to measure the normal fluctuation range; ΔR t By regularly monitoring and recording the resource usage values ​​of the program at different time points R t , calculate the resource change in each time interval T, through the formula: ΔR t =R t+T -R t ; Then use historical data to calculate the average value of resource usage change μ R and standard deviation σ R , through the formula Where n is the number of samples of historical data.

6. A network information security defense detection method according to claim 1, characterized in that: The specific process of obtaining the device connection type risk factor, the operating system vulnerability density risk factor, the malware infection probability, the data encryption coverage rate and the network behavior abnormality rate is as follows: Calculate the device connection type risk factor YZ1, set the wired connection risk factor YZ1 to 0.1, and the wireless connection risk factor YZ1 to 0.3; calculate the operating system vulnerability density risk factor YZ2, the vulnerability density is the ratio of the number of known vulnerabilities of the operating system version to the number of installations of that version of the operating system Calculate the malware infection probability YZ3 to determine whether the device is at risk of malware infection based on the device's historical records, known malware samples, and security measures; directly obtain the device's historical probability of being infected as the malware infection probability YZ3; calculate the data encryption coverage YZ4 to calculate the proportion of encrypted data stored on the device: Calculate the network behavior abnormality rate YZ5, and calculate the abnormal traffic ratio through the device's network traffic data:

7. A network information security defense detection method according to claim 1, characterized in that: The specific process of obtaining the security risk value FXZ by weighted summing up each risk factor according to different weights is as follows: The risk factors are weighted and summed according to different weights to obtain the preset weight of each factor; through the set formula: Output the security risk value FXZ, where cj is the preset weight of the jth factor, and m=5.

8. A network information security defense detection system, characterized in that: Applied to implement any one of claims 1-7 of the network information security defense detection method, the system comprises: a website security inspection module, a download security inspection module, an access security inspection module and a display execution module; The website security check module performs security checks on websites browsed by users, mainly by checking the website's domain name and URL, verifying the credibility of the HTTPS certificate, scanning the website to see if it contains malicious code or suspicious plug-ins, and finally generating and outputting the website's security assessment results; The download security module verifies the integrity of files downloaded by users to ensure that the files have not been tampered with. It uses virtual machines to isolate and monitor the installation process, track file and registry changes, and calculate potential security risks. The access security inspection module analyzes the security risks when external devices are connected to the system, calculates the device connection type, operating system vulnerabilities, malware infection risk factors, and comprehensively calculates the security risk value of the device; The display execution module is responsible for displaying the evaluation results of each security detection module by displaying security alerts and risk values.

Images