A large-scale network security defense system based on a knowledge graph

Abstract

This invention belongs to the field of network security defense and involves data analysis technology. It addresses the problem that existing network security defense systems are unable to comprehensively analyze and characterize network attack data, resulting in poor security protection effectiveness. Specifically, it is a large-scale network security defense system based on knowledge graphs, including a security defense platform. The security defense platform is communicatively connected to a defense analysis module, a periodic management module, a feature analysis module, and a storage module. The defense analysis module is used to monitor and analyze network security defense data: generating a monitoring period and acquiring defense failure data packets of the security defense platform within the monitoring period. This invention can monitor and analyze network security defense data, thereby providing feedback on the attack risk and defense difficulty of the monitored object based on the value of the defense coefficient, and thus enabling targeted defense upgrades based on network attack characteristics.

Description

TECHNICAL FIELD

[0001] The application belongs to the field of network security defense, and relates to a data analysis technique, in particular to a large-scale network security defense system based on a knowledge graph. BACKGROUND

[0002] Network security generally refers to the security of a computer network, and can also refer to the security of a computer communication network. The computer communication network is a system in which a plurality of computers with independent functions are interconnected through communication equipment and transmission media, and information transmission and exchange between computers are realized under the support of communication software. The computer network refers to a system in which a plurality of independent computer systems, terminal equipment and data equipment that are relatively dispersed in terms of region are connected by using communication means for the purpose of sharing resources, and data exchange is carried out under the control of a protocol.

[0003] In network attacks and defense, a plurality of factors need to be considered, for example, network topology, host hardware and software configuration, vulnerabilities, firewall settings, task dependency, etc. The conventional security evaluation method can only perform isolated basic evaluation on these aspects, and it is difficult to effectively combine them to analyze the vulnerability of the system from a higher level.

[0004] In view of the above technical problems, the application provides a solution. SUMMARY

[0005] The application aims to provide a large-scale network security defense system based on a knowledge graph, which can solve the problem that the existing network security defense system cannot comprehensively analyze network attack data and the poor security protection effect caused by feature marking.

[0006] The application needs to solve the technical problem of how to provide a large-scale network security defense system based on a knowledge graph which can comprehensively analyze network attack data and mark features.

[0007] The application can be achieved by the following technical scheme.

[0008] The application provides a large-scale network security defense system based on a knowledge graph, which comprises a security defense platform, wherein the security defense platform is communicatively connected with a defense analysis module, a cycle management module, a feature analysis module and a storage module.

[0009] The defense analysis module is used to monitor and analyze network security defense data: generate a monitoring period, obtain the defense failure data packets of the security defense platform within the monitoring period; mark the defense failure data as monitoring objects, obtain the leak table data LB and attack table data GB of the monitoring objects; obtain the defense coefficient FY of the monitoring objects by numerically calculating the leak table data LB and attack table data GB; mark the monitoring objects as ordinary objects or key objects according to the value of the defense coefficient FY.

[0010] The periodic management module is used to perform periodic management and analysis of defense failure data within the monitoring period: obtain the number of key objects within the monitoring period and mark them as key data; mark the ratio of the number of key data to the number of monitored objects in the defense failure data packets as the key coefficient; mark the difference between the network attack time of the key object and the start time of the monitoring period as the key duration; establish a key set for the key duration of all key objects; calculate the variance of the key set to obtain the bias coefficient; and mark the defense characteristics of the monitoring period by the magnitude of the key coefficient and the bias coefficient.

[0011] The feature analysis module is used to monitor and analyze the defense features during the monitoring period.

[0012] In a preferred embodiment of the present invention, the defense failure data packet includes vulnerability data and attack data. The vulnerability data includes the vulnerability type at each defense failure, and the vulnerability types include firewall mismatch, improper server configuration, software patch update, weak password, and information leakage. The attack data includes the attack characteristics at each defense failure, and the attack characteristics include the attacked network node and the attacked path.

[0013] In a preferred embodiment of the present invention, the process of obtaining the leak table data LB includes: obtaining the vulnerability type of the monitored object, marking the number of times the same vulnerability type appears in the defense failure data packet as the leak type value, and marking the ratio of the leak type value to the total number of monitored objects in the defense failure data packet as the leak table data LB; the process of obtaining the attack table data GB includes: obtaining the attack characteristics of the monitored object, marking the number of times the same attack characteristics appear in the defense data packet as the attack characteristic value, and marking the ratio of the attack characteristic value to the total number of monitored objects in the defense failure data packet as the attack table data GB.

[0014] As a preferred embodiment of the present invention, the specific process of marking a monitored object as a normal object or a key object includes: obtaining the defense threshold FYmax through the storage module, comparing the defense coefficient FY of the monitored object with the defense threshold FY: if the defense coefficient FY is less than the defense threshold FYmax, then the corresponding monitored object is marked as a normal object; if the defense coefficient is greater than or equal to the defense threshold FYmax, then the corresponding monitored object is marked as a key object.

[0015] In a preferred embodiment of the present invention, the specific process of marking the defense characteristics of the monitoring period includes: obtaining the key threshold and the re-bias threshold through the storage module; comparing the key coefficient and the re-bias coefficient of the monitoring period with the key threshold and the re-bias threshold respectively; if the key coefficient is less than the key threshold, it is determined that the network defense effect within the monitoring period meets the requirements, and the defense characteristics of the monitoring period are marked as normal; if the key coefficient is greater than or equal to the key threshold and the re-bias coefficient is greater than or equal to the re-bias threshold, it is determined that the network defense effect within the monitoring period does not meet the requirements, and the defense characteristics of the monitoring period are marked as overall upgrade; if the key coefficient is greater than or equal to the key threshold and the re-bias coefficient is less than the re-bias threshold, it is determined that the network defense effect within the monitoring period does not meet the requirements. The defense characteristics of the monitoring period are marked as local upgrades. The average of all key durations is summed to obtain the marked duration BJ. The marked thresholds BJmin and BJmax are obtained using the formulas BJmin = t1*BJ and BJmax = t2*BJ, where t1 and t2 are proportional coefficients, and 0.85≤t1≤0.95 and 1.05≤t2≤1.15, respectively. The marked range is formed by the marked thresholds BJmin and BJmax and is sent to the security defense platform. After receiving the marked range, the security defense platform sends the marked range to the mobile terminal of the management personnel. The defense characteristics of the monitoring period are also sent to the security defense platform, which then sends the received defense characteristics of the monitoring period to the feature analysis module.

[0016] As a preferred embodiment of the present invention, the specific process of the feature analysis module monitoring and analyzing the defense features of the monitoring cycle includes: performing frequency analysis when the feature analysis module first receives a defense feature of overall or partial upgrade; setting an initial upgrade value of zero; incrementing the upgrade value by one at the start of the frequency analysis; obtaining the defense feature of the next monitoring cycle received by the feature analysis module; if it is normal, the frequency analysis ends, and frequency analysis is performed again when the feature analysis module receives a defense feature of overall or partial upgrade; if it is an overall or partial upgrade, the upgrade value is incremented by one, and a defense warning signal is generated when the upgrade value is not less than a preset upgrade threshold. The defense warning signal is sent to the security defense platform, and after receiving the defense warning signal, the security defense platform sends the defense warning signal to the mobile terminal of the management personnel until the defense feature of the next monitoring cycle is normal, at which point the frequency analysis ends; and clearing the upgrade value to zero at the end of the frequency analysis.

[0017] As a preferred embodiment of the present invention, the working method of the knowledge graph-based large-scale network security defense system includes the following steps:

[0018] Step 1: Monitor and analyze network security defense data: Generate a monitoring period, obtain the defense failure data packets of the security defense platform within the monitoring period, perform numerical calculations on the defense failure data packets to obtain the defense coefficient FY of the monitored object, and mark the monitored object as an ordinary object or a key object based on the value of the defense coefficient FY;

[0019] Step 2: Periodic management and analysis of defense failure data within the monitoring period: Obtain the number of key objects within the monitoring period and mark them as key data. Obtain the key coefficient and bias coefficient of the monitoring period through the key data. Mark the defense characteristics of the monitoring period through the key coefficient and bias coefficient.

[0020] Step 3: Monitor and analyze the defense characteristics during the monitoring period: When the feature analysis module receives the defense characteristics of overall upgrade or partial upgrade for the first time, it performs frequency analysis. When the upgrade value of the frequency analysis is not less than the preset upgrade threshold, a defense warning signal is sent to the mobile terminal of the management personnel.

[0021] The present invention has the following beneficial effects:

[0022] 1. The defense analysis module can monitor and analyze network security defense data. By comprehensively analyzing the vulnerability data and attack data in the failed defense data packets, the defense coefficient of each monitored object can be obtained. Based on the value of the defense coefficient, feedback can be given on the attack risk and defense difficulty of the monitored object, and then targeted defense upgrades can be carried out according to the characteristics of network attacks.

[0023] 2. The periodic management module can perform periodic management and analysis of defense failure data within the monitoring period. By analyzing and calculating key data within the monitoring period, the key coefficient and the repetition coefficient are obtained. Based on the key coefficient and the repetition coefficient, the defense characteristics of the monitoring period are marked. The network security defense status is periodically monitored based on the defense characteristic marking results.

[0024] 3. The feature analysis module can monitor and analyze the defense features during the monitoring period. The frequency analysis results can not only monitor the network security defense status during the monitoring period, but also provide feedback on the effectiveness of network defense upgrades, thereby continuously optimizing network security defense upgrade plans and improving the security level of subsequent network operations. Attached Figure Description

[0025] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0026] Figure 1 This is a system block diagram of Embodiment 1 of the present invention;

[0027] Figure 2 This is a flowchart of the method in Embodiment 2 of the present invention. Detailed Implementation

[0028] The technical solution of the present invention will be clearly and completely described below with reference to the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0029] Example 1

[0030] like Figure 1 As shown, a large-scale network security defense system based on knowledge graphs includes a security defense platform, which is communicatively connected to a defense analysis module, a periodic management module, a feature analysis module, and a storage module.

[0031] The defense analysis module is used to monitor and analyze network security defense data: It generates monitoring cycles and acquires defense failure data packets from the security defense platform within the monitoring cycle. These packets include vulnerability data and attack data. Vulnerability data includes the vulnerability type at the time of each defense failure, including firewall incompatibility, improper server configuration, software patch updates, weak passwords, and information leakage. Attack data includes attack characteristics at the time of each defense failure, including attacked network nodes and attack paths. The module marks defense failure data as monitoring objects and acquires the leak table data (LB) and attack table data (GB) for these objects. The LB acquisition process includes: acquiring the vulnerability type of the monitoring object, marking the number of times the same vulnerability type appears in the defense failure data packet as the leak type value, and marking the ratio of the leak type value to the total number of monitoring objects in the defense failure data packet as the leak table data (LB). The GB acquisition process includes: acquiring the attack characteristics of the monitoring object, marking the number of times the same attack characteristic appears in the defense data packet as the attack characteristic value, and comparing the attack characteristic value with the number of monitoring objects in the defense failure data packet. The ratio of the total number of objects is marked as attack table data GB; the defense coefficient FY of the monitored object is obtained through the formula FY=α1*LB+α2*GB. The defense coefficient is a value that reflects the attack risk and defense difficulty of the monitored object. The larger the defense coefficient, the higher the attack risk and the greater the defense difficulty of the monitored object; where α1 and α2 are both proportional coefficients, and α1>α2>1; the defense threshold FYmax is obtained through the storage module, and the defense coefficient FY of the monitored object is compared with the defense threshold FY: if the defense coefficient FY is less than the defense threshold FYmax, the corresponding monitored object is marked as an ordinary object; if the defense coefficient is greater than or equal to the defense threshold FYmax, the corresponding monitored object is marked as a key object; network security defense data is monitored and analyzed. By comprehensively analyzing the vulnerability data and attack data in the failed defense data packets, the defense coefficient of each monitored object is obtained. Thus, the attack risk and defense difficulty of the monitored object are fed back according to the value of the defense coefficient, and targeted defense upgrades can be carried out based on the characteristics of network attacks.

[0032] The periodic management module is used to periodically manage and analyze defense failure data within a monitoring period: It acquires the number of key objects within the monitoring period and marks them as key data; it marks the ratio of the number of key data to the number of monitored objects in the defense failure data packets as a key coefficient; it marks the difference between the network attack time of a key object and the start time of the monitoring period as a key duration; it establishes a key set for the key durations of all key objects; it calculates the variance of the key set to obtain the re-biasing coefficient; it obtains the key threshold and re-biasing threshold through the storage module; and it compares the key coefficient and re-biasing coefficient of the monitoring period with the key threshold and re-biasing threshold, respectively: if the key coefficient is less than the key threshold, the network defense effect within the monitoring period is deemed satisfactory, and the defense feature of the monitoring period is marked as normal; if the key coefficient is greater than or equal to the key threshold and the re-biasing coefficient is greater than or equal to the re-biasing threshold, the network defense effect within the monitoring period is deemed unsatisfactory, and the defense feature of the monitoring period is marked as an overall upgrade; if the key coefficient is greater than or equal to the key threshold and the re-biasing coefficient is less than the re-biasing threshold, the network defense effect within the monitoring period is deemed unsatisfactory. To meet the requirements, the defense characteristics of the monitoring period are marked as local upgrades. The average of all key durations is summed to obtain the marked duration BJ. The marking thresholds BJmin and BJmax are obtained using the formulas BJmin = t1*BJ and BJmax = t2*BJ, where t1 and t2 are proportional coefficients, and 0.85≤t1≤0.95 and 1.05≤t2≤1.15, respectively. The marking range is formed by the marking thresholds BJmin and BJmax and sent to the security defense platform. After receiving the marking range, the security defense platform sends the marking range to the mobile terminal of the administrator. The defense characteristics of the monitoring period are also sent to the security defense platform, which sends the received defense characteristics of the monitoring period to the feature analysis module. The defense failure data within the monitoring period is periodically managed and analyzed. By analyzing and calculating the key data within the monitoring period, the key coefficient and the repetition coefficient are obtained. The defense characteristics of the monitoring period are marked according to the key coefficient and the repetition coefficient. The network security defense status is periodically monitored based on the defense characteristic marking results.

[0033] The feature analysis module monitors and analyzes defense features during the monitoring period. When the feature analysis module first receives a defense feature indicating a complete or partial upgrade, it performs frequency analysis. An initial upgrade value of zero is set, and the upgrade value is incremented by one at the start of the frequency analysis. The module then retrieves the defense features received for the next monitoring period. If the upgrade value is normal, the frequency analysis ends, and it is repeated when the feature analysis module receives another defense feature indicating a complete or partial upgrade. If it is a complete or partial upgrade, the upgrade value is incremented by one, and a defense warning signal is generated when the upgrade value is not less than a preset upgrade threshold. This warning signal is sent to the security defense platform, which then sends it to the administrator's mobile terminal. This process continues until the defense features received for the next monitoring period are normal, at which point the frequency analysis ends. The upgrade value is reset to zero at the end of the frequency analysis. By monitoring and analyzing the defense features during the monitoring period, the frequency analysis results not only monitor the network security defense status during the monitoring period but also provide feedback on the effectiveness of network defense upgrades, thereby continuously optimizing network security defense upgrade schemes and improving the subsequent network operation security.

[0034] Example 2

[0035] like Figure 2 As shown, a large-scale network security defense method based on knowledge graphs includes the following steps:

[0036] Step 1: Monitor and analyze network security defense data: Generate a monitoring period, obtain the defense failure data packets of the security defense platform within the monitoring period, perform numerical calculations on the defense failure data packets to obtain the defense coefficient FY of the monitored object, and mark the monitored object as an ordinary object or a key object based on the value of the defense coefficient FY;

[0037] Step 2: Periodic management and analysis of defense failure data within the monitoring period: Obtain the number of key objects within the monitoring period and mark them as key data. Obtain the key coefficient and bias coefficient of the monitoring period through the key data. Mark the defense characteristics of the monitoring period through the key coefficient and bias coefficient.

[0038] Step 3: Monitor and analyze the defense characteristics during the monitoring period: When the feature analysis module receives the defense characteristics of overall upgrade or partial upgrade for the first time, it performs frequency analysis. When the upgrade value of the frequency analysis is not less than the preset upgrade threshold, a defense warning signal is sent to the mobile terminal of the management personnel.

[0039] A large-scale network security defense system based on knowledge graphs, during operation, generates a monitoring period, acquires defense failure data packets of the security defense platform within the monitoring period, calculates the defense coefficient FY of the monitored object based on the defense failure data packets, and marks the monitored object as an ordinary object or a key object based on the value of the defense coefficient FY; acquires the number of key objects within the monitoring period and marks them as key data, obtains the key coefficient and repetition coefficient of the monitoring period based on the key data, and marks the defense features of the monitoring period based on the key coefficient and repetition coefficient; when the feature analysis module receives the defense features of overall upgrade or partial upgrade for the first time, it performs frequency analysis, and sends a defense warning signal to the mobile terminal of the administrator when the upgrade value of the frequency analysis is not less than the preset upgrade threshold.

[0040] The above description is merely an example and illustration of the structure of the present invention. Those skilled in the art can make various modifications or additions to the specific embodiments described, or use similar methods to replace them, as long as they do not deviate from the structure of the invention or exceed the scope defined in the claims, all of which should fall within the protection scope of the present invention.

[0041] The above formulas are all derived from software simulation using a large amount of data, and are selected to be close to the actual values. The coefficients in the formulas are set by those skilled in the art according to the actual situation; for example: the formula FY=α1*LB+α2*GB; those skilled in the art collect multiple sets of sample data and set corresponding defense coefficients for each set of sample data; substitute the set defense coefficients and the collected sample data into the formulas, any two formulas form a system of two linear equations, filter the calculated coefficients and take the average value, and obtain the values ​​of α1 and α2 as 3.47 and 2.15 respectively;

[0042] The size of the coefficient is a specific value obtained by quantifying each parameter to facilitate subsequent comparison. The size of the coefficient depends on the amount of sample data and the defense coefficient initially set by those skilled in the art for each set of sample data. As long as it does not affect the proportional relationship between the parameter and the quantified value, such as the defense coefficient being proportional to the value of the missing data.

[0043] In the description of this specification, references to terms such as "an embodiment," "example," "specific example," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0044] The preferred embodiments of the present invention disclosed above are merely illustrative of the invention. These preferred embodiments do not exhaustively describe all details, nor do they limit the invention to any specific implementation. Clearly, many modifications and variations can be made based on the content of this specification. This specification selects and specifically describes these embodiments to better explain the principles and practical applications of the invention, thereby enabling those skilled in the art to better understand and utilize the invention. The invention is limited only by the claims and their full scope and equivalents.

Claims

1. A large-scale network security defense system based on knowledge graphs, characterized in that, It includes a security defense platform, which is communicatively connected to a defense analysis module, a periodic management module, a feature analysis module, and a storage module; The defense analysis module is used to monitor and analyze network security defense data: generate a monitoring period, obtain the defense failure data packets of the security defense platform within the monitoring period; mark the defense failure data as monitoring objects, obtain the leak table data LB and attack table data GB of the monitoring objects; obtain the defense coefficient FY of the monitoring objects by numerically calculating the leak table data LB and attack table data GB; mark the monitoring objects as ordinary objects or key objects according to the value of the defense coefficient FY. The periodic management module is used to perform periodic management and analysis of defense failure data within the monitoring period: obtain the number of key objects within the monitoring period and mark them as key data; mark the ratio of the number of key data to the number of monitored objects in the defense failure data packets as the key coefficient; mark the difference between the network attack time of the key object and the start time of the monitoring period as the key duration; establish a key set for the key duration of all key objects; calculate the variance of the key set to obtain the bias coefficient; and mark the defense characteristics of the monitoring period by the magnitude of the key coefficient and the bias coefficient. The feature analysis module is used to monitor and analyze the defense features during the monitoring period; The process of obtaining leak table data (LB) includes: obtaining the vulnerability type of the monitored object, marking the number of times the same vulnerability type appears in the defense failure data packet as the leak type value, and marking the ratio of the leak type value to the total number of monitored objects in the defense failure data packet as the leak table data (LB); the process of obtaining attack table data (GB) includes: obtaining the attack characteristics of the monitored object, marking the number of times the same attack characteristics appear in the defense data packet as the attack characteristic value, and marking the ratio of the attack characteristic value to the total number of monitored objects in the defense failure data packet as the attack table data (GB). The specific process of marking the defense characteristics of the monitoring period includes: obtaining the key threshold and the re-bias threshold through the storage module; comparing the key coefficient and the re-bias coefficient of the monitoring period with the key threshold and the re-bias threshold respectively; if the key coefficient is less than the key threshold, the network defense effect within the monitoring period is determined to meet the requirements, and the defense characteristics of the monitoring period are marked as normal; if the key coefficient is greater than or equal to the key threshold and the re-bias coefficient is greater than or equal to the re-bias threshold, the network defense effect within the monitoring period is determined to not meet the requirements, and the defense characteristics of the monitoring period are marked as overall upgrade; if the key coefficient is greater than or equal to the key threshold and the re-bias coefficient is less than the re-bias threshold, the network defense effect within the monitoring period is determined to not meet the requirements, and the defense characteristics of the monitoring period are marked as overall upgrade. The defense feature is marked as a local upgrade. The marked duration BJ is obtained by summing and averaging all key durations. The marked thresholds BJmin and BJmax are obtained by the formulas BJmin = t1*BJ and BJmax = t2*BJ, where t1 and t2 are proportional coefficients, and 0.85≤t1≤0.95 and 1.05≤t2≤1.15, respectively. The marked range is formed by the marked thresholds BJmin and BJmax. The marked range is sent to the security defense platform. After receiving the marked range, the security defense platform sends the marked range to the mobile terminal of the management personnel. The defense features of the monitoring period are sent to the security defense platform. The security defense platform sends the received defense features of the monitoring period to the feature analysis module.

2. The large-scale network security defense system based on knowledge graphs according to claim 1, characterized in that, The defense failure data packet includes vulnerability data and attack data. Vulnerability data includes the vulnerability type for each defense failure, including firewall mismatch, improper server configuration, software patch update, weak password, and information leakage. Attack data includes the attack characteristics for each defense failure, including the attacked network node and the attacked path.

3. A large-scale network security defense system based on knowledge graphs according to claim 2, characterized in that, The specific process of marking a monitored object as a normal object or a key object includes: obtaining the defense threshold FYmax through the storage module, comparing the defense coefficient FY of the monitored object with the defense threshold FY: if the defense coefficient FY is less than the defense threshold FYmax, the corresponding monitored object is marked as a normal object; if the defense coefficient is greater than or equal to the defense threshold FYmax, the corresponding monitored object is marked as a key object.

4. A large-scale network security defense system based on knowledge graphs according to claim 3, characterized in that, The specific process of the feature analysis module monitoring and analyzing the defense features of the monitoring cycle includes: When the feature analysis module first receives a defense feature indicating an overall or partial upgrade, it performs frequency analysis: An initial upgrade value of zero is set, and the upgrade value is incremented by one at the start of the frequency analysis. The feature analysis module then obtains the defense features received for the next monitoring cycle. If the upgrade is normal, the frequency analysis ends, and it is performed again when the feature analysis module receives the defense feature indicating an overall or partial upgrade. If it is an overall or partial upgrade, the upgrade value is incremented by one, and a defense warning signal is generated when the upgrade value is not less than a preset upgrade threshold. This warning signal is sent to the security defense platform, which then sends it to the administrator's mobile terminal. This process continues until the defense features received for the next monitoring cycle are normal, at which point the frequency analysis ends. The upgrade value is then reset to zero at the end of the frequency analysis.

5. A large-scale network security defense system based on knowledge graphs according to any one of claims 1-4, characterized in that, The working method of this knowledge graph-based large-scale network security defense system includes the following steps: Step 1: Monitor and analyze network security defense data: Generate a monitoring period, obtain the defense failure data packets of the security defense platform within the monitoring period, perform numerical calculations on the defense failure data packets to obtain the defense coefficient FY of the monitored object, and mark the monitored object as an ordinary object or a key object based on the value of the defense coefficient FY; Step 2: Periodic management and analysis of defense failure data within the monitoring period: Obtain the number of key objects within the monitoring period and mark them as key data. Obtain the key coefficient and bias coefficient of the monitoring period through the key data. Mark the defense characteristics of the monitoring period through the key coefficient and bias coefficient. Step 3: Monitor and analyze the defense characteristics during the monitoring period: When the feature analysis module receives the defense characteristics of overall upgrade or partial upgrade for the first time, it performs frequency analysis. When the upgrade value of the frequency analysis is not less than the preset upgrade threshold, a defense warning signal is sent to the mobile terminal of the management personnel.

Images