A network information system endogenous security defense method and system

Abstract

The present invention discloses an endogenous security defense method and system for a network information system, and relates to the technical field of network security defense. The system includes an authority verification module, which verifies the identity of a user and synchronously obtains the corresponding access rights under the user identity. The technical key points are: establishing a plurality of temporarily encrypted access channels to avoid external intrusion through the access channels, and comparing the generated system abnormal state evaluation value Evos with the evaluation threshold, so as to efficiently judge the effectiveness of the security defense system and provide a basis for subsequent adjustments. After judging that the security defense system has risks, cross-verification is performed through two verification tools in a data verification module, which can not only effectively judge whether the network information system has been invaded, but also accurately determine the location of the invasion, and then execute corresponding strategies to ensure the security of the system.

Description

Technical Field

[0001] The present invention relates to the field of network security defense technology, and in particular to an intrinsic security defense method and system for a network information system. Background Art

[0002] Cybersecurity defense technologies are a set of methods and tools used to protect the security of computer networks. They are designed to identify, prevent and respond to cyber attacks, and ensure the confidentiality, integrity and availability of network systems, such as firewalls, which are security devices located at the network boundary that can monitor and control network traffic, filter malicious traffic to protect internal networks from attacks, or access control and identity authentication, which ensure that only authorized users can access systems and data, such as using passwords, certificates, two-factor authentication and other methods to verify identity.

[0003] The existing patent application publication number is CN114978697A, and the invention patent titled "A method, device, equipment and medium for endogenous security defense of a network information system" points out the technical solution as follows: obtaining a target service request for a network information system; determining a target service type corresponding to the target service request, and determining a target trusted virtual machine corresponding to the target service type from trusted virtual machines pre-created in a trusted virtual environment; the trusted virtual environment is a virtualized environment obtained by deploying trusted basic software and host security mechanisms on a trusted host system; and different trusted virtual machines carry different security defense services; using the security defense service in the target trusted virtual machine to process the service corresponding to the target service request, so as to realize endogenous security defense of the network information system;

[0004] Another technical solution pointed out in the invention patent with application publication number CN113542262A is: based on the trapping node used to protect the information system, determine whether the information system is attacked; when the information system is attacked, collect attack data through the trapping node, and divert the attack data to the back-end honeynet; based on the attack data and the preset adaptive honeynet strategy model, adjust the deployment rules of the honeypots in the honeynet to improve the overall active defense capability of the current network.

[0005] However, with respect to the above patent combined with the prior art, when enterprise users access a network information system, they usually need to ask questions, so that the network information system matches the questions asked by the user through the built-in database and responds according to the matching results. During the access process, a security defense system is usually configured on the network information system, generally by using a firewall or placing the database in a virtual environment with an access security policy. The overall security defense mechanism of the network information system is poor. When encountering a system intrusion, the effectiveness of the security defense system cannot be accurately judged, resulting in the staff being unable to respond in advance, and the security of the network information system cannot be further guaranteed. Summary of the invention

[0006] 1. Technical issues to be resolved

[0007] In view of the deficiencies in the prior art, the present invention provides an endogenous security defense method and system for a network information system, establishes a number of temporarily encrypted access channels to prevent external intrusion through the access channels, and compares the generated system abnormal state evaluation value Evos with the evaluation threshold, so as to efficiently judge the effectiveness of the security defense system and provide a basis for subsequent adjustments. After judging that the security defense system is at risk, cross-verification is performed through two verification tools in the data verification module, which can not only effectively judge whether the network information system is invaded, but also accurately determine the location of the invasion, and then execute corresponding strategies to ensure the security of the system, thereby solving the problems of cross-traditional security defense mechanisms and lack of security performance guarantee proposed in the background technology.

