A railway network security risk visualization analysis method and device

Abstract

The present invention provides a method and device for visual analysis of railway network security risks, and belongs to the field of railway network security technology. Under the constraints of the technical and industry standard specification system and the information security system organization, the prototype system of the railway information asset mapping platform adopts a service-oriented architecture design, and the overall architecture includes an infrastructure layer, a data layer, a system support layer, an application layer, and a presentation layer. Considering the scalability of the system, the data and business application system expansion network architecture is realized. The method for visual analysis of railway network security risks includes the following steps: locating the device for visual analysis of railway network security risks; using the device body to obtain and analyze railway network security risk data, and classifying the railway network security risk data into primary risk data, intermediate risk data, and advanced risk data. The method enables personnel with corresponding levels of authority to obtain corresponding analysis information.

Description

Technical Field

[0001] The present invention relates to the technical field of railway network security, and in particular to a method and device for visualizing and analyzing railway network security risks. Background Art

[0002] Under the constraints of the technical and industry standard system and the information security system, the prototype system of the railway information asset mapping platform adopts a service-oriented architecture design. The overall architecture includes the infrastructure layer, data layer, system support layer, application layer and presentation layer. Considering the scalability of the system, the data and business application system expansion network architecture is realized. The visualization analysis device of the prototype system of the railway information asset mapping platform is an analyzer, which is mainly used for massive data correlation analysis. Because the information involved is relatively scattered, the data structure may not be unified, and it is usually mainly manual analysis, coupled with the unstructured and uncertain analysis process, it is not easy to form a fixed analysis process or mode, and it is difficult to transfer the data into the application system for analysis and mining. With the help of a powerful visualization data analysis platform, manual operation can be assisted to analyze the data and make a complete analysis chart. The chart contains relevant information of all events, and also fully displays the process of data analysis and the direction of data chain. At the same time, these analysis charts can also be saved in other formats for relevant personnel to read. However, the existing visualization data analysis platform generally adopts the method of full display for display, and the risk data information with higher confidentiality level is easily obtained by personnel who do not have the corresponding authority level. Summary of the invention

[0003] The purpose of the present invention is to overcome the shortcomings of the prior art, adapt to actual needs, and provide a railway network security risk visualization analysis method to solve the above technical problems.

[0004] In the railway visualization prototype subsystem, enter the user name and password in the system interface, and click the "OK" button to enter the main interface of the system. In the drop-down list on the left, you can select different viewing contents, namely "Asset Ledger Management", "Asset Multi-Dimensional Portrait", "Asset Correlation Analysis" and "Asset Dynamic Panorama". Selecting different options can convert the display interface of the visualization model and the view on the right. Users can click on the model according to their needs to view the internal information of a certain layer of the model and update the data in the right view at the same time; users can click on the server of the model to view the current information of the server; users can adjust the transparency and select a certain business type to view the server location and business data under the same business in the model; users can click on the topology map option to jump to the topology map interface, and at the same time view the classification of the business in the topology map and its geographical location in the 3D model.

[0005] A railway network security risk visualization analysis method includes the following steps:

[0006] Step 1: Locate the railway network security risk visualization analysis device;

[0007] Step 2: Using the device body of the railway network security risk visualization analysis device to obtain and analyze railway network security risk data, and classify the railway network security risk data into primary risk data, intermediate risk data, and advanced risk data;

[0008] Step 3: Classify each type of risk data into hardware risk, software risk and human risk according to the nature of the event;

[0009] Step 4: assign different second security levels to hardware risk, software risk and human risk respectively;

[0010] Step 5: Graphically process the hardware risk and software risk in each type of risk data, and encrypt the human risk;

[0011] Step 6: Receive the input account information and compare and identify the first permission level to which the account information belongs;

[0012] Step 7: Capture one of primary risk data, intermediate risk data, or advanced risk data according to the first permission level;

[0013] Step 8: Identify the second permission level based on the account information, and capture and display one of the hardware risk, software risk or human risk based on the second permission level.

[0014] In one embodiment, before step one, the method further includes adding and storing account information, the account information including name, work number, address, first permission level and second permission level, wherein the first permission level is associated with the name, and the second permission level is associated with the first permission level.

[0015] In one embodiment, when the first authority level is missing, the account information is not stored, the second security level includes the first property level, the second property level and the third property level, and the hardware risk, software risk and human risk are respectively assigned the first property level, the second property level and the third property level.

[0016] In one embodiment, when the second authority level is missing, step eight is specifically: identify the second authority level based on the account information. If the second authority level information is missing, all hardware risks, software risks and human risks of a risk data category corresponding to the first authority level are displayed.

[0017] In one embodiment, step one is specifically: utilizing the movement of the auxiliary area increasing mechanism of the railway network security risk visualization analysis device to increase the support area of ​​the equipment body, and synchronously linking the gripping mechanism to move to realize the gripping action of the equipment body.

[0018] In one embodiment, the railway network security risk visualization analysis device includes an equipment body and an adjustment support handle, and the adjustment support handle is provided on the lower end of the equipment body, and an area enlargement mechanism is provided on the adjustment support handle, and the area enlargement mechanism includes a first mounting groove and a second mounting groove, and the first mounting groove and the second mounting groove are both opened on the adjustment support handle, and the first mounting groove and the second mounting groove are arranged in communication, and a pushing support assembly is fixedly connected to the side wall of the second mounting groove, and the free end of the pushing support assembly is fixedly connected to the side wall of the fixed block, the fixed block is fixedly set on the upper end surface of the L-shaped area enlargement plate, and the L-shaped area enlargement plate is matched with the first mounting groove, and the pushing support assembly includes a pushing support rod, a pushing support tube and a pushing support spring, the pushing support rod is movably inserted in the pushing support tube, the pushing support spring is wound and connected to the outside of the pushing support rod, and the two ends of the pushing support spring are respectively fixedly connected to the side wall of the pushing support rod and the outer wall of the pushing support tube.

