A network information security supervision method and system

Abstract

The invention discloses a network information security supervision method, which relates to the technical field of network security, and includes obtaining performance monitoring data, flow data and log data of each process subsequence; filtering out invalid flow data, abnormal flow data, normal log data and vulnerability-related log data; obtaining historical data within several historical monitoring periods of each process subsequence, obtaining the monitoring time of abnormal flow data and vulnerability-related log data in the historical data, and packaging the abnormal flow data and vulnerability-related log data into a potential associated aggregation package according to the monitoring time; according to the vulnerability type of the vulnerability feature data associated with the vulnerability-related log data in the potential associated aggregation package, aggregating associated aggregation packages with the same vulnerability type, and constructing several dynamic subnetworks; performing similarity matching between the abnormal flow data of the process subsequence and the abnormal flow data of several dynamic subnetworks, and formulating network preventive measures according to the matching results. The accuracy and effectiveness of network security supervision are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a network information security supervision method. Background Art

[0002] The prior art CN115550063A "A method and system for network information security supervision" includes acquiring network security data, log data and network audit data; cleaning the acquired data and classifying and storing them in different object libraries, wherein the cleaning process includes data preprocessing and data format verification; defining corresponding violation strategies for the data types in the object library; performing violation analysis on the data in the object library to analyze whether a violation event occurs; verifying and supervising the violation event; the object library is provided with access rights for entry operations, and the entry operations include query, statistics, export and backup; the present invention aggregates network security data, log data and network audit data for comprehensive analysis, defines corresponding violation strategies for different data types, and verifies and supervises violation events, thereby improving the network confidentiality risk management and governance capabilities of government agencies.

[0003] The prior art CN116681568A "A system and method for information security protection supervision based on 5G network" includes a data acquisition module, a data processing module, an operation management module and a visualization module; the data acquisition module is used to collect image information in a specified area through a camera; the data processing module uses a face detection algorithm to identify facial information in the image information, classify and mark the corresponding personnel, retrieve all seat information in the specified area in the system and mark it, and divide the area into types within the specified area; the operation management module is used to analyze the personnel position in real time to set the personnel status, and perform blurring processing according to the personnel status; the visualization module is used to display the processed image information in real time; the present invention realizes the protection of personnel privacy and security while monitoring the designated area, and reduces the risk of information leakage.

[0004] Network data is of various types and huge in volume. Due to the complexity of the network structure, attacks and malicious behaviors against the network are increasing, and attacks on network systems that exploit vulnerabilities and security flaws in the network are endless. Existing network security early warning methods can effectively detect abnormal traffic, abnormal log data, etc. in the network and identify network risks. However, most of the current anomaly detection algorithms stop at labeling each piece of data as normal or abnormal. Some of these anomalies are false anomalies. A large amount of false anomaly data is mixed with a small amount of abnormal data that is correctly judged as abnormal, which will seriously weaken the availability of the intrusion detection system. This is also one of the reasons why anomaly-based intrusion detection systems are difficult to use in practice. In addition, the early intrusion trend before the network operation terminal changes from a normal state to an intrusion state is often difficult to detect, which may lead to the inability to take preventive measures before the network intrusion. Summary of the Invention

[0005] In order to solve the above technical problems, the purpose of the present invention is to provide a network information security supervision method, comprising the following steps:

[0006] Step S1: Divide the current operation process of the network operation terminal into several process sub-sequences, and obtain performance monitoring data, flow data and log data of each process sub-sequence;

[0007] Step S2: Compare the performance monitoring data and flow data of each process subsequence with the performance monitoring standard and the standard flow two-dimensional curve, filter out invalid flow data and abnormal flow data based on the comparison results, preset a vulnerability database, match the log data of the process subsequence with the vulnerability feature data, and filter out normal log data and vulnerability-related log data based on the matching results;

[0008] Step S3: Obtain historical data from several historical monitoring periods for each process subsequence, obtain the monitoring time of abnormal traffic data and vulnerability-related log data in the historical data, and package the abnormal traffic data and vulnerability-related log data into a group of potential correlation aggregation packages based on the monitoring time; based on the vulnerability type of the vulnerability feature data associated with the vulnerability-related log data in the potential correlation aggregation package, aggregate the correlation aggregation packages with the same vulnerability type to construct several dynamic subnetworks;

[0009] Step S4: perform similarity matching on the abnormal traffic data of the process subsequence in the current monitoring period and the abnormal traffic data of several dynamic sub-networks, and formulate network prevention measures based on the matching results.

[0010] Furthermore, the operation process of the current network operation terminal is divided into several process sub-sequences, and the process of obtaining performance monitoring data, flow data and log data of each process sub-sequence includes:

[0011] Obtain the running process characteristics of the current network running terminal, extract process information based on the running process characteristics, and split the network running process according to the process information into several process sub-sequences;

[0012] A network security monitoring point is set in each process subsequence. The network security monitoring point is used to obtain performance monitoring data, flow data and log data of each process subsequence, mark the monitoring time, and set the monitoring cycle.

[0013] Furthermore, the performance monitoring data and flow data of each process subsequence are compared with the performance monitoring standard and the standard flow two-dimensional curve. The process of screening out invalid flow data and abnormal flow data based on the comparison results includes:

[0014] Based on the operational process characteristics of each process subsequence, a performance monitoring standard and a two-dimensional standard flow curve are obtained for each process subsequence, where the horizontal axis of the two-dimensional standard flow curve is time and the vertical axis is flow. The performance monitoring data and flow data monitored at the network security monitoring point of each process subsequence are compared with the performance monitoring standard and the two-dimensional standard flow curve corresponding to each process subsequence, respectively, to obtain the performance monitoring data error of each process subsequence and the flow data error at each moment;

[0015] Preset a performance error threshold and a flow error threshold, and compare the performance monitoring data error and flow data error of each process subsequence with the performance error threshold and the flow error threshold respectively;

[0016] Mark the flow data whose performance monitoring data error is less than or equal to the performance error threshold and whose flow data error is greater than the flow error threshold as invalid flow data;

[0017] Traffic data whose performance monitoring data error is greater than the performance error threshold and whose traffic data error is greater than the traffic error threshold is marked as abnormal traffic data.

[0018] Furthermore, a vulnerability database is preset, and the log data of the process subsequence is matched with the vulnerability feature data. The process of filtering out normal log data and vulnerability-related log data based on the matching results includes:

[0019] A vulnerability database is preset, the vulnerability database contains a number of vulnerability feature data, a regular vulnerability scanning time interval is preset, log data of a process subsequence is obtained, and the log data of the process subsequence is regularly matched with the vulnerability feature data according to the regular vulnerability scanning time interval. If the flow data of the process subsequence is marked as abnormal flow data within the regular vulnerability scanning time interval, the log data of the process subsequence at this moment is immediately matched with the vulnerability feature data;

[0020] If the log data of the process subsequence successfully matches the vulnerability feature data, the vulnerability feature data is associated with the log data, and the log data is marked as vulnerability-associated log data;

[0021] If the log data of the process subsequence fails to match the vulnerability feature data, the log data is marked as normal log data.

[0022] Furthermore, the process of obtaining historical data within several historical monitoring periods of each process subsequence, obtaining the monitoring time of abnormal traffic data and vulnerability-related log data in the historical data, and packaging the abnormal traffic data and vulnerability-related log data into a group of potential correlation aggregation packages according to the monitoring time includes:

[0023] Obtain historical performance monitoring data, historical traffic data, and historical log data for several historical monitoring periods of each process subsequence, filter out abnormal traffic data and vulnerability-related log data within several historical monitoring periods, and obtain the monitoring time of the abnormal traffic data and vulnerability-related log data;

[0024] A preset time aggregation threshold is used to obtain the monitoring time difference between the monitoring time of each abnormal traffic data and the monitoring time of each vulnerability-related log data in several historical monitoring periods, and the abnormal traffic data and vulnerability-related log data whose monitoring time difference is less than or equal to the time aggregation threshold are packaged into a group of potential associated aggregation packages.

[0025] Furthermore, according to the vulnerability type of the vulnerability feature data associated with the vulnerability association log data in the potential association aggregation package, the association aggregation packages with the same vulnerability type are aggregated to construct several dynamic sub-networks, including:

[0026] Obtain all potential associated aggregation packages within several historical monitoring periods, obtain vulnerability feature data associated with vulnerability associated log data in all potential associated aggregation packages, obtain vulnerability types of vulnerability feature data, aggregate potential associated aggregation packages with the same vulnerability type, build a dynamic subnetwork, use abnormal traffic data in the aggregation of potential associated aggregation packages with the same vulnerability type as nodes of the dynamic subnetwork, obtain several dynamic subnetworks with different vulnerability types, build a subnetwork database, and store several dynamic subnetworks with different vulnerability types in the subnetwork database.

[0027] Furthermore, the abnormal traffic data of the process subsequence in the current monitoring period is matched with the abnormal traffic data of several dynamic sub-networks for similarity, and the process of formulating network preventive measures based on the matching results includes:

[0028] Determine whether the flow data of the process subsequence in the current monitoring period is marked as abnormal flow data; if the flow data of the process subsequence in the current monitoring period is marked as abnormal flow data, determine whether the log data of the process subsequence in the current monitoring period is vulnerability-related log data; if the log data of the process subsequence in the current monitoring period is vulnerability-related log data, obtain the vulnerability type of the vulnerability feature data associated with the vulnerability-related log data, and formulate network prevention measures based on the vulnerability type;

[0029] If the log data of the process subsequence in the current monitoring period is normal log data, the abnormal traffic data of the process subsequence in the current monitoring period is transmitted to the subnetwork database, and the abnormal traffic data of the process subsequence is matched with the abnormal traffic data of each dynamic subnetwork in the subnetwork database by numerical attributes, and the similarity between the abnormal traffic data of the process subsequence and the abnormal traffic data of each dynamic subnetwork in the subnetwork database is obtained, and the dynamic subnetwork to which the abnormal traffic data with the highest similarity belongs is screened out, and the vulnerability type of the vulnerability feature data in the dynamic subnetwork is obtained, and network prevention measures are formulated according to the vulnerability type.

[0030] A network information security supervision system includes a monitoring center, wherein the monitoring center is communicatively connected to a data acquisition module, a data analysis module, a time series aggregation module, and a network prevention module;

[0031] The data acquisition module is used to divide the current operation process of the network operation terminal into several process sub-sequences and obtain performance monitoring data, flow data and log data of each process sub-sequence;

[0032] The data analysis module is used to compare the performance monitoring data and flow data of each process subsequence with the performance monitoring standard and the standard flow two-dimensional curve, filter out invalid flow data and abnormal flow data based on the comparison results, preset a vulnerability database, match the log data of the process subsequence with the vulnerability feature data, and filter out normal log data and vulnerability-related log data based on the matching results;

[0033] The time series aggregation module is used to obtain historical data within several historical monitoring periods of each process subsequence, obtain the monitoring time of abnormal traffic data and vulnerability-related log data in the historical data, and package the abnormal traffic data and vulnerability-related log data into a group of potential correlation aggregation packages based on the monitoring time; based on the vulnerability type of the vulnerability feature data associated with the vulnerability-related log data in the potential correlation aggregation package, aggregate the correlation aggregation packages with the same vulnerability type to construct several dynamic subnetworks;

[0034] The network prevention module is used to perform similarity matching between abnormal traffic data of the process subsequence in the current monitoring period and abnormal traffic data of several dynamic subnetworks, and formulate network prevention measures according to the matching results.