[0008] (II) Technical solution

[0009] To achieve the above objectives, the present invention is implemented through the following technical solutions:

[0010] An endogenous security defense system for a network information system, comprising:

[0011] The permission verification module verifies the user's identity and simultaneously obtains the corresponding access rights under the user's identity;

[0012] The security access module, after the user's identity is verified, the user asks the question information he needs to search on the web page. After detection and defense processing, the question information is classified, and the type of question is determined and matched to the corresponding function database in the virtual database. The virtual database is equipped with N function databases and data verification units corresponding to each function database to verify the data integrity in the corresponding function database;

[0013] The access channel connection module, after matching the corresponding function database, establishes a temporary encrypted access channel using the transport layer security protocol, and cancels the channel after the access is completed;

[0014] The log recording module records the security information of the network information system and backs up and stores the security information;

[0015] The anomaly detection module obtains the abnormal data set and preprocesses the abnormal data set to generate a system abnormal state evaluation value Evos, compares the system abnormal state evaluation value Evos with a preset evaluation threshold, and when the system abnormal state evaluation value Evos exceeds the evaluation threshold, synchronously triggers each data verification unit to detect whether the corresponding function database is abnormal, and executes corresponding strategies for the abnormal function database, deletes and re-enters the data in the corresponding function database.

[0016] Further, the security access module includes a threat detection unit, a classification matching unit, and a virtual database;

[0017] The threat detection unit monitors and analyzes data traffic in real time through network security equipment, identifies potential threats and attacks, and takes defensive measures. The classification and matching unit uses natural language processing technology to classify problem information. The virtual database includes at least a financial database, a customer database, a market database, and a production database.

[0018] Furthermore, the virtual database also includes a backup unit for regularly backing up the financial database, customer database, market database and production database in the virtual database.

[0019] Furthermore, the anomaly detection module includes an anomaly information collection unit and an evaluation and analysis unit. The anomaly data set obtained by the anomaly information collection unit includes the number of login failures M s , Number of unauthorized accesses K s , Network disconnection times L s , the network transmission rate Ws at each time node within the unit time T t And the number of malicious attacks B s .

[0020] Furthermore, in the evaluation and analysis unit, the network transmission rate Ws in the abnormal data set is t Preprocessing is performed to obtain the network transmission rate Ws at each time node within the unit time T. t Based on this, the formula for calculating the network transmission stability coefficient Wdt is as follows:

[0021]

[0022] Where Ws tThe t in the figure represents the number of the network transmission rate at different time nodes within the unit time T.

[0023] Furthermore, in the evaluation and analysis unit, the number of login failures M s , Number of unauthorized accesses K s , Network disconnection times L s , network transmission stability coefficient Wdt and the number of malicious attacks B s After dimensionless processing, the system abnormal state evaluation value Evos is generated, and the formula is as follows:

[0024]

[0025] In the formula, f 1 、f 2 、f 3 、f 4 、f 5 The number of failed logins M s , Number of unauthorized accesses K s , the number of malicious attacks B s , Network disconnection times L s And the preset proportional coefficient of the network transmission stability coefficient Wdt, and f 5 >f 4 >f 1 >f 2 >f 3 >0,f 1 +f 2 +f 3 +f 4 +f 5 =3.547, G is the constant correction coefficient.

[0026] Further, in the evaluation and analysis unit, the system abnormal state evaluation value Evos is compared with a preset evaluation threshold;

[0027] If the system abnormal status evaluation value Evos does not exceed the evaluation threshold, no response action is taken; if the system abnormal status evaluation value Evos exceeds the evaluation threshold, each data verification unit is triggered synchronously, and the data verification unit performs data consistency verification and uses a data consistency verification tool to detect whether the corresponding functional database is abnormal. The data consistency verification tools used include database checksum tools and data integrity check tools.

[0028] Furthermore, when checking whether the corresponding function database is abnormal, the results are as follows:

[0029] If the detection result is abnormal, the corresponding strategy is executed. The content of executing the corresponding strategy is: delete the data in the corresponding functional database with abnormal detection result, and schedule the data regularly backed up by the backup unit to enter the corresponding functional database; if the detection result is not abnormal, no response action is taken.

