Automated defense system for computer network security in universities

Abstract

The invention relates to the field of network security, and in particular to an automated defense system for the network security of university computers, and is used to solve the problem that the existing automated defense system for the network security of university computers cannot accurately monitor the security status of university computers through multi-faceted data, resulting in that university computers are susceptible to various security threats, and the defense efficiency and real-time performance of network security are poor; the system comprises a risk monitoring module, a risk analysis module, an analysis and judgment module, a notification management module, a security defense module, a threat discrimination module and a threat analysis module; the system can monitor the security status of university computers in real time, accurately monitor and identify various security threats without manual intervention, greatly improve the defense efficiency of network security, and once a threat is detected, the system automatically triggers defense measures and starts a security emergency plan to protect university computers from security threats, thereby ensuring the real-time performance of network security.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to an automated defense system for the network security of university computers. Background Art

[0002] With the rapid development of information technology, university computer network systems have become an important support for teaching, scientific research, and management. However, due to the complexity and diversity of the network environment, university computer networks face various security threats. Traditional network security defense methods often rely on manual operation and judgment, and cannot respond to various security threats in a timely and accurate manner, resulting in frequent network security incidents, which have a serious impact on the normal operation of universities.

[0003] The patent with application number CN202310523298.3 discloses an automated defense system, method and device for university computer network security, which relates to the field of Internet security technology. Each LAN gateway extracts the semantic features of each HTTP data and sends the semantic features to the cloud server; the cloud server matches the semantic features in the shared blockchain and returns the matching results to the corresponding LAN gateway; the shared blockchain saves the semantic features of the attack behaviors that have been detected in the history of each LAN gateway; each LAN gateway is also used to cluster and classify the semantic features in turn if the matching result is no, to determine whether each HTTP data is an attack behavior. Sharing attack detection intelligence through a shared blockchain can improve the detection efficiency of the LAN, and extracting the semantic features of HTTP data for clustering and classification detection can improve the performance of network attack detection, but there are still the following shortcomings: it is impossible to accurately monitor the security status of university computers through multi-faceted data, resulting in university computers being vulnerable to various security threats, and the defense efficiency and real-time performance of network security are poor. Summary of the invention

[0004] In order to overcome the above-mentioned technical problems, the purpose of the present invention is to provide an automated defense system for the network security of university computers, which solves the problem that the existing automated defense system for the network security of university computers cannot accurately monitor the security status of university computers through various data, resulting in university computers being vulnerable to various security threats and the network security defense efficiency and real-time performance are poor.

[0005] The purpose of the present invention can be achieved through the following technical solutions:

[0006] An automated defense system for university computer network security, including:

[0007] The hazard monitoring module is used to obtain the hazard analysis parameters of the analysis object and send the hazard analysis parameters to the hazard analysis module; wherein the hazard analysis parameters include transmission information TR, access information FW, loss and modification information DG and value information JZ;

[0008] The risk analysis module is used to obtain the risk analysis coefficient WX according to the risk analysis parameters, and send the risk analysis coefficient WX to the analysis and judgment module;

[0009] The specific process of the risk analysis module obtaining the risk analysis coefficient WX is as follows:

[0010] The values ​​of the transmission information TR, the access information FW, the loss and modification information DG and the value information JZ are quantified according to the preset risk analysis function to obtain the risk analysis coefficient WX, and the risk analysis coefficient WX is sent to the analysis and judgment module;

[0011] The hazard analysis function is as follows:

[0012]

[0013] Where:

[0014] κ is the preset error adjustment factor, taking κ = 0.827;

[0015] Both π and e are mathematical constants;

[0016] w1, w2, w3 and w4 are respectively the preset weight factors corresponding to the transmission information TR, access information FW, loss and modification information DG and value information JZ. w1, w2, w3 and w4 satisfy w1>w2>w3>w4>2.366, and w1=4.19, w2=3.76, w3=3.25, w4=2.88;

[0017] The analysis and judgment module is used to generate a notification management instruction and a security defense instruction according to the risk analysis coefficient WX, and send the notification management instruction to the notification management module and send the security defense instruction to the security defense module;

[0018] A notification management module is used to remind network security management after receiving notification management instructions;

[0019] The security defense module is used to disconnect the network connection of the analysis object after receiving the security defense instruction.