[0035] Compared with the prior art, the present invention has the following beneficial effects:

[0036] 1. Compare the performance monitoring data and flow data of each process subsequence with the performance monitoring standard and the standard flow two-dimensional curve. Filter out invalid flow data and abnormal flow data based on the comparison results to avoid mixing a large amount of false abnormal flow data with a small amount of abnormal data that is correctly judged as abnormal, thereby improving the availability of network security supervision.

[0037] 2. Pack abnormal traffic data and vulnerability-related log data into a group of potential-related aggregation packages based on the monitoring time; aggregate the associated aggregation packages with the same vulnerability type based on the vulnerability type of the vulnerability feature data associated with the vulnerability-related log data in the potential-related aggregation package, build several dynamic sub-networks, perform similarity matching on the abnormal traffic data of the process sub-sequence of the current monitoring cycle with the abnormal traffic data of several dynamic sub-networks, formulate network prevention measures based on the matching results, and realize the prediction of early intrusion before the network operation terminal changes from a normal state to an intrusion state, so as to take preventive measures before the network intrusion, and improve the accuracy and effectiveness of network security supervision. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 This is a schematic diagram of a network information security supervision method according to an embodiment of the present application.

[0039] Figure 2 This is a schematic diagram of a network information security supervision system according to an embodiment of the present application. DETAILED DESCRIPTION

[0040] The following is a clear and complete description of the technical solutions in the embodiments of the present application in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without making creative efforts are within the scope of protection of this application.

[0041] like Figure 1 As shown, a network information security supervision method includes the following steps:

[0042] Step S1: Divide the current operation process of the network operation terminal into several process sub-sequences, and obtain performance monitoring data, flow data and log data of each process sub-sequence;

[0043] Step S2: Compare the performance monitoring data and flow data of each process subsequence with the performance monitoring standard and the standard flow two-dimensional curve, filter out invalid flow data and abnormal flow data based on the comparison results, preset a vulnerability database, match the log data of the process subsequence with the vulnerability feature data, and filter out normal log data and vulnerability-related log data based on the matching results;

[0044] Step S3: Obtain historical data from several historical monitoring periods for each process subsequence, obtain the monitoring time of abnormal traffic data and vulnerability-related log data in the historical data, and package the abnormal traffic data and vulnerability-related log data into a group of potential correlation aggregation packages based on the monitoring time; based on the vulnerability type of the vulnerability feature data associated with the vulnerability-related log data in the potential correlation aggregation package, aggregate the correlation aggregation packages with the same vulnerability type to construct several dynamic subnetworks;

[0045] Step S4: perform similarity matching on the abnormal traffic data of the process subsequence in the current monitoring period and the abnormal traffic data of several dynamic sub-networks, and formulate network prevention measures based on the matching results.

[0046] It should be further explained that, in a specific implementation process, the operation process of the current network operation terminal is divided into several process sub-sequences, and the process of obtaining performance monitoring data, traffic data, and log data of each process sub-sequence includes:

[0047] Obtain the running process characteristics of the current network running terminal, extract process information based on the running process characteristics, and split the network running process according to the process information into several process sub-sequences;

[0048] A network security monitoring point is set in each process subsequence. The network security monitoring point is used to obtain performance monitoring data, flow data and log data of each process subsequence, mark the monitoring time, and set the monitoring cycle.

[0049] It should be further explained that, in the specific implementation process, the performance monitoring data and flow data of each process subsequence are compared with the performance monitoring standard and the standard flow two-dimensional curve. The process of screening out invalid flow data and abnormal flow data based on the comparison results includes:

[0050] Based on the operational process characteristics of each process subsequence, a performance monitoring standard and a two-dimensional standard flow curve are obtained for each process subsequence, where the horizontal axis of the two-dimensional standard flow curve is time and the vertical axis is flow. The performance monitoring data and flow data monitored at the network security monitoring point of each process subsequence are compared with the performance monitoring standard and the two-dimensional standard flow curve corresponding to each process subsequence, respectively, to obtain the performance monitoring data error of each process subsequence and the flow data error at each moment;

[0051] Preset a performance error threshold and a flow error threshold, and compare the performance monitoring data error and flow data error of each process subsequence with the performance error threshold and the flow error threshold respectively;

[0052] Mark the flow data whose performance monitoring data error is less than or equal to the performance error threshold and whose flow data error is greater than the flow error threshold as invalid flow data;

[0053] Traffic data whose performance monitoring data error is greater than the performance error threshold and whose traffic data error is greater than the traffic error threshold is marked as abnormal traffic data.

[0054] It should be further explained that, in the specific implementation process, a vulnerability database is preset, and the log data of the process subsequence is matched with the vulnerability feature data. The process of screening out normal log data and vulnerability-related log data based on the matching results includes:

[0055] A vulnerability database is preset, and the vulnerability database contains a number of vulnerability feature data, wherein the vulnerability data features include keywords, vulnerability types, affected components or applications, etc., so as to be subsequently matched with log data. A regular vulnerability scanning time interval is preset, and log data of a process subsequence is obtained. The log data of the process subsequence is regularly matched with the vulnerability feature data according to the regular vulnerability scanning time interval. If the flow data of the process subsequence is marked as abnormal flow data within the regular vulnerability scanning time interval, the log data of the process subsequence at this moment is immediately matched with the vulnerability feature data.

[0056] If the log data of the process subsequence successfully matches the vulnerability feature data, the vulnerability feature data is associated with the log data, and the log data is marked as vulnerability-associated log data;

[0057] If the log data of the process subsequence fails to match the vulnerability feature data, the log data is marked as normal log data.

[0058] It should be further explained that, in a specific implementation process, the process of obtaining historical data within several historical monitoring periods of each process subsequence, obtaining the monitoring time of abnormal traffic data and vulnerability-related log data in the historical data, and packaging the abnormal traffic data and vulnerability-related log data into a group of potential correlation aggregation packages according to the monitoring time includes:

[0059] Obtain historical performance monitoring data, historical traffic data, and historical log data for several historical monitoring periods of each process subsequence, filter out abnormal traffic data and vulnerability-related log data within several historical monitoring periods, and obtain the monitoring time of the abnormal traffic data and vulnerability-related log data;

[0060] A preset time aggregation threshold is used to obtain the monitoring time difference between the monitoring time of each abnormal traffic data and the monitoring time of each vulnerability-related log data in several historical monitoring periods, and the abnormal traffic data and vulnerability-related log data whose monitoring time difference is less than or equal to the time aggregation threshold are packaged into a group of potential associated aggregation packages.

[0061] It should be further explained that, in the specific implementation process, based on the vulnerability type of the vulnerability feature data associated with the vulnerability correlation log data in the potential correlation aggregation package, the correlation aggregation packages with the same vulnerability type are aggregated to construct several dynamic sub-networks, including the following process:

[0062] Obtain all potential associated aggregation packages within several historical monitoring periods, obtain vulnerability feature data associated with vulnerability associated log data in all potential associated aggregation packages, obtain vulnerability types of vulnerability feature data, aggregate potential associated aggregation packages with the same vulnerability type, build a dynamic subnetwork, use abnormal traffic data in the aggregation of potential associated aggregation packages with the same vulnerability type as nodes of the dynamic subnetwork, obtain several dynamic subnetworks with different vulnerability types, build a subnetwork database, and store several dynamic subnetworks with different vulnerability types in the subnetwork database.

[0063] It should be further explained that, in the specific implementation process, the abnormal traffic data of the process subsequence in the current monitoring period is matched with the abnormal traffic data of several dynamic sub-networks for similarity, and the process of formulating network prevention measures based on the matching results includes:

[0064] Determine whether the flow data of the process subsequence in the current monitoring period is marked as abnormal flow data; if the flow data of the process subsequence in the current monitoring period is marked as abnormal flow data, determine whether the log data of the process subsequence in the current monitoring period is vulnerability-related log data; if the log data of the process subsequence in the current monitoring period is vulnerability-related log data, obtain the vulnerability type of the vulnerability feature data associated with the vulnerability-related log data, and formulate network prevention measures based on the vulnerability type;

[0065] If the log data of the process subsequence in the current monitoring period is normal log data, the abnormal traffic data of the process subsequence in the current monitoring period is transmitted to the subnetwork database, and the abnormal traffic data of the process subsequence is matched with the abnormal traffic data of each dynamic subnetwork in the subnetwork database by numerical attributes, and the similarity between the abnormal traffic data of the process subsequence and the abnormal traffic data of each dynamic subnetwork in the subnetwork database is obtained, and the dynamic subnetwork to which the abnormal traffic data with the highest similarity belongs is screened out, and the vulnerability type of the vulnerability feature data in the dynamic subnetwork is obtained, and network prevention measures are formulated according to the vulnerability type.

[0066] It should be further explained that, in the specific implementation process, the formula for matching the numerical attributes of the abnormal flow data of the process subsequence with the abnormal flow data of each dynamic subnetwork in the subnetwork database is:

[0067]

[0068] Where z represents the similarity, Q at represents the abnormal flow data at the tth moment of the process subsequence, Q bt represents the abnormal traffic data of the dynamic sub-network at the tth moment, N represents the time span of the monitoring period where the abnormal traffic data is located, Dist(Q at , Q bt ) represents the distance between the abnormal flow data of the dynamic sub-network at the tth moment and the numerical attribute of the abnormal flow data of the process sub-sequence at the tth moment.

[0069] like Figure 2 As shown, a network information security supervision system includes a monitoring center, wherein the monitoring center is communicatively connected to a data acquisition module, a data analysis module, a time series aggregation module and a network prevention module;

[0070] The data acquisition module is used to divide the current operation process of the network operation terminal into several process sub-sequences and obtain performance monitoring data, flow data and log data of each process sub-sequence;

[0071] The data analysis module is used to compare the performance monitoring data and flow data of each process subsequence with the performance monitoring standard and the standard flow two-dimensional curve, filter out invalid flow data and abnormal flow data based on the comparison results, preset a vulnerability database, match the log data of the process subsequence with the vulnerability feature data, and filter out normal log data and vulnerability-related log data based on the matching results;

[0072] The time series aggregation module is used to obtain historical data within several historical monitoring periods of each process subsequence, obtain the monitoring time of abnormal traffic data and vulnerability-related log data in the historical data, and package the abnormal traffic data and vulnerability-related log data into a group of potential correlation aggregation packages based on the monitoring time; based on the vulnerability type of the vulnerability feature data associated with the vulnerability-related log data in the potential correlation aggregation package, aggregate the correlation aggregation packages with the same vulnerability type to construct several dynamic subnetworks;

[0073] The network prevention module is used to perform similarity matching between abnormal traffic data of the process subsequence in the current monitoring period and abnormal traffic data of several dynamic subnetworks, and formulate network prevention measures according to the matching results.

[0074] The above embodiments are only used to illustrate the technical method of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical method of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical method of the present invention.

Claims

1. A network information security supervision method, characterized in that: The following steps are involved: Step S1: Divide the operation process of the current network operation terminal into several process sub-sequences, and obtain performance monitoring data, flow data and log data of each process sub-sequence; Step S2: Compare the performance monitoring data and flow data of each process subsequence with the performance monitoring standard and the standard flow two-dimensional curve, filter out invalid flow data and abnormal flow data according to the comparison results, preset a vulnerability database, match the log data of the process subsequence with the vulnerability feature data, and filter out normal log data and vulnerability-related log data according to the matching results; Step S3: obtaining historical data within several historical monitoring periods of each process subsequence, obtaining the monitoring time of abnormal traffic data and vulnerability-related log data in the historical data, and packaging the abnormal traffic data and vulnerability-related log data into a group of potential associated aggregation packages according to the monitoring time; According to the vulnerability type of the vulnerability feature data associated with the vulnerability association log data in the potential association aggregation package, the association aggregation packages with the same vulnerability type are aggregated to construct several dynamic sub-networks; Step S4: performing similarity matching between the abnormal traffic data of the process subsequence in the current monitoring period and the abnormal traffic data of several dynamic subnetworks, and formulating network prevention measures according to the matching results; The process of dividing the operation process of the current network operation terminal into several process sub-sequences and obtaining the performance monitoring data, flow data and log data of each process sub-sequence includes: Obtain the operation process characteristics of the current network operation terminal, extract process information according to the operation process characteristics, split the network operation process according to the process information, and divide it into several process sub-sequences; Set a network security monitoring point in each process subsequence, which is used to obtain performance monitoring data, flow data and log data of each process subsequence, mark the monitoring time, and set the monitoring cycle; The process of comparing the performance monitoring data and flow data of each process subsequence with the performance monitoring standard and the standard flow two-dimensional curve, and screening out invalid flow data and abnormal flow data according to the comparison results includes: According to the running process characteristics of each process subsequence, the performance monitoring standard and the standard flow two-dimensional curve of each process subsequence are obtained, the horizontal axis of the standard flow two-dimensional curve is time, and the vertical axis is flow. The performance monitoring data and flow data monitored by the network security monitoring point of each process subsequence are compared with the performance monitoring standard and the standard flow two-dimensional curve corresponding to each process subsequence, and the performance monitoring data error of each process subsequence and the flow data error at each moment are obtained; Preset a performance error threshold and a flow error threshold, and compare the performance monitoring data error and flow data error of each process subsequence with the performance error threshold and the flow error threshold respectively; Marking the flow data whose performance monitoring data error is less than or equal to the performance error threshold and whose flow data error is greater than the flow error threshold as invalid flow data; Marking the flow data whose performance monitoring data error is greater than the performance error threshold and whose flow data error is greater than the flow error threshold as abnormal flow data; The vulnerability database is preset, and the log data of the process subsequence is matched with the vulnerability feature data. The process of filtering out normal log data and vulnerability-related log data according to the matching results includes: A vulnerability database is preset, the vulnerability database includes a number of vulnerability feature data, a regular vulnerability scanning time interval is preset, the log data of the process subsequence is obtained, and the log data of the process subsequence is regularly matched with the vulnerability feature data according to the regular vulnerability scanning time interval. If the flow data of the process subsequence is marked as abnormal flow data within the regular vulnerability scanning time interval, the log data of the process subsequence at this moment is immediately matched with the vulnerability feature data; If the log data of the process subsequence matches the vulnerability feature data successfully, the vulnerability feature data is associated with the log data, and the log data is marked as vulnerability associated log data; If the log data of the process subsequence fails to match the vulnerability feature data, the log data is marked as normal log data; The process of obtaining historical data in several historical monitoring cycles of each process subsequence, obtaining the monitoring time of abnormal traffic data and vulnerability-related log data in the historical data, and packaging the abnormal traffic data and vulnerability-related log data into a group of potential associated aggregation packages according to the monitoring time includes: Obtain historical performance monitoring data, historical traffic data, and historical log data within several historical monitoring periods of each process subsequence, and filter out abnormal traffic data and vulnerability-related log data within several historical monitoring periods, and simultaneously obtain the monitoring time of the abnormal traffic data and vulnerability-related log data; Preset a time aggregation threshold, obtain the monitoring time difference between the monitoring time of each abnormal traffic data and the monitoring time of each vulnerability-related log data in several historical monitoring periods, and package the abnormal traffic data and vulnerability-related log data whose monitoring time difference is less than or equal to the time aggregation threshold into a group of potential associated aggregation packages; According to the vulnerability type of the vulnerability feature data associated with the vulnerability correlation log data in the potential correlation aggregation package, the correlation aggregation packages with the same vulnerability type are aggregated, and the process of constructing several dynamic sub-networks includes: Obtain all potential associated aggregation packages within several historical monitoring periods, obtain vulnerability feature data associated with vulnerability associated log data in all potential associated aggregation packages, obtain vulnerability types of vulnerability feature data, aggregate potential associated aggregation packages with the same vulnerability type, build a dynamic sub-network, use abnormal traffic data in the aggregation of potential associated aggregation packages with the same vulnerability type as nodes of the dynamic sub-network, obtain several dynamic sub-networks with different vulnerability types, build a sub-network database, and store several dynamic sub-networks with different vulnerability types in the sub-network database; The process of performing similarity matching between the abnormal traffic data of the process subsequence in the current monitoring cycle and the abnormal traffic data of several dynamic subnetworks and formulating network prevention measures based on the matching results includes: Determine whether the flow data of the process subsequence in the current monitoring period is marked as abnormal flow data. If the flow data of the process subsequence in the current monitoring period is marked as abnormal flow data, determine whether the log data of the process subsequence in the current monitoring period is vulnerability-related log data. If the log data of the process subsequence in the current monitoring period is vulnerability-related log data, obtain the vulnerability type of the vulnerability feature data associated with the vulnerability-related log data, and formulate network prevention measures according to the vulnerability type. If the log data of the process subsequence in the current monitoring period is normal log data, the abnormal traffic data of the process subsequence in the current monitoring period is transmitted to the subnetwork database, and the abnormal traffic data of the process subsequence is matched with the abnormal traffic data of each dynamic subnetwork in the subnetwork database by numerical attributes, and the similarity between the abnormal traffic data of the process subsequence and the abnormal traffic data of each dynamic subnetwork in the subnetwork database is obtained, and the dynamic subnetwork to which the abnormal traffic data with the highest similarity belongs is screened out, and the vulnerability type of the vulnerability feature data in the dynamic subnetwork is obtained, and network prevention measures are formulated according to the vulnerability type.

2. A network information security supervision system, specifically applied to a network information security supervision method according to claim 1, comprising a monitoring center, characterized in that: The monitoring center is communicatively connected with a data acquisition module, a data analysis module, a time series aggregation module and a network prevention module; The data acquisition module is used to divide the operation process of the current network operation terminal into several process sub-sequences, and obtain the performance monitoring data, flow data and log data of each process sub-sequence; The data analysis module is used to compare the performance monitoring data and flow data of each process subsequence with the performance monitoring standard and the standard flow two-dimensional curve, filter out invalid flow data and abnormal flow data according to the comparison results, preset a vulnerability database, match the log data of the process subsequence with the vulnerability feature data, and filter out normal log data and vulnerability-related log data according to the matching results; The time series aggregation module is used to obtain historical data within several historical monitoring periods of each process subsequence, obtain the monitoring time of abnormal flow data and vulnerability-related log data in the historical data, and package the abnormal flow data and vulnerability-related log data into a group of potential associated aggregation packages according to the monitoring time; According to the vulnerability type of the vulnerability feature data associated with the vulnerability association log data in the potential association aggregation package, the association aggregation packages with the same vulnerability type are aggregated to construct several dynamic sub-networks; The network prevention module is used to perform similarity matching between the abnormal traffic data of the process subsequence in the current monitoring period and the abnormal traffic data of several dynamic subnetworks, and formulate network prevention measures according to the matching results.

Images