[0019] In one embodiment, a locking mechanism is provided in the area enlargement mechanism, and the locking mechanism is used to lock the L-shaped area enlargement plate in the first mounting groove. The locking mechanism includes a locking groove and a locking plate. Two locking grooves are provided, and the two locking grooves are symmetrically arranged on the regulating support handle. The number of locking plates matches the number of locking grooves, and the locking plate is movably inserted in the third mounting groove. The third mounting groove is arranged on the fixed block, and the fixed block is provided with a mounting through hole. A pressing adjustment plate is movably arranged in the mounting through hole, and the pressing adjustment plate is fixedly arranged on the side wall of the locking plate. The side wall of the pressing adjustment plate is fixedly connected with a first support spring, and the free end of the first support spring is fixedly connected to the side wall of the mounting through hole.

[0020] In one embodiment, an auxiliary area increasing mechanism is provided in the area increasing mechanism, and the auxiliary area increasing mechanism is used to assist in increasing the area of ​​the L-shaped area increasing plate. The auxiliary area increasing mechanism includes a contact plate and a movable groove. There are two contact plates, and the two contact plates are symmetrically arranged on the side walls of the first mounting groove. The contact plate is slidably arranged in the movable groove, and the movable groove is opened on the L-shaped area increasing plate. A contact block is also slidably arranged in the movable groove, and a guide support assembly is arranged on the contact block. A driving assembly is arranged on the side wall of the contact block, and the free end of the driving assembly is connected to the auxiliary area increasing plate. The auxiliary area increasing plate is slidably arranged in the auxiliary movable groove opened on the L-shaped area increasing plate, and the side wall of the auxiliary movable groove is fixedly connected with a third support spring, and the free end of the third support spring is fixedly connected to the side wall of the auxiliary area increasing plate.

[0021] In one embodiment, the guide support assembly includes a guide support block, a guide support groove and a second support spring, the guide support block is fixedly arranged on the lower end surface of the interference block, and the guide support block is slidably arranged in the guide support groove opened on the bottom wall of the moving groove, the side wall of the guide support groove is fixedly connected with the second support spring, and the free end of the second support spring is fixedly connected to the side wall of the guide support block, the driving assembly includes a spur rack and a driving gear, the spur rack is fixedly arranged on the side wall of the interference block, and the spur rack is meshed with the driving gear, the driving gear is fixedly sleeved outside the inner spiral tube, and the outer sleeve of the inner spiral tube is provided with a support ring, the outer side wall of the support ring is fixedly connected with an L-shaped connecting rod, and the L-shaped connecting rod The free end is fixedly connected to the side wall of the movable groove, the inner thread of the inner spiral tube is inserted with an inner spiral rod, and the inner spiral rod is movably inserted in the movable through hole opened in the L-shaped area enlargement plate, an L-shaped connecting rod is fixedly sleeved outside the inner spiral rod, and the L-shaped connecting rod is fixedly arranged on the side wall of the auxiliary area enlargement plate, and a gripping mechanism is arranged in the auxiliary area enlargement mechanism, the gripping mechanism includes an arc-shaped gripping plate and a rotating support disk, the arc-shaped gripping plate is arranged on the circumference of the rotating support disk, and the rotating support disk is fixedly sleeved outside the rotating rod, the rotating rod is rotatably arranged in the rotating groove opened in the auxiliary area enlargement plate, a push-pull rod is also hinged on the circumference of the rotating support disk, and the free end of the push-pull rod is hinged on the top wall of the auxiliary movable groove.

[0022] The present invention also provides a railway network security risk visualization analysis device adopted by the railway network security risk visualization analysis method as described above.

[0023] During use, when the user inputs the account information into the railway network security risk visualization analysis device, the device body can capture one of the primary risk data, intermediate risk data or advanced risk data according to the first permission level associated with the account information, and then capture one of the hardware risk, software risk or human risk in the above risk data according to the second permission level associated with the account information and display it, so that the account risk authority can be divided into two levels. Specifically, according to the nature of the user's work (for example, if the user's work nature is a hardware engineer, hardware risk data is captured, if the user's work nature is a hardware engineer, software risk information is captured, and if the work type is an analysis engineer, human risk data is captured), according to the two-level permissions of the account, first determine to capture one of the primary risk data, intermediate risk data and advanced risk data, and then capture one of the hardware risk, software risk or human risk in the above risk data, thereby avoiding the information leakage risk brought by the first-level permission, realizing the refined management of railway network security risks, so that people who do not have the corresponding permission level cannot obtain information beyond the first permission level and the second permission level, reducing the management and control risks. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0025] Figure 1 A flowchart of the steps of a railway network security risk visualization analysis method according to an embodiment;

[0026] Figure 2 This is a schematic diagram of the structure of an embodiment of a railway network security risk visualization analysis device of the present invention;

[0027] Figure 3 The railway network security risk visualization analysis device of the present invention Figure 2 A schematic diagram of the partially enlarged structure;

[0028] Figure 4 The railway network security risk visualization analysis device of the present invention Figure 3 A schematic diagram of the partially enlarged structure;

[0029] Figure 6 The railway network security risk visualization analysis device of the present invention Figure 5 A partial enlarged view of the middle A;

[0030] Figure 7 The railway network security risk visualization analysis device of the present invention Figure 5 A partial enlarged view of point B in the middle;

[0031] Reference numerals:

[0032] 1: Equipment body; 2: Control support handle; 3: Area enlargement mechanism;

[0033] 4: Locking mechanism; 5: Auxiliary area enlargement mechanism; 6: Grip mechanism;

[0034] 31: first mounting slot; 32: second mounting slot; 33: push support assembly;

[0035] 34: fixing block; 35: L-shaped area enlargement plate; 41: locking groove; 42: locking plate;

[0036] 43: third mounting slot; 44: pressing adjustment plate; 45: mounting through hole;

[0037] 46: first support spring; 51: abutment plate; 52: moving slot; 53: abutment block;

[0038] 54: guide support assembly; 55: drive assembly; 56: auxiliary area enlargement plate;

[0039] 57: auxiliary moving groove; 58: third supporting spring; 61: arc-shaped gripping plate;

[0040] 62: rotating support plate; 63: rotating rod; 64: rotating slot; 65: push-pull rod;

[0041] 331: push the support rod; 332: push the support cylinder; 333: push the support spring;

[0042] 551: spur rack; 552: driving gear; 553: inner spiral tube;

[0043] 554: inner screw rod; 555: moving through hole; 556: supporting ring;

[0044] 557: L-shaped connecting rod; 558: connecting plate. DETAILED DESCRIPTION

[0045] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0046] Based on the security requirements for preventing security attacks, the security goals that need to be achieved, the security services required by the corresponding security mechanisms, and other factors, referring to international standards such as SSE-CMM ("System Security Engineering Capability Maturity Model") and ISO17799 (Information Security Management Standard), and in accordance with the requirements of the National Standard of the People's Republic of China GB / T 22240-2008, we comprehensively consider the feasibility, manageability, scalability, comprehensive completeness, system balance and other aspects. In the overall design process of the network security prevention system, we follow the following 6 principles.