[0020] As a further solution of the present invention: the specific process of the hazard monitoring module obtaining the hazard analysis parameters is as follows:

[0021] Obtain the university computer for automated defense as the analysis object, take the current time as the end of the time period, take the preset duration as the danger monitoring duration, obtain the time period start point, obtain the time period between the time period start point and the time period end point, and mark it as the danger monitoring time;

[0022] The number of bytes of data transmitted in the computer network during the danger monitoring time of the analysis object is obtained, and it is marked as the transmission value CS; the maximum data transmission rate during the danger monitoring time of the analysis object is obtained, and it is marked as the transmission speed value CV; the transmission value CS and the transmission speed value CV are quantized, and the values ​​of the transmission value CS and the transmission speed value CV are multiplied by their corresponding preset proportional coefficients respectively to obtain the sum of the two, and it is marked as the transmission sub-value; the product of the preset proportional coefficients corresponding to the transmission value CS and the transmission speed value CV is obtained, and it is marked as the transmission mother value; the arithmetic square root of the ratio of the transmission sub-value and the transmission mother value is obtained, and it is marked as the transmission information TR; wherein the preset proportional coefficients corresponding to the transmission value CS and the transmission speed value CV are c1 and c2 respectively, and c1 and c2 satisfy c1+c2=1, 0<c2<c1<1, and c1=0.66, c2=0.34;

[0023] Obtain the number of illegal access behaviors during the danger monitoring time of the analysis object, and mark it as the current non-secondary value FC0; obtain the number of illegal access behaviors during the same time period of the danger monitoring time three days, ten days, and thirty days before the current moment of the analysis object, and mark them as the first non-secondary value FC1, the second non-secondary value FC2, and the third non-secondary value FC3, respectively; quantize the first non-secondary value FC1, the second non-secondary value FC2, and the third non-secondary value FC3, respectively multiply the first non-secondary value FC1, the second non-secondary value FC2, and the third non-secondary value FC3 by their corresponding preset proportional coefficients, obtain the sum of the three, and sum it Marked as non-substandard value FCb, obtain the difference between the current non-substandard value FC0 and the non-substandard value FCb, and mark it as access information FW; wherein, the preset proportional coefficients corresponding to the first non-substandard value FC1, the second non-substandard value FC2 and the third non-substandard value FC3 are f1, f2 and f3 respectively, and f1, f2 and f3 satisfy f1+f2+f3=1, 0<f3<f2<f1<1, take f1=0.43, f2=0.36, f3=0.21; wherein, illegal access behaviors include information theft attacks, denial of service attacks, remote control attacks and application vulnerability attacks;

[0024] Obtain the number of bytes lost and bytes tampered during the dangerous monitoring period of the analyzed object, obtain the average of the two, and mark them as loss and modification information DG;

[0025] Obtain the number and average price of network devices in the same local area network as the analysis object, obtain the product of the two, and mark it as value information JZ;

[0026] The transmission information TR, access information FW, loss and modification information DG and value information JZ are sent to the risk analysis module.

[0027] As a further solution of the present invention: the specific process of the analysis and judgment module generating the notification management instruction and the security defense instruction is as follows:

[0028] The risk analysis coefficient WX is compared with the preset risk analysis threshold WXy, and the comparison results are as follows:

[0029] If the risk analysis coefficient WX≥risk analysis threshold WXy, a notification management instruction and a security defense instruction are generated, and the notification management instruction is sent to the notification management module, and the security defense instruction is sent to the security defense module.

[0030] As a further solution of the present invention: the automated defense system for university computer network security also includes:

[0031] The threat identification module is used to obtain the threat analysis parameters of the identification object i after receiving the threat identification instruction, and send the threat analysis parameters to the threat analysis module; wherein the threat analysis parameters include distance information JL, access time information FS and access information FW.

[0032] As a further solution of the present invention: the specific process of the threat identification module obtaining the threat analysis parameters is as follows:

[0033] After receiving the threat identification instruction, obtain the IP addresses of all access analysis objects in the recent preset identification time period, and mark them as identification objects i in sequence, i=1, ..., n, n is a positive integer, i is the number of any identification object, and n is the total number of identification objects;

[0034] Obtain the position of the identification object i and the position of the analysis object, obtain the distance between the two, and mark it as distance information JL;

[0035] Obtain the time when the identification object i first accesses the analysis object and the current time, obtain the time difference between the two, and mark it as access time information FS;

[0036] Obtain the total number of times the identification object i has recently accessed the analysis object within a preset identification time period, and mark it as the access value FC; obtain the average data transmission rate during the identification object i's most recent access to the analysis object, and mark it as the access speed value FV; obtain the product of the access value FC and the access speed value FV, and mark it as the access information FW;

[0037] The distance information JL, access time information FS and access information FW are sent to the threat analysis module.