[0030] A network information system endogenous security defense method comprises the following steps:

[0031] Step 1: When a user logs into the network information system, the user identity is verified and the corresponding access rights under the user identity are obtained simultaneously;

[0032] Step 2: After the user's identity is verified, the user asks the question information he needs to search on the web page. After detection and defense processing, the question information is classified, and the type of question is determined and matched to the corresponding functional database in the virtual database. The virtual database includes at least a financial database, a customer database, a market database, and a production database. Each functional database in the virtual database is also backed up regularly;

[0033] Step 3: After matching the corresponding function database, a temporary encrypted access channel using the transport layer security protocol is established, and the channel is cancelled after the access is completed;

[0034] Step 4: Record the security information of the network information system and back up and store the security information;

[0035] Step 5: Obtain an abnormal data set, pre-process the abnormal data set, generate a system abnormal state evaluation value Evos, and compare the system abnormal state evaluation value Evos with a preset evaluation threshold;

[0036] If the system abnormal status evaluation value Evos does not exceed the evaluation threshold, no response action is taken;

[0037] If the system abnormal status evaluation value Evos exceeds the evaluation threshold, the data consistency check operation of each functional database is triggered synchronously, and the data consistency check tool is used to detect whether the corresponding functional database is abnormal;

[0038] If the detection result is abnormal, the data in the corresponding function database with abnormal detection result is deleted, and the data backed up regularly is scheduled to enter the corresponding function database;

[0039] If the detection result is not abnormal, no response action is taken.

[0040] (III) Beneficial effects

[0041] The present invention provides a network information system endogenous security defense method and system, which has the following beneficial effects:

[0042] 1. Use the threat detection unit in conjunction with the access channel connection module to achieve dual system defense processing. Use network security equipment for primary defense in the threat detection unit, and then establish a separate access channel for each functional database during the access process. Each access channel is temporarily encrypted and unique, and adjacent access channels will not interfere with each other, further improving the security of the entire defense system. After the access is completed, the channel is canceled, which can avoid the risk of external intrusion through the access channel to a certain extent;

[0043] 2. After the log recording module, an anomaly detection module is established. According to the collected anomaly data set, the network transmission rate Ws in the anomaly data set is t After preprocessing, the system abnormal state evaluation value Evos is generated to judge whether the defense system is stable. Since it comprehensively considers the behavioral abnormality factors, network abnormality factors and activity abnormality factors, the obtained system abnormal state evaluation value Evos has high accuracy and effectiveness. After comparing with the evaluation threshold, it can efficiently judge the effectiveness of the security defense system, which is convenient for providing a basis for subsequent adjustments;

[0044] 3. Use the anomaly detection module in conjunction with each data verification module. After determining that there is a risk in the security defense system, cross-verify through the two verification tools in the data verification module. This can not only effectively determine whether the network information system has been invaded, but also accurately determine the location of the invasion, and combine with the backup unit to update the abnormal function database, so that the network information system can be restored in a very short time, while also ensuring the security of the network information system. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 This is a modular principle block diagram of the intrinsic security defense system of the network information system of the present invention. DETAILED DESCRIPTION

[0046] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0047] Example 1: Please refer to Figure 1 This embodiment provides an endogenous security defense system for a network information system, including:

[0048] The permission verification module verifies the user's identity and simultaneously obtains the corresponding access rights under the user's identity;

[0049] Specifically, enterprise users need to enter the correct "user name" and "password" on the web page before they can log in to the network information system. The corresponding "user name" has pre-set access rights. For example, the access right of "user name" A1306 is S-level, which means that it can access all functional databases in the subsequent virtual database; the access right of "user name" E1038 is F-level, which means that it can access the financial database in the subsequent virtual database;

[0050] A security access module, which includes a threat detection unit, a classification matching unit, and a virtual database;

[0051] After the user's identity is verified, the user asks the question information he needs to search on the web page. After the primary defense of the threat detection unit, the question information is sent to the classification and matching unit, which classifies the question information and determines and matches it to the corresponding functional database in the virtual database based on the type of question, so as to facilitate the retrieval of subsequent reply content data.

[0052] The threat detection unit monitors and analyzes data traffic in real time through network security equipment (firewall), identifies potential threats and attacks, and takes corresponding defense measures, such as traffic filtering, attack blocking, etc., to achieve the role of primary defense. The selection of network security equipment also includes intrusion detection system, referred to as IDS, which is a security tool used to monitor and report potential intrusion behaviors in networks or systems. The specific intrusion detection system used is network intrusion detection system, referred to as NIDS, which monitors and analyzes data traffic transmitted through the network and identifies possible network intrusion behaviors. NIDS can detect network attacks, scanning activities and vulnerability exploits, and provide alarms or record abnormal network behaviors;

[0053] The classification and matching unit uses natural language processing (NLP) technology to classify the question information and determine the required type of question, such as financial, customer information, and product information. According to the question type, it matches it to the corresponding functional database in the virtual database, such as the financial database, customer database, etc.;

[0054] The virtual database includes at least a financial database, a customer database, a market database, and a production database, and the virtual database and each functional database therein are securely isolated. Security isolation means that different data and functions in the virtual database and the functional database do not interfere with each other, thereby reducing potential attack surfaces and security risks. The specific content of security isolation is: by using virtualization technology, different functional databases are separated into different virtual environments to ensure that there is no mutual influence and interference between them. The virtualization technology is container virtualization. Container virtualization is based on operating system-level virtualization and uses the resource isolation and restriction functions of the operating system to create multiple independent containers. Unlike virtual machines, containers share the kernel of the host operating system, and Docker is a commonly used containerization technology platform. Through virtualization technology, different functional databases can be deployed in their own containers and isolated from each other. Even if a functional database fails or has security issues, it will not affect other databases.

[0055] Specifically, the following are common data types in an enterprise, which may be included in financial databases, customer databases, marketing databases, and production databases;

[0056] Among them, the financial database includes the company's financial data, such as sales records, purchase records, collection records, payment records, balance sheets, income statements, cash flow statements, etc. These data are used to manage and monitor the company's financial status, profits and cash flow;

[0057] Customer database: including customers’ personal information, contact information, purchase history, consumption preferences, complaint records, etc. These data are used to understand customer needs, provide personalized services, and optimize customer relationships and marketing strategies;

[0058] Market database: including market research data, competitive intelligence, market trend analysis, consumer behavior data, etc. These data are used to understand market demand, competitive environment and potential opportunities, and guide product development and market promotion;

[0059] Production database: includes data in the product production process, such as raw material inventory, production plan, production process parameters, production line capacity, product quality monitoring data, etc. These data are used to optimize production plans, improve production efficiency, ensure product quality and trace product traceability;

[0060] The virtual database also includes data verification units corresponding to the financial database, customer database, market database and production database. That is, if there are N functional databases in the virtual database, the number of data verification units is also N, and they correspond to each functional database one by one. Each data verification unit is used to verify the integrity of the data in the corresponding functional database.

[0061] The virtual database also includes a backup unit, which is used to regularly back up each functional database in the virtual database. The regular time points and intervals need to be set in advance according to actual needs. For example, the data in the virtual database is automatically backed up at zero o'clock during the time interval of one day.

[0062] The access channel connection module establishes a temporary encrypted access channel after matching the corresponding function database, and cancels the channel after the access is completed, thereby avoiding the risk of external intrusion through the access channel;

[0063] The establishment of a temporary encrypted access channel is to use the Transport Layer Security Protocol (TLS / SSL) to provide security and encryption services for the communication between the corresponding functional database and the visitor (i.e., corporate user);

[0064] TLS / SSL uses public and private keys to establish a secure communication channel and ensure the confidentiality and integrity of the communication. When a visitor establishes a connection with the corresponding functional database, a temporarily generated key is used to establish an access channel, so that the key used each time a connection is established is unique, ensuring the uniqueness of the channel. At the same time, TLS / SSL can provide identity authentication to ensure that the communication between the visitor and the corresponding functional database is limited to the two parties. In this way, each access channel is temporarily encrypted and unique, and adjacent access channels will not interfere with each other, further improving security and achieving privacy protection.

[0065] By adopting the above technical solution: the threat detection unit is used in conjunction with the access channel connection module to achieve dual system defense processing, and the network security equipment is used for primary defense in the threat detection unit, and then a separate access channel is established for each functional database during the access process. Each access channel is temporarily encrypted and unique, and adjacent access channels will not interfere with each other, further improving the security of the entire defense system. The channel is canceled after the access is completed, which can avoid the risk of external intrusion through the access channel to a certain extent.

[0066] The log recording module is used to record the security information of the network information system, which includes at least the security time, user operations and network traffic, and to back up and store the security information so that subsequent investigations can discover abnormal behaviors and security vulnerabilities of the system;

[0067] Anomaly detection module, which includes an abnormal information collection unit and an evaluation and analysis unit;

[0068] The abnormal data set is obtained by the abnormal information collection unit, and the abnormal data set includes the number of login failures M s , Number of unauthorized accesses Ks , Network disconnection times L s , the network transmission rate Ws at each time node within the unit time T t And the number of malicious attacks B s ;

[0069] Among them, the number of login failures M s , Number of unauthorized accesses K s Indicates abnormal behavior;

[0070] Network disconnection times, network transmission rate Ws at each time node within unit time T t Indicates network abnormality;

[0071] Number of malicious attacks B s Indicates abnormal activity;

[0072] After the collected evaluation parameters are sent to the evaluation and analysis unit, the following steps are performed:

[0073] S101. Network transmission rate Ws in abnormal data set t Preprocessing is performed to obtain the network transmission rate Ws at each time node within the unit time T. t Based on this, the formula for calculating the network transmission stability coefficient Wdt is as follows:

[0074]

[0075] Where Ws t The t in the figure represents the number of the network transmission rate at different time nodes within the unit time T. For example, if the unit time T is 1h, then the time nodes are the 1st minute, the 2nd minute, and so on to the 60th minute, and the maximum value of the number t is 60.

[0076] S102: Number of failed logins M s , Number of unauthorized accesses K s , Network disconnection times L s , network transmission stability coefficient Wdt and the number of malicious attacks B s After dimensionless processing, the system abnormal state evaluation value Evos is generated, and the formula is as follows:

[0077]

[0078] In the formula, f 1 、f 2 、f 3 、f 4 、f 5 The number of failed logins M s , Number of unauthorized accesses K s, the number of malicious attacks B s , Network disconnection times L s And the preset proportional coefficient of the network transmission stability coefficient Wdt, and f 5 >f 4 >f 1 >f 2 >f 3 >0,f 1 +f 2 +f 3 +f 4 +f 5 =3.547, G is a constant correction coefficient, the specific value of which can be adjusted and set by the user, or generated by analytical function fitting, and the value of G is 1.038.

[0079] It should be noted that: the technicians in this field collect multiple groups of sample data and set corresponding preset proportional coefficients for each group of sample data; substitute the preset proportional coefficients, which can be preset proportional coefficients and the collected sample data, into the formula, and any five formulas constitute a set of linear equations of five variables, and screen and average the calculated coefficients to obtain the values; the size of the coefficient is to quantify each parameter to obtain a specific value, which is convenient for subsequent comparison. The size of the coefficient depends on the amount of sample data and the preset proportional coefficients corresponding to each group of sample data preliminarily set by the technicians in this field. It can also be said that it is preset according to the actual situation, as long as it does not affect the proportional relationship between the parameter and the quantized value. For the preset proportional coefficients and constant correction coefficients described in other formulas, the above description is also adopted;

[0080] S103, comparing the system abnormal state evaluation value Evos with a preset evaluation threshold;

[0081] If the system abnormal state evaluation value Evos does not exceed the evaluation threshold, it means that the security defense system is stable or the abnormality of the network information system will not cause the security defense system to fail;

[0082] If the system abnormal state evaluation value Evos exceeds the evaluation threshold, it means that the abnormal degree of the network information system may cause the security defense system to fail, making the network information system at risk of being invaded. The higher the system abnormal state evaluation value Evos, the greater the risk of being invaded.

[0083] By adopting the above technical solution: an anomaly detection module is established after the log recording module, and according to the collected abnormal data set, the network transmission rate Ws in the abnormal data set is tAfter preprocessing, the system abnormal state evaluation value Evos is generated to judge whether the defense system is stable. Since it comprehensively considers the behavioral abnormality factors, network abnormality factors and activity abnormality factors, the obtained system abnormal state evaluation value Evos has high accuracy and effectiveness. After comparing with the evaluation threshold, it can efficiently judge the effectiveness of the security defense system, which is convenient for providing a basis for subsequent adjustments.

[0084] When the system abnormal status evaluation value Evos exceeds the evaluation threshold, each data verification unit is triggered synchronously, and the data verification unit performs data consistency verification. The data consistency verification tool is used to detect the data integrity of the corresponding functional database. The test results are as follows:

[0085] If the detection result is abnormal, it means that the security defense system is determined to be invalid and the corresponding strategy is executed;

[0086] If the detection result is non-abnormal, that is, no abnormality is detected, it means that the security defense system is effective and the system does not take any response action.

[0087] Specifically, the data consistency verification tools used include database checksum tools and data integrity check tools;

[0088] Database checksum tools: Ensure data integrity by calculating the checksum of the data in the database, such as MD5 or SHA-256 hash values, and compare the checksum with the expected result of the previous calculation to detect any data being modified or damaged, indicating data anomalies;

[0089] Data integrity checking tools: used to perform various integrity checking operations, such as checking constraints, validating indexes and foreign key relationships, to detect and identify data loss, corruption, or inconsistency in the database, indicating data anomalies.

[0090] Cross-validation is performed through the two tools. When any tool identifies an anomaly, it means that the detection result is abnormal. When an abnormal detection result is obtained, the corresponding strategy is executed: delete the data in the corresponding functional database with an abnormal detection result, display an early warning, and schedule the regularly backed-up data to enter the corresponding functional database.

[0091] By adopting the above technical solution: using the anomaly detection module and each data verification module in conjunction, after determining that there is a risk in the security defense system, cross-verification is performed through the two verification tools in the data verification module, which can not only effectively determine whether the network information system has been invaded, but also accurately determine the location of the invasion, and combine with the backup unit to update the abnormal function database, so that the network information system can be restored to use in a very short time, while also ensuring the security of the network information system.

[0092] Embodiment 2: Based on Embodiment 1, this embodiment provides an endogenous security defense method for a network information system, comprising the following steps:

[0093] Step 1: When a user logs into the network information system, the user identity is verified and the corresponding access rights under the user identity are obtained simultaneously;

[0094] Step 2: After the user's identity is verified, the user asks the question information he needs to search on the web page. After detection and defense processing, the question information is classified, and the type of question is determined and matched to the corresponding functional database in the virtual database. The virtual database includes at least a financial database, a customer database, a market database, and a production database. Each functional database in the virtual database is also backed up regularly;

[0095] Step 3: After matching the corresponding function database, a temporary encrypted access channel using the transport layer security protocol is established, and the channel is cancelled after the access is completed;

[0096] Step 4: Record the security information of the network information system and back up and store the security information;

[0097] Step 5: Obtain an abnormal data set, pre-process the abnormal data set, generate a system abnormal state evaluation value Evos, and compare the system abnormal state evaluation value Evos with a preset evaluation threshold;

[0098] If the system abnormal status evaluation value Evos does not exceed the evaluation threshold, no response action is taken;

[0099] If the system abnormal status evaluation value Evos exceeds the evaluation threshold, the data consistency check operation of each functional database is triggered synchronously, and the data consistency check tool is used to detect whether the corresponding functional database is abnormal;

[0100] If the detection result is abnormal, the data in the corresponding function database with abnormal detection result is deleted, and the data backed up regularly is scheduled to enter the corresponding function database;

[0101] If the detection result is not abnormal, no response action is taken.

[0102] The above formulas are all dimensionless and numerical calculations. The formula is a formula for the most recent real situation obtained by collecting a large amount of data and performing software simulation. The preset parameters in the formula are set by technicians in this field according to actual conditions.

[0103] The above embodiments may be implemented in whole or in part by software, hardware, firmware or any other combination thereof. When implemented using software, the above embodiments may be implemented in whole or in part in the form of a computer program product. A person of ordinary skill in the art may appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein may be implemented in electronic hardware, or in a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution.

[0104] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, and may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0105] The above description is only a specific implementation manner of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application.

Claims

1. An endogenous security defense system for a network information system, characterized in that: include: The permission verification module verifies the user's identity and simultaneously obtains the corresponding access rights under the user's identity; After the security access module verifies the user's identity, the user asks the question information he needs to search on the web page. After detection and defense processing, the question information is classified and determined and matched to the corresponding function database in the virtual database according to the type of question. The virtual database is equipped with N function databases and data verification units corresponding to each function database to verify the data integrity in the corresponding function database; The access channel connection module, after matching the corresponding function database, establishes a temporary encrypted access channel using the transport layer security protocol, and cancels the channel after the access is completed; The log recording module records the security information of the network information system and backs up and stores the security information; The anomaly detection module obtains the abnormal data set, pre-processes the abnormal data set, generates the system abnormal state evaluation value Evos, compares the system abnormal state evaluation value Evos with the preset evaluation threshold, and synchronously triggers each data verification unit to detect whether the corresponding function database is abnormal, and executes the corresponding strategy for the abnormal function database, deletes and re-enters the data in the corresponding function database when the system abnormal state evaluation value Evos exceeds the evaluation threshold; The anomaly detection module includes an anomaly information collection unit and an evaluation and analysis unit. The anomaly data set obtained by the anomaly information collection unit includes the number of login failures. , Number of unauthorized accesses , Network disconnection times , the network transmission rate at each time node within the unit time T and the number of malicious attacks ; In the evaluation and analysis unit, the network transmission rate in the abnormal data set is Preprocessing is performed based on the network transmission rate at each time node within the unit time T Based on this, the network transmission stability coefficient is calculated and generated. The dt formula is as follows: ； In the formula, The t in the figure represents the number of the network transmission rate at different time nodes within the unit time T; In the evaluation and analysis unit, the number of failed logins , Number of unauthorized accesses , Network disconnection times , Network transmission stability coefficient dt and the number of malicious attacks After dimensionless processing, the system abnormal state evaluation value Evos is generated, and the formula is as follows: ； In the formula, The number of failed logins , Number of unauthorized accesses , the number of malicious attacks , Network disconnection times And the network transmission stability factor The preset scaling factor of dt, and 0, , G is the constant correction coefficient.

2. The network information system endogenous security defense system according to claim 1, characterized in that: The security access module includes a threat detection unit, a classification matching unit, and a virtual database; The threat detection unit monitors and analyzes data traffic in real time through network security equipment, identifies potential threats and attacks, and takes defensive measures. The classification and matching unit uses natural language processing technology to classify problem information. The virtual database includes at least a financial database, a customer database, a market database, and a production database.

3. The network information system endogenous security defense system according to claim 2 is characterized by: The virtual database also includes a backup unit for regularly backing up the financial database, customer database, market database and production database in the virtual database.

4. The network information system endogenous security defense system according to claim 3 is characterized by: In the evaluation and analysis unit, the system abnormal state evaluation value Evos is compared with a preset evaluation threshold; If the system abnormal status evaluation value Evos does not exceed the evaluation threshold, no response action is taken; if the system abnormal status evaluation value Evos exceeds the evaluation threshold, each data verification unit is triggered synchronously, and the data verification unit performs data consistency verification and uses a data consistency verification tool to detect whether the corresponding functional database is abnormal. The data consistency verification tools used include database checksum tools and data integrity check tools.

5. The network information system endogenous security defense system according to claim 4 is characterized by: When checking whether the corresponding function database is abnormal, the results are as follows: If the detection result is abnormal, the corresponding strategy is executed. The content of executing the corresponding strategy is: delete the data in the corresponding functional database with abnormal detection result, and schedule the data regularly backed up by the backup unit to enter the corresponding functional database; if the detection result is not abnormal, no response action is taken.

6. A method for endogenous security defense of a network information system, using any system described in claim 1 to claim 5, characterized in that: The steps include: Step 1: When a user logs into the network information system, the user identity is verified and the corresponding access rights under the user identity are obtained simultaneously; Step 2: After the user's identity is verified, the user asks the question information he needs to search on the web page. After detection and defense processing, the question information is classified, and the type of question is determined and matched to the corresponding functional database in the virtual database. The virtual database includes at least a financial database, a customer database, a market database, and a production database. Each functional database in the virtual database is also backed up regularly; Step 3: After matching the corresponding function database, a temporary encrypted access channel using the transport layer security protocol is established, and the channel is cancelled after the access is completed; Step 4: Record the security information of the network information system and back up and store the security information; Step 5: Obtain an abnormal data set, pre-process the abnormal data set, generate a system abnormal state evaluation value Evos, and compare the system abnormal state evaluation value Evos with a preset evaluation threshold; If the system abnormal status evaluation value Evos does not exceed the evaluation threshold, no response action is taken; If the system abnormal status evaluation value Evos exceeds the evaluation threshold, the data consistency check operation of each functional database is triggered synchronously, and the data consistency check tool is used to detect whether the corresponding functional database is abnormal; If the detection result is abnormal, the data in the corresponding function database with abnormal detection result is deleted, and the data backed up regularly is scheduled to enter the corresponding function database; If the detection result is not abnormal, no response action is taken.

Images