[0047] The holistic principle of network information security

[0048] It is required that in the event of a network attack or destruction, the services of the network information center must be restored as quickly as possible to reduce losses. Therefore, the system provides security protection mechanisms, security detection mechanisms, and security recovery mechanisms. The security protection mechanism is a corresponding protective measure taken according to various security threats existing in the specific system to avoid illegal attacks. The security detection mechanism is to detect the operation of the system and promptly discover and stop various attacks on the system. The security recovery mechanism is to carry out emergency processing and restore information as much as possible and in a timely manner in the event of the failure of the security protection mechanism to reduce the degree of damage to the supply.

[0049] Safety evaluation and balance principle

[0050] Establish a reasonable and practical security and user demand evaluation and balance system. The security system design should correctly handle the relationship between demand, risk and cost, make security and availability compatible, and make it organizationally executable. There is no absolute evaluation standard or measurement indicator for evaluating whether information is secure. It can only be determined by the user needs of the system and the specific application environment, which depends on the scale and scope of the system, the nature of the system and the importance of the information.

[0051] Standardization and consistency principles

[0052] System construction is a huge system project, and the design of its security system must follow a series of standards to ensure that the entire system can be safely interconnected and information sharing can be achieved.

[0053] The principle of combining technology and management

[0054] The safety system is a complex system engineering, involving elements such as people, technology, and operation. It is impossible to achieve it by technology or management alone. Therefore, it is necessary to combine various safety technologies with operation management mechanisms, personnel ideological education and technical training, and the construction of safety regulations and systems.

[0055] Hierarchical principle

[0056] The hierarchical principle refers to the security hierarchy and security level. The system adopts the information system level two for relevant design, and provides comprehensive and optional security algorithms and security systems for different levels of security objects to meet various practical needs at different levels in the network.

[0057] Dynamic development principle

[0058] When designing system security, security measures must be continuously adjusted according to changes in network security to adapt to the new network environment, and the system design must meet new network security requirements.

[0059] Therefore, according to the system security principles, we carry out system security design from eight aspects: physical security, host security, network security, application system security, data security and backup and recovery, security management system, security management organization, and personnel safety management.

[0060] The following is combined with Figure 1-7 The present invention is further described with examples:

[0061] A railway network security risk visualization analysis method includes the following steps:

[0062] Step 1: Position the railway network security risk visualization analysis device, for example, on a desktop or workbench;

[0063] Step 2: Use the equipment body of the railway network security risk visualization analysis device to obtain and analyze the railway network security risk data, and classify the railway network security risk data into primary risk data, intermediate risk data and advanced risk data; for example, according to the severity of the harm that can be caused by the railway network security risk data, it is divided into primary risk data, intermediate risk data and advanced risk data. These three risk levels are the first safety level.

[0064] Step 3: Classify each type of risk data mentioned above into hardware risk, software risk and human risk according to the nature of the event; for example, hardware risk is hardware failure risk, fire risk or flood risk, etc. For example, software risk is software data storage risk, data crash risk, data error risk and logic error risk, etc. Human risk is virus risk, illegal access risk, visitor surge risk and out-of-domain visitor risk, etc.

[0065] Step 4: assign different second security levels to hardware risk, software risk and human risk respectively;

[0066] Step 5: Graphically process the hardware risk and software risk in each type of risk data, and encrypt the human risk; for example, encrypt the visitor's name, ID number, etc. of the human risk.

[0067] Step 6: Receive the input account information and compare and identify the first permission level to which the account information belongs;

[0068] Step 7: Capture one of primary risk data, intermediate risk data, or advanced risk data according to the first permission level;

[0069] Step 8: Identify the second permission level based on the account information, and capture and display one of the hardware risk, software risk or human risk based on the second permission level.

[0070] For example, the first security level includes primary level, intermediate level and advanced level, which correspond to capturing primary risk data, intermediate risk data and advanced risk data respectively. The second security level includes the first nature level, the second nature level and the third nature level, which assign the hardware risk, software risk and human risk to the first nature level, the second nature level and the third nature level respectively.

[0071] During use, when the user inputs the account information into the railway network security risk visualization analysis device, the device body can capture one of the primary risk data, intermediate risk data or advanced risk data according to the first permission level associated with the account information, and then capture one of the hardware risk, software risk or human risk in the above risk data according to the second permission level associated with the account information and display it, so that the account risk authority can be divided into two levels. Specifically, according to the nature of the user's work (for example, if the user's work nature is a hardware engineer, hardware risk data is captured, if the user's work nature is a hardware engineer, software risk information is captured, and if the work type is an analysis engineer, human risk data is captured), according to the two-level permissions of the account, first determine to capture one of the primary risk data, intermediate risk data and advanced risk data, and then capture one of the hardware risk, software risk or human risk in the above risk data, thereby avoiding the information leakage risk brought by the first-level permission, realizing the refined management of railway network security risks, so that people who do not have the corresponding permission level cannot obtain information beyond the first permission level and the second permission level, reducing the management and control risks.

[0072] For example, if the second authority level is the hardware level, the risk information corresponding to the first nature level will be captured; if the second authority level is the software level, the risk information corresponding to the second nature level will be captured; if the second authority level is the manual level, the risk information corresponding to the third nature level will be captured.

[0073] In one embodiment, before step 1, the process further includes adding and storing account information, the account information including name, work number, address, first permission level and second permission level, wherein the first permission level is associated with the name, and the second permission level is associated with the first permission level. In one embodiment, when the first permission level is missing, the account information is not stored. That is, each account information must determine the first permission level, but does not necessarily need to set the second permission level.

[0074] In one embodiment, when the second permission level is missing, step eight is specifically: identify the second permission level according to the account information, and if the second permission level information is missing, display all hardware risks, software risks and human risks of a risk data category corresponding to the first permission level. For example, when the nature of the manager's work is broad or global control, the three risks can be viewed at the same time.

[0075] In one embodiment, in order to improve the positioning effect of the equipment body, step one is specifically: utilizing the auxiliary area of ​​the railway network security risk visualization analysis device to increase the movement of the mechanism, increase the support area of ​​the equipment body, and synchronously link the gripping mechanism to move to realize the gripping action of the equipment body.

[0076] For example, in order to facilitate the implementation of the safety positioning effect and analysis and display effect of step one, the present invention also provides a railway network security risk visualization analysis device, which includes an equipment body 1 and an adjustment support handle 2. The lower end of the equipment body 1 is provided with an adjustment support handle 2, and the adjustment support handle 2 is provided with an area enlargement mechanism 3. In the present invention, the structure of the existing analyzer is improved, and the improved analyzer increases the area of ​​the support structure, so that the analyzer can be prevented from tipping over when placed. At the same time, the enlarged area can realize automatic adjustment, so that the device can be made easier to pick up through the adjustment effect.

[0077] In this embodiment, the area increasing mechanism 3 includes a first mounting groove 31 and a second mounting groove 32, and the first mounting groove 31 and the second mounting groove 32 are both provided on the regulating support handle 2, and the first mounting groove 31 and the second mounting groove 32 are connected and arranged, and a pushing support assembly 33 is fixedly connected to the side wall of the second mounting groove 32, and the free end of the pushing support assembly 33 is fixedly connected to the side wall of the fixing block 34, and the fixing block 34 is fixedly arranged on the upper end surface of the L-shaped area increasing plate 35, and the L-shaped area increasing plate 35 is matched with the first mounting groove 31. In the present invention, an area increasing mechanism 3 is added to the regulating support handle 2. The setting of the area increasing mechanism 3 can realize the increase of the area of ​​the regulating support handle 2, thereby preventing the device from tipping over when placed, and the structural design of the area increasing mechanism 3 is reasonable. During use, the adjustment function can be realized, so that the area of ​​the regulating support handle 2 can be increased by loosening, thereby preventing the device from tipping over, and it can also be recovered to facilitate the taking of the regulating support handle 2.

[0078] In this embodiment, the pushing support assembly 33 includes a pushing support rod 331, a pushing support tube 332 and a pushing support spring 333. The pushing support rod 331 is movably inserted in the pushing support tube 332, the pushing support spring 333 is wrapped and connected to the outside of the pushing support rod 331, and the two ends of the pushing support spring 333 are respectively fixedly connected to the side wall of the pushing support rod 331 and the outer side wall of the pushing support tube 332. The setting of the pushing support assembly 33 can not only play a guiding and supporting role for the movement of the L-shaped area enlargement plate 35, but also provide power for the pop-up of the L-shaped area enlargement plate 35.

[0079] In this embodiment, a locking mechanism 4 is provided in the area enlargement mechanism 3. The setting of the locking mechanism 4 can lock the L-shaped area enlargement plate 35 in the first installation groove 31. The locking mechanism 4 includes a locking groove 41 and a locking plate 42. Two locking grooves 41 are provided, and the two locking grooves 41 are symmetrically opened on the regulating support handle 2. The number of locking plates 42 is matched with the number of locking grooves 41. The locking plate 42 is movably plugged into the third installation groove 43. The third installation groove 43 is opened on the fixing block 34, and the fixing block 34 is provided with a mounting through hole 4 5. A pressing adjustment plate 44 is movably arranged in the installation through hole 45, and the pressing adjustment plate 44 is fixedly arranged on the side wall of the locking plate 42. A first supporting spring 46 is fixedly connected to the side wall of the pressing adjustment plate 44, and the free end of the first supporting spring 46 is fixedly connected to the side wall of the installation through hole 45. In the present invention, a locking mechanism 4 is additionally arranged in the area enlarging mechanism 3. The setting of the locking mechanism 4 can be used to lock the L-shaped area enlarging plate 35. Specifically, under the action of the locking mechanism 4, the L-shaped area enlarging plate 35 can be locked in the first installation groove 31.

[0080] In this embodiment, an auxiliary area increasing mechanism 5 is provided in the area increasing mechanism 3, and the auxiliary area increasing mechanism 5 is used to assist in increasing the area of ​​the L-shaped area increasing plate 35, so as to ensure that the device is placed more stably. The auxiliary area increasing mechanism 5 includes a contact plate 51 and a movable groove 52. There are two contact plates 51, and the two contact plates 51 are symmetrically arranged on the side walls of the first installation groove 31. The contact plate 51 is slidably arranged in the movable groove 52, and the movable groove 52 is opened on the L-shaped area increasing plate 35. A contact block 53 is also slidably arranged in the movable groove 52, and a guide support assembly 54 is arranged on the contact block 53. A driving assembly 55 is provided on the side wall of the abutment block 53, and the free end of the driving assembly 55 is connected to the auxiliary area enlargement plate 56, the auxiliary area enlargement plate 56 is slidably arranged in the auxiliary moving groove 57 provided on the L-shaped area enlargement plate 35, and the side wall of the auxiliary moving groove 57 is fixedly connected with a third support spring 58, and the free end of the third support spring 58 is fixedly connected to the side wall of the auxiliary area enlargement plate 56, the guide support assembly 54 includes a guide support block 541, a guide support groove 542 and a second support spring 543, the guide support block 541 is fixedly arranged on the lower end surface of the abutment block 53, and the guide support block 54 The guide support groove 542 is slidably arranged on the bottom wall of the moving groove 52, the side wall of the guide support groove 542 is fixedly connected with a second support spring 543, and the free end of the second support spring 543 is fixedly connected to the side wall of the guide support block 541, the driving assembly 55 comprises a spur rack 551 and a driving gear 552, the spur rack 551 is fixedly arranged on the side wall of the abutment block 53, and the spur rack 551 is meshed with the driving gear 552, the driving gear 552 is fixedly sleeved on the outside of the inner spiral tube 553, and the inner spiral tube 553 is movably sleeved with a support ring 556, and the outer wall of the support ring 556 is fixedly connected to the side wall of the abutment block 53. An L-shaped connecting rod 557 is connected, and the free end of the L-shaped connecting rod 557 is fixedly connected to the side wall of the movable groove 52. The inner spiral tube 553 is internally threaded with an inner spiral rod 554, and the inner spiral rod 554 is movably inserted into a movable through hole 555 opened on the L-shaped area enlargement plate 35. An L-shaped connecting rod 557 is fixedly sleeved outside the inner spiral rod 554, and the L-shaped connecting rod 557 is fixedly set on the side wall of the auxiliary area enlargement plate 56. In the present invention, an auxiliary area enlargement mechanism 5 is added, and the auxiliary area enlargement mechanism 5 is used to assist in increasing the area of ​​the L-shaped area enlargement plate 35, so as to better prevent the equipment from tipping over.

[0081] In this embodiment, a gripping mechanism 6 is provided in the auxiliary area enlargement mechanism 5, and the gripping mechanism 6 includes an arc-shaped gripping plate 61 and a rotating support plate 62. The arc-shaped gripping plate 61 is arranged on the circumference of the rotating support plate 62, and the rotating support plate 62 is fixedly sleeved outside the rotating rod 63, and the rotating rod 63 is rotatably arranged in a rotating groove 64 opened on the auxiliary area enlargement plate 56. A push-pull rod 65 is also hinged on the circumference of the rotating support plate 62, and the free end of the push-pull rod 65 is hinged on the top wall of the auxiliary movable groove 57. In the present invention, a gripping mechanism 6 is added. The setting of the gripping mechanism 6 can ensure that the equipment is better prevented from tipping over when placed by gripping the support table, and the structural design of the gripping mechanism 6 is reasonable, which can not only grip the support table, but also play a supporting role, so that the sagging force of the equipment body 1 can be buffered, thereby achieving a better effect of preventing tipping over.

[0082] The present invention also provides a method for using a railway network security risk visualization analysis device, comprising the following steps:

[0083] When the device needs to be placed, the support area of ​​the control support handle 2 and the platform can be increased to prevent the device from tipping over. Specifically:

[0084] Manually adjust the locking mechanism 4 so that the locking mechanism 4 completes the unlocking of the L-shaped area enlargement plate 35, ensuring that the L-shaped area enlargement plate 35 can move to the outside of the first installation slot 31 under the push of the push support assembly 33, thereby increasing the relative area of ​​the control support handle 2. Specifically, manually grasp and press the adjustment plate 44 so that the press adjustment plate 44 moves with the locking plate 42 into the third installation slot 43, thereby ensuring that the locking plate 42 moves to the outside of the locking slot 41. At this time, the locking mechanism 4 realizes the unlocking process, and the L-shaped area enlargement plate 35 can move to the outside of the first installation slot 31 under the push of the push support assembly 33. In this way, under the combined action of the L-shaped area enlargement plate 35 and the control support handle 2, the support area of ​​the analyzer can be increased, thereby preventing the analyzer from tipping over.

[0085] At the same time, during the movement of the L-shaped area enlargement plate 35, the auxiliary area enlargement mechanism 5 will be driven to move. The movement of the auxiliary area enlargement mechanism 5 will assist in increasing the area of ​​the L-shaped area enlargement plate 35. Specifically, during the movement of the L-shaped area enlargement plate 35 outward from the first mounting groove 31, the contact plate 51 will lose its contact with the contact block 53. In this way, under the pulling of the second supporting spring 543, the contact block 53 will be moved to the left through the guiding supporting block 541. The leftward movement of the contact block 53 will cause the inner spiral tube 553 to rotate through the spur rack 551 and the driving gear 552. The rotation of the inner spiral tube 553 will cause the inner spiral rod 554 to move outward from the moving through hole 555. In this way, under the action of the inner spiral rod 554, the auxiliary area enlargement plate 56 will be moved outward from the auxiliary moving groove 57 through the transverse connecting plate 558. Therefore, under the combination of the auxiliary moving groove 57 and the L-shaped area enlargement plate 35, the area of ​​the equipment can be further increased, thereby achieving a better anti-dumping effect.

[0086] In addition, while the auxiliary area increasing mechanism 5 assists in increasing the area, it will synchronously link the gripping mechanism 6 to move, ensuring that the gripping mechanism 6 can grip the ground, thereby better preventing the equipment from tipping over. Specifically, when the auxiliary area increasing plate 56 moves out of the auxiliary moving groove 57, it will push the rotating support plate 62 to rotate through the push-pull rod 65. The rotation of the rotating support plate 62 will cause the arc-shaped gripping plate 61 to rotate, and the rotation of the arc-shaped gripping plate 61 will grip the support platform.

[0087] The present invention also provides a railway network security risk visualization analysis device adopted by the above railway network security risk visualization analysis method.

[0088] Beneficial effects of the present invention:

[0089] The present invention improves the structure of the existing analyzer. The improved analyzer increases the area of ​​the supporting structure, thereby preventing the analyzer from tipping over when placed. At the same time, the increased area can achieve automatic adjustment, so that the device can be more convenient to pick up through the adjustment effect.

[0090] In the present invention, an area increasing mechanism 3 is added to the regulating support handle 2. The setting of the area increasing mechanism 3 can increase the area of ​​the regulating support handle 2, thereby preventing the device from tipping over when placed, and the structural design of the area increasing mechanism 3 is reasonable. During use, the regulating effect can be achieved. In this way, the area of ​​the regulating support handle 2 can be increased by loosening it, thereby preventing the device from tipping over, and it can also be recovered to facilitate the taking of the regulating support handle 2.

[0091] In the present invention, a locking mechanism 4 is added to the area enlargement mechanism 3 , and the setting of the locking mechanism 4 can be used to lock the L-shaped area enlargement plate 35 . Specifically, under the action of the locking mechanism 4 , the L-shaped area enlargement plate 35 can be locked in the first installation groove 31 .

[0092] In the present invention, an auxiliary area enlarging mechanism 5 is additionally provided, and the auxiliary area enlarging mechanism 5 is used to assist in increasing the area of ​​the L-shaped area enlarging plate 35, so as to better prevent the equipment from tipping over.

[0093] The present invention further provides a gripping mechanism 6, which can ensure that the device is better prevented from tipping over when placed by gripping the support table. The gripping mechanism 6 has a reasonable structural design, which can not only grip the support table, but also provide support, thereby buffering the downward force of the device body 1, thereby achieving a better effect of preventing tipping over.

[0094] The structural design of the present invention is reasonable. When the L-shaped area enlargement plate 35 moves out of the first installation groove 31, the auxiliary area enlargement mechanism 5 and the gripping mechanism 6 can be synchronously driven to move, which can reduce the operating difficulty of the equipment and ensure the high efficiency performance of the equipment.

[0095] In addition, the physical security design of the above system is designed from the perspectives of hardware equipment security, anti-theft and anti-destruction, lightning protection, fire prevention, waterproof and moisture-proof, anti-static, temperature and humidity control, power supply safety, and electromagnetic protection.

[0096] Hardware equipment safety: It is recommended that the National Climate Center select servers and network equipment with higher performance, and consider the stability and reliability of the equipment itself. The equipment should have the lowest environmental requirements, be earthquake-proof and moisture-proof, have low electromagnetic radiation, and be strong in anti-electromagnetic radiation interference and anti-static capabilities; have automatic protection capabilities against electrical shocks such as overvoltage, undervoltage, and overcurrent; and have good safety grounding.

[0097] Anti-theft and anti-vandalism:

[0098] It is recommended to place the main equipment in the machine room;

[0099] It is recommended to fix the equipment or main components and set obvious and difficult-to-remove marks;

[0100] It is recommended to classify and label the media and store them in a media library or archive room;

[0101] It is recommended to install necessary anti-theft alarm facilities in the main computer room.

[0102] Lightning protection:

[0103] It is recommended that lightning protection devices be installed in the computer room building;

[0104] It is recommended to install an AC power ground wire in the equipment room.

[0105] Fire protection:

[0106] It is recommended that the computer room be equipped with fire-fighting equipment and automatic fire alarm system.

[0107] Waterproof and moisture resistant:

[0108] It is recommended that water pipes should not be installed through the roof of the machine room or under the raised floor;

[0109] It is recommended to take measures to prevent rainwater from penetrating through the windows, roof and walls of the machine room;

[0110] Take measures to prevent condensation of water vapor in the machine room and the transfer and infiltration of underground water.

[0111] Anti-static:

[0112] It is recommended that necessary grounding and anti-static measures be adopted for key equipment.

[0113] Temperature and humidity control:

[0114] It is recommended that the computer room be equipped with automatic temperature and humidity adjustment facilities to ensure that changes in temperature and humidity in the computer room are within the range allowed by equipment operation.

[0115] Power supply safety:

[0116] It is recommended to configure voltage stabilizers and overvoltage protection devices on the power supply lines in the equipment room;

[0117] It is recommended to provide a short-term backup power supply to at least meet the normal operation requirements of key equipment in the event of a power outage.

[0118] Electromagnetic protection:

[0119] It is recommended that power cables and communication cables be laid separately to avoid mutual interference.

[0120] Host security:

[0121] Database system selection:

[0122] The system can use MySQL database to store data. We provide system security through the security mechanism provided by the database itself, which is mainly reflected in the following aspects:

[0123] Authentication: Only users who have passed database authentication can log in and use the database;

[0124] Access control: deny unauthorized access and prevent information leakage;

[0125] Auditability: It is recommended to use the audit function provided by the MySQL database to record operations on the database.

[0126] Semantic confidentiality: The data in the database is stored in encrypted form, so that even if illegal users obtain the data files, they cannot use them.

[0127] Identity Authentication:

[0128] When the system starts, the user must log in; each user is only given three login opportunities, and each user will be locked out for one day if the login fails;

[0129] The operating system and database system management user identities are not easily misused, and passwords are required to be complex and changed regularly.

[0130] Enable the login failure processing function, which can take measures such as ending the session, limiting the number of illegal logins, and automatically logging out;

[0131] It is recommended that when remotely managing a server, necessary measures be taken to prevent authentication information from being eavesdropped during network transmission.

[0132] Access Control:

[0133] It is recommended to enable the access control function to control user access to resources based on security policies;

[0134] It is recommended to separate the privileges of privileged users of the operating system and database system;

[0135] Limit access rights to default accounts, rename system default accounts, and change the default passwords for these accounts;

[0136] It is recommended to delete redundant and expired accounts in a timely manner to avoid the existence of shared accounts.

[0137] Security Audit:

[0138] The audit scope covers every operating system user and database user on the server;

[0139] The audit content includes important security-related events in the system, such as important user behaviors, abnormal use of system resources, and use of important system commands;

[0140] Audit records include the date, time, type, subject identification, object identification, and results of the event;

[0141] Protect audit records from unexpected deletion, modification, or overwriting.

[0142] Intrusion Prevention:

[0143] The operating system follows the principle of minimal installation, installing only required components and applications, and keeping system patches updated in a timely manner by setting up upgrade servers.

[0144] Resource Control:

[0145] The system records user login information by binding user IP and MAC;

[0146] Set the operation timeout lock of the login terminal according to the security policy;

[0147] Cybersecurity:

[0148] Network security is designed from the perspectives of network structure security, access control, firewall technology, intrusion prevention, and network equipment protection.

[0149] Network structure security:

[0150] Take full account of the existing network environment and ensure that the business processing capabilities of key network equipment have redundant space to meet the needs of business peak periods;

[0151] Ensure that the bandwidth of access networks and core networks meets the needs of business peak periods;

[0152] Draw a network topology diagram that matches the current operating conditions;

[0153] Access Control:

[0154] It is recommended to deploy access control devices at the network boundary and enable the access control function;

[0155] It is recommended to decide whether to allow or deny users to access resources of the controlled system based on the access rules between users and systems, with the control granularity being a single user.

[0156] Firewall Technology:

[0157] Firewall is currently an effective means of protecting the network from hacker attacks. Software firewalls are usually used in network environments.

[0158] Intrusion Prevention:

[0159] Monitor the following attack behaviors at the network boundary: port scanning, brute force attacks, Trojan backdoor attacks, denial of service attacks, buffer overflow attacks, IP fragmentation attacks, and network worm attacks, etc.

[0160] Network device protection:

[0161] It is recommended to authenticate the identity of users logging into network devices;

[0162] It is recommended to restrict the administrator login address of network devices;

[0163] The network device user's identification is unique;

[0164] Identity authentication information is not easily misused, and passwords must be complex and changed regularly;

[0165] It has a login failure processing function, which can take measures such as ending the session, limiting the number of illegal logins, and automatically logging out when the network login connection times out.

[0166] Application system security:

[0167] Application system security is designed from the perspectives of identity authentication, access control, security audit, communication confidentiality, system fault tolerance, and application system encryption.

[0168] Identity Authentication:

[0169] The system provides a dedicated login control module to identify and authenticate the logged-in users;

[0170] Provides user identity uniqueness and authentication information complexity check functions to ensure that there are no duplicate user identity identifiers in the system and that identity authentication information is not easily misused;

[0171] Provide login failure processing function, which can take measures such as ending the session, limiting the number of illegal logins and automatic logout;

[0172] Enable identity authentication, user identity uniqueness check, user identity authentication information complexity check, and login failure processing functions, and configure related parameters according to the security policy.

[0173] Access Control:

[0174] Provide access control function to control user access to files, database tables and other objects according to security policies;

[0175] The coverage of access control includes subjects, objects and operations between them related to resource access;

[0176] The access control policy is configured by the authorized subject, and the access rights of the default account are strictly limited;

[0177] Grant different accounts the minimum permissions required to complete their respective tasks and form a mutually restrictive relationship between them.

[0178] Security Audit:

[0179] Provide security auditing functions covering every user and audit important security events of the application system;

[0180] Ensure that audit records cannot be deleted, modified or overwritten;

[0181] The content of the audit record includes at least the event date, time, initiator information, type, description and results.

[0182] Communication confidentiality:

[0183] Before the two communicating parties establish a connection, the application system must perform initial verification of the user name, password and verification code;

[0184] Encrypt sensitive information during the communication process. For example, when the meteorological department and the land department are holding a consultation, the consultation documents are encrypted before uploading and downloading to prevent highly confidential data from being intercepted and used maliciously by others.

[0185] System fault tolerance:

[0186] Regarding data fault tolerance: first, prompts are given for data anomalies (such as data not arriving); second, the model with errors can be repaired and then backcalculated; third, the alternate data can be replaced by using yesterday's temperature to bring into today's monitoring data to calculate the drought monitoring index.

[0187] For functional fault tolerance, provide humanized error prompts, undo and restore operations, etc.

[0188] Provide data validity verification function to ensure that the format or length of data input through the human-machine interface or through the communication interface meets the system setting requirements;

[0189] When a failure occurs, the application system can continue to provide some functions to ensure that necessary measures can be implemented.

[0190] Data security and backup recovery:

[0191] Data security and backup and recovery are designed with security in mind, including data integrity, data confidentiality, data backup and recovery.

[0192] (1) Data integrity

[0193] It is recommended to use a dual-machine hot standby method with shared storage (disk array, English abbreviation RAID) to provide protection for data integrity. The shared storage method mainly provides data integrity and continuity after switching through the disk array. User data is generally placed on the disk array. When the host fails, the backup machine continues to obtain the original data from the disk array. This method generally has higher storage security. Therefore, if we ignore the case of storage device failure, this method is also the most widely used backup method in the industry.

[0194] (2) Data confidentiality

[0195] Since the network assets and network security data displayed in the system are confidential data of the unit, once leaked, they may be attacked by hackers or other organizations, causing network security problems. Therefore, all database data sources in the system support database-level security mechanisms, such as data access permission settings, database audit mechanisms, log tracking mechanisms, backup and recovery mechanisms and other security measures.

[0196] (3) Data backup and recovery

[0197] The database is the basis for the operation of C / S and B / S systems. The prototype system of the railway information asset mapping platform needs to operate efficiently and safely, so the system needs to provide a complete data recovery and backup mechanism. In the event of an emergency, the data required by the system can be quickly restored, and the files to be restored can be specified. The system provides two operations: manual backup, recovery, and scheduled backup.

[0198] The embodiments of the present invention disclose preferred embodiments, but are not limited thereto. A person skilled in the art can easily understand the spirit of the present invention based on the above embodiments and make different extensions and changes. However, as long as they do not deviate from the spirit of the present invention, they are all within the protection scope of the present invention.

Claims

1. A railway network security risk visualization analysis method, characterized in that: Under the constraints of technology and industry standards and information security system, a service-oriented architecture design is adopted. The overall architecture includes infrastructure layer, data layer, system support layer, application layer and presentation layer. The method includes the following steps: Step 1: Locate the railway network security risk visualization analysis device; Step 2: using the device body of the railway network security risk visualization analysis device to obtain and analyze railway network security risk data, and classify the railway network security risk data into primary risk data, intermediate risk data and advanced risk data; Step 3: Classify the risk data of each level mentioned above into hardware risk, software risk and human risk according to the nature of the event; Step 4: assigning different second security levels to the hardware risk, the software risk, and the human risk respectively; Step 5: Graphically process the hardware risk and the software risk in the risk data of each level respectively, and encrypt the human risk; Step 6: Receive the input account information and compare and identify the first permission level to which the account information belongs; Step 7: Capture one of the primary risk data, the intermediate risk data, or the advanced risk data according to the first authority level; and Step 8: Identify the second permission level according to the account information, and capture and display one of the hardware risk, the software risk or the human risk according to the second permission level.

2. The railway network security risk visualization analysis method according to claim 1 is characterized in that: Before step one, the method also includes adding and storing account information, wherein the account information includes name, work number, address, the first authority level and the second authority level, wherein the first authority level is associated with the name, and the second authority level is associated with the first authority level.

3. The railway network security risk visualization analysis method according to claim 2 is characterized in that: When the first authority level is missing, the account information is not stored, and the second security level includes the first property level, the second property level and the third property level, and the hardware risk, the software risk and the human risk are respectively assigned the first property level, the second property level and the third property level.

4. The railway network security risk visualization analysis method according to claim 3 is characterized in that: When the second authority level is missing, step eight is specifically: identify the second authority level based on the account information, if the second authority level information is missing, then display all hardware risks, software risks and human risks in the risk data category of the level corresponding to the first authority level.

5. The railway network security risk visualization analysis method according to claim 4 is characterized in that: Step one is specifically as follows: utilizing the movement of the auxiliary area enlarging mechanism of the railway network security risk visualization analysis device to increase the support area of ​​the equipment body, and synchronously linking the gripping mechanism to move to realize the gripping action of the equipment body.

6. The railway network security risk visualization analysis method according to claim 5 is characterized in that: The railway network security risk visualization analysis device comprises a device body (1) and a control support handle (2), wherein the lower end of the device body (1) is provided with a control support handle (2), and the control support handle (2) is provided with an area increasing mechanism (3), and the area increasing mechanism (3) comprises a first mounting groove (31) and a second mounting groove (32), wherein the first mounting groove (31) and the second mounting groove (32) are both provided on the control support handle (2), and the first mounting groove (31) and the second mounting groove (32) are arranged in communication, and a pushing support component (33) is fixedly connected to the side wall of the second mounting groove (32), and the free end of the pushing support component (33) is fixedly connected to the fixed The fixing block (34) is fixedly arranged on the upper end surface of the L-shaped area enlargement plate (35), and the L-shaped area enlargement plate (35) is matched with the first mounting groove (31). The pushing support assembly (33) includes a pushing support rod (331), a pushing support tube (332) and a pushing support spring (333). The pushing support rod (331) is movably inserted into the pushing support tube (332), and the pushing support spring (333) is wound and connected to the outside of the pushing support rod (331), and the two ends of the pushing support spring (333) are respectively fixedly connected to the side wall of the pushing support rod (331) and the outer side wall of the pushing support tube (332).

7. The railway network security risk visualization analysis method according to claim 6 is characterized in that: A locking mechanism (4) is provided in the area enlarging mechanism (3), and the locking mechanism (4) is used to lock the L-shaped area enlarging plate (35) in the first mounting groove (31). The locking mechanism (4) comprises a locking groove (41) and a locking plate (42). Two locking grooves (41) are provided, and the two locking grooves (41) are symmetrically arranged on the regulating support handle (2). The number of the locking plates (42) matches the number of the locking grooves (41), and the locking plates (42) are movably plugged into the first mounting groove (31). In the three installation grooves (43), the third installation groove (43) is opened on the fixing block (34), and the fixing block (34) is provided with an installation through hole (45), a pressing adjustment plate (44) is movably arranged in the installation through hole (45), and the pressing adjustment plate (44) is fixedly arranged on the side wall of the locking plate (42), the side wall of the pressing adjustment plate (44) is fixedly connected with a first supporting spring (46), and the free end of the first supporting spring (46) is fixedly connected to the side wall of the installation through hole (45).

8. The railway network security risk visualization analysis method according to claim 7 is characterized by: The area increasing mechanism (3) is provided with an auxiliary area increasing mechanism (5), the auxiliary area increasing mechanism (5) is used to assist in increasing the area of ​​the L-shaped area increasing plate (35), the auxiliary area increasing mechanism (5) comprises a contact plate (51) and a movable groove (52), the number of the contact plates (51) is two, and the two contact plates (51) are symmetrically arranged on the side walls of the first installation groove (31), the contact plate (51) is slidably arranged in the movable groove (52), and the movable groove (52) is provided on the L-shaped area increasing plate (35), and the movable groove (52) is also slidably arranged in the movable groove (52). A resistance block (53) is provided, and a guide support assembly (54) is provided on the resistance block (53); a driving assembly (55) is provided on the side wall of the resistance block (53), and the free end of the driving assembly (55) is connected to an auxiliary area enlargement plate (56); the auxiliary area enlargement plate (56) is slidably provided in an auxiliary movable groove (57) provided on the L-shaped area enlargement plate (35), and a third support spring (58) is fixedly connected to the side wall of the auxiliary movable groove (57), and the free end of the third support spring (58) is fixedly connected to the side wall of the auxiliary area enlargement plate (56).

9. The railway network security risk visualization analysis method according to claim 8 is characterized by: The guide support assembly (54) comprises a guide support block (541), a guide support groove (542) and a second support spring (543); the guide support block (541) is fixedly arranged on the lower end surface of the abutment block (53), and the guide support block (541) is slidably arranged in the guide support groove (542) provided on the bottom wall of the movable groove (52); the side wall of the guide support groove (542) is fixedly connected with the second support spring (543), and the free end of the second support spring (543) is fixedly connected to the guide support groove (542). The drive assembly (55) is mounted on the side wall of the abutment block (541), the drive assembly (55) comprising a spur rack (551) and a drive gear (552), the spur rack (551) being fixedly mounted on the side wall of the abutment block (53), and the spur rack (551) being meshed with the drive gear (552), the drive gear (552) being fixedly sleeved on the outside of the inner spiral tube (553), and a support ring (556) being movably sleeved on the outside of the inner spiral tube (553), an L-shaped connecting rod (557) being fixedly connected to the outer side wall of the support ring (556), and the L-shaped The free end of the connecting rod (557) is fixedly connected to the side wall of the movable groove (52); the inner spiral tube (553) is internally threaded with an inner spiral rod (554), and the inner spiral rod (554) is movably inserted into a movable through hole (555) provided on the L-shaped area enlargement plate (35); the inner spiral rod (554) is fixedly sleeved with the L-shaped connecting rod (557), and the L-shaped connecting rod (557) is fixedly arranged on the side wall of the auxiliary area enlargement plate (56); and a gripping mechanism is arranged in the auxiliary area enlargement mechanism (5). (6), the gripping mechanism (6) comprises an arc-shaped gripping plate (61) and a rotating support plate (62), the arc-shaped gripping plate (61) is arranged on the circumference of the rotating support plate (62), and the rotating support plate (62) is fixedly sleeved outside the rotating rod (63), and the rotating rod (63) is rotatably arranged in a rotating groove (64) provided on the auxiliary area enlargement plate (56), and a push-pull rod (65) is also hinged on the circumference of the rotating support plate (62), and the free end of the push-pull rod (65) is hinged on the top wall of the auxiliary movable groove (57).

10. A railway network security risk visualization analysis device adopted by the railway network security risk visualization analysis method as claimed in claim 9.

Images