[0038] As a further solution of the present invention: the automated defense system for university computer network security also includes:

[0039] The threat analysis module is used to obtain the threat analysis coefficient WF according to the threat analysis parameters, and send the threat analysis coefficient WF to the analysis and judgment module.

[0040] As a further solution of the present invention: the specific process of the threat analysis module obtaining the threat analysis coefficient WF is as follows:

[0041] Quantify the distance information JL and the access information FW, multiply the values ​​of the distance information JL and the access information FW by their corresponding preset weight factors, obtain the sum of the two, and obtain the threat sub-value; multiply the value of the access time information FS by its corresponding preset weight factor, and obtain the threat parent value; obtain the ratio of the threat sub-value and the threat parent value, and mark it as the threat index; take the threat index as the exponent, take the preset threat base as the base, obtain the exponential power, and mark it as the threat analysis coefficient WF; wherein, the preset weight factors corresponding to the distance information JL, the access time information FS, and the access information FW are x1, x2, and x3, respectively, and x1, x2, and x3 satisfy x3>x1>x2>1.336, and take x1=2.52, x2=1.63, and x3=2.88;

[0042] The threat analysis coefficient WF is sent to the analysis and judgment module.

[0043] As a further solution of the present invention: the analysis and judgment module is also used to obtain a threat object according to the threat analysis coefficient WF, and send the threat object to the security defense module.

[0044] As a further solution of the present invention: the specific process of the analysis and judgment module obtaining the threat object is as follows:

[0045] The threat analysis coefficient WF is compared with the preset threat analysis threshold WFy. The comparison results are as follows:

[0046] If the threat analysis coefficient WF ≥ the threat analysis threshold WFy, the identification object i corresponding to the threat analysis coefficient WF is marked as a threat object, and the threat object is sent to the security defense module.

[0047] As a further solution of the present invention: the security defense module is also used to add the threat object to a blacklist, and restrict the threat object from accessing the analysis object again.

[0048] Beneficial effects of the present invention:

[0049] The automated defense system for the network security of university computers of the present invention first performs risk monitoring on university computers to obtain risk analysis parameters. The risk analysis coefficient obtained according to the risk analysis parameters can comprehensively measure the risk level of university computers, and the larger the risk analysis coefficient is, the higher the risk level is, which also indicates that there are defects in network security. Then, notification reminders and security defense are performed to achieve risk isolation. Then, threat monitoring is performed on the IP address accessing the analysis object to obtain threat analysis parameters. The threat analysis coefficient obtained according to the threat analysis parameters can comprehensively measure the threat level of the IP address, and the larger the threat analysis coefficient is, the higher the threat level is. Finally, the threat object is added to a blacklist to restrict the threat object from accessing the analysis object again, thereby further achieving risk isolation.

[0050] The automated defense system for university computer network security of the present invention can monitor the security status of university computers in real time, accurately monitor and identify various security threats without human intervention, greatly improving the defense efficiency of network security, and once a threat is detected, the system automatically triggers defense measures and starts a security emergency plan to protect university computers from security threats, thereby ensuring the real-time nature of network security.

[0051] In summary, the automated defense system for university computer network security of the present invention can realize accurate monitoring and comprehensive protection of university computer networks, improve the defense efficiency and real-time performance of network security, and provide powerful guarantees for teaching, scientific research, management and other aspects of universities. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] The present invention will be further described below in conjunction with the accompanying drawings.

[0053] Figure 1 It is a principle block diagram of the automated defense system for university computer network security in the present invention;

[0054] Figure 2 It is a flow chart of the working method of the automated defense system for the computer network security of colleges and universities in the present invention. DETAILED DESCRIPTION

[0055] The following will be combined with the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0056] Embodiment 1:

[0057] See also Figure 1As shown, this embodiment is an automated defense system for computer network security in colleges and universities, including the following modules: a danger monitoring module, a danger analysis module, an analysis and judgment module, a notification management module, a security defense module, a threat identification module, and a threat analysis module;

[0058] The risk monitoring module is used to obtain risk analysis parameters of the analysis object and send the risk analysis parameters to the risk analysis module; wherein the risk analysis parameters include transmission information TR, access information FW, loss and modification information DG and value information JZ;

[0059] The risk analysis module is used to obtain the risk analysis coefficient WX according to the risk analysis parameters, and send the risk analysis coefficient WX to the analysis and judgment module;

[0060] The analysis and judgment module is used to generate a notification management instruction and a security defense instruction according to the risk analysis coefficient WX, and send the notification management instruction to the notification management module and send the security defense instruction to the security defense module; it is also used to obtain a threat object according to the threat analysis coefficient WF and send the threat object to the security defense module;

[0061] Wherein, the notification management module is used to remind network security management after receiving the notification management instruction;

[0062] The security defense module is used to disconnect the network connection of the analysis object after receiving the security defense instruction, and generate a threat identification instruction at the same time, and send the threat identification instruction to the threat identification module; it is also used to add the threat object to the blacklist to restrict the threat object from accessing the analysis object again;

[0063] The threat identification module is used to obtain the threat analysis parameters of the identification object i after receiving the threat identification instruction, and send the threat analysis parameters to the threat analysis module; wherein the threat analysis parameters include distance information JL, access time information FS and access information FW;

[0064] The threat analysis module is used to obtain a threat analysis coefficient WF according to the threat analysis parameters, and send the threat analysis coefficient WF to the analysis and judgment module.

[0065] Embodiment 2:

[0066] See also Figure 2 As shown, this embodiment is a working method of an automated defense system for university computer network security, comprising the following steps:

[0067] Step S1: The risk monitoring module obtains risk analysis parameters of the analysis object, wherein the risk analysis parameters include transmission information TR, access information FW, loss and modification information DG and value information JZ, and sends the risk analysis parameters to the risk analysis module;

[0068] Step S2: the risk analysis module obtains the risk analysis coefficient WX according to the risk analysis parameters, and sends the risk analysis coefficient WX to the analysis and judgment module;

[0069] Step S3: The analysis and judgment module generates a notification management instruction and a security defense instruction according to the risk analysis coefficient WX, and sends the notification management instruction to the notification management module and sends the security defense instruction to the security defense module;

[0070] Step S4: after receiving the notification management instruction, the notification management module reminds the network security management;

[0071] Step S5: After receiving the security defense instruction, the security defense module disconnects the network connection of the analysis object, generates a threat identification instruction, and sends the threat identification instruction to the threat identification module;

[0072] Step S6: after receiving the threat identification instruction, the threat identification module obtains the threat analysis parameters of the identification object i, wherein the threat analysis parameters include the distance information JL, the access time information FS and the access information FW, and sends the threat analysis parameters to the threat analysis module;

[0073] Step S7: the threat analysis module obtains a threat analysis coefficient WF according to the threat analysis parameters, and sends the threat analysis coefficient WF to the analysis and judgment module;

[0074] Step S8: The analysis and judgment module obtains the threat object according to the threat analysis coefficient WF, and sends the threat object to the security defense module;

[0075] Step S9: The security defense module adds the threat object to the blacklist, restricting the threat object from accessing the analysis object again.

[0076] Embodiment 3:

[0077] Based on any of the above embodiments, Embodiment 3 of the present invention is a danger monitoring module. The function of the danger monitoring module is to obtain danger analysis parameters, wherein the danger analysis parameters include transmission information TR, access information FW, loss and modification information DG, and value information JZ. The specific process is as follows:

[0078] The danger monitoring module obtains the university computer mark for automatic defense as the analysis object, takes the current time as the end of the time period, takes the preset time as the danger monitoring time, obtains the time period start point, obtains the time period between the time period start point and the time period end point, and marks it as the danger monitoring time;

[0079] The danger monitoring module obtains the number of bytes of data transmitted in the computer network during the danger monitoring time of the analysis object, and marks it as the transmission value CS, obtains the maximum data transmission rate during the danger monitoring time of the analysis object, and marks it as the transmission speed value CV, quantizes the transmission value CS and the transmission speed value CV, multiplies the values ​​of the transmission value CS and the transmission speed value CV by their corresponding preset proportional coefficients, obtains the sum of the two, and marks it as the transmission sub-value, obtains the product of the preset proportional coefficients corresponding to the transmission value CS and the transmission speed value CV, and marks it as the transmission mother value, obtains the arithmetic square root of the ratio of the transmission sub-value and the transmission mother value, and marks it as the transmission information TR; wherein the preset proportional coefficients corresponding to the transmission value CS and the transmission speed value CV are c1 and c2 respectively, and c1 and c2 satisfy c1+c2=1, 0<c2<c1<1, and c1=0.66, c2=0.34;

[0080] The danger monitoring module obtains the number of illegal access behaviors within the danger monitoring time of the analysis object, and marks it as the current non-secondary value FC0, obtains the number of illegal access behaviors within the same time period of the danger monitoring time three days, ten days and thirty days before the current moment of the analysis object, and marks them as the first non-secondary value FC1, the second non-secondary value FC2 and the third non-secondary value FC3 respectively, quantizes the first non-secondary value FC1, the second non-secondary value FC2 and the third non-secondary value FC3, multiplies the first non-secondary value FC1, the second non-secondary value FC2 and the third non-secondary value FC3 by their corresponding preset proportional coefficients respectively, obtains the sum of the three, and marks it as the non-secondary standard value FCb, obtains the difference between the current non-secondary value FC0 and the non-secondary standard value FCb, and marks it as access information FW; wherein the preset proportional coefficients corresponding to the first non-secondary value FC1, the second non-secondary value FC2 and the third non-secondary value FC3 are f1, f2 and f3 respectively, and f1, f2 and f3 satisfy f1+f2+f3=1, 0<f3< f2<f1<1, f1=0.43, f2=0.36, f3=0.21; Among them, illegal access behaviors include information theft attacks, denial of service attacks, remote control attacks and application vulnerability attacks; Information theft attacks: attackers obtain sensitive information stored in the system through illegal means, such as user accounts, passwords, bank card numbers, etc. This type of attack may cause a large amount of sensitive data to be leaked; Denial of service attacks: attackers achieve the purpose of the attack by sending a large number of requests or specific requests to the system, causing the system or service to be paralyzed. This type of attack will seriously affect the normal operation of the system and user experience; Remote control attacks: attackers invade the system and gain control of the system, so that they can remotely control the system and conduct various attacks. This type of attack may cause the system to be completely controlled, thereby causing greater security risks; Application vulnerability attacks: attackers gain control of the system and obtain sensitive information by exploiting application vulnerabilities. This type of attack usually exploits known vulnerabilities in the system or application;

[0081] The danger monitoring module obtains the number of bytes lost and bytes tampered with during the danger monitoring period of the analyzed object, obtains the average of the two, and marks it as loss and modification information DG;

[0082] The danger monitoring module obtains the number and average price of network devices in the same local area network as the analysis object, obtains the product of the two, and marks it as value information JZ;

[0083] The risk monitoring module sends the transmission information TR, access information FW, loss and modification information DG and value information JZ to the risk analysis module.

[0084] Embodiment 4:

[0085] Based on any of the above embodiments, Embodiment 4 of the present invention is a risk analysis module. The function of the risk analysis module is to obtain a risk analysis coefficient WX. The specific process is as follows:

[0086] The risk analysis module quantifies the values ​​of the transmission information TR, the access information FW, the loss and modification information DG and the value information JZ according to the preset risk analysis function to obtain the risk analysis coefficient WX, and sends the risk analysis coefficient WX to the analysis and judgment module;

[0087] The hazard analysis function is as follows:

[0088]

[0089] Where:

[0090] κ is the preset error adjustment factor, taking κ = 0.827;

[0091] Both π and e are mathematical constants;

[0092] w1, w2, w3 and w4 are the preset weight factors corresponding to the set transmission information TR, access information FW, loss and modification information DG and value information JZ respectively. w1, w2, w3 and w4 satisfy w1>w2>w3>w4>2.366, and w1=4.19, w2=3.76, w3=3.25, w4=2.88.

[0093] Embodiment 5:

[0094] Based on any of the above embodiments, Embodiment 5 of the present invention is an analysis and judgment module, which has two functions:

[0095] One of them is to generate notification management instructions and security defense instructions. The specific process is as follows:

[0096] The analysis and judgment module compares the risk analysis coefficient WX with the preset risk analysis threshold WXy. The comparison results are as follows:

[0097] If the risk analysis coefficient WX ≥ the risk analysis threshold WXy, a notification management instruction and a security defense instruction are generated, and the notification management instruction is sent to the notification management module, and the security defense instruction is sent to the security defense module;

[0098] The second function is to obtain the threat object. The specific process is as follows:

[0099] The analysis and judgment module compares the threat analysis coefficient WF with the preset threat analysis threshold WFy. The comparison results are as follows:

[0100] If the threat analysis coefficient WF ≥ the threat analysis threshold WFy, the identification object i corresponding to the threat analysis coefficient WF is marked as a threat object, and the threat object is sent to the security defense module.

[0101] Embodiment 6:

[0102] Based on any of the above embodiments, Embodiment 6 of the present invention is a notification management module. The function of the notification management module is to remind network security management. The specific process is as follows:

[0103] After receiving the notification management instruction, the notification management module will pop up a window and ring a reminder on the mobile terminal of the network security manager of the university computer.

[0104] Embodiment 7:

[0105] Based on any of the above embodiments, Embodiment 7 of the present invention is a security defense module, which has two functions:

[0106] One of the functions is to disconnect the network connection of the analyzed object. The specific process is as follows:

[0107] After receiving the security defense instruction, the security defense module disconnects the network connection of the analysis object, generates a threat identification instruction, and sends the threat identification instruction to the threat identification module;

[0108] The second function is to add the threat object to the blacklist. The specific process is as follows:

[0109] The security defense module adds the threat object to the blacklist, restricting the threat object from accessing the analysis object again.

[0110] Embodiment 8:

[0111] Based on any of the above embodiments, Embodiment 8 of the present invention is a threat identification module. The function of the threat identification module is to obtain threat analysis parameters, wherein the threat analysis parameters include distance information JL, access time information FS, and access information FW. The specific process is as follows:

[0112] After receiving the threat identification instruction, the threat identification module obtains the IP addresses of all access analysis objects in the most recent preset identification time period, and marks them as identification objects i in sequence, where i=1, ..., n, n is a positive integer, i is the number of any identification object, and n is the total number of identification objects;

[0113] The threat identification module obtains the position of the identification object i and the position of the analysis object, obtains the distance between the two, and marks it as distance information JL;

[0114] The threat identification module obtains the time when the identification object i first accesses the analysis object and the current time, obtains the time difference between the two, and marks it as the access time information FS;

[0115] The threat identification module obtains the total number of times the identification object i has recently accessed the analysis object within the preset identification time period, and marks it as the access value FC, obtains the average data transmission rate during the identification object i's most recent access to the analysis object, and marks it as the access speed value FV, obtains the product of the access value FC and the access speed value FV, and marks it as the access information FW;

[0116] The threat identification module sends the distance information JL, the access time information FS and the access information FW to the threat analysis module.

[0117] Embodiment 9:

[0118] Based on any of the above embodiments, Embodiment 9 of the present invention is a threat analysis module. The function of the threat analysis module is to obtain a threat analysis coefficient WF. The specific process is as follows:

[0119] The threat analysis module quantifies the distance information JL and the access information FW, multiplies the values ​​of the distance information JL and the access information FW by their corresponding preset weight factors, obtains the sum of the two, obtains the threat sub-value, multiplies the value of the access time information FS by its corresponding preset weight factor, obtains the threat parent value, obtains the ratio of the threat sub-value and the threat parent value, and marks it as the threat index, takes the threat index as the exponent, takes the preset threat base as the base, obtains the exponential power, and marks it as the threat analysis coefficient WF; wherein, the preset weight factors corresponding to the distance information JL, the access time information FS, and the access information FW are x1, x2, and x3, respectively, and x1, x2, and x3 satisfy x3>x1>x2>1.336, and x1=2.52, x2=1.63, and x3=2.88;

[0120] The threat analysis module sends the threat analysis coefficient WF to the analysis and judgment module.

[0121] Based on the above embodiments 1-9, the working principle of the present invention is as follows:

[0122] The automated defense system for the network security of university computers of the present invention obtains the risk analysis parameters of the analysis object through the risk monitoring module, wherein the risk analysis parameters include transmission information, access information, loss and modification information, and value information; obtains the risk analysis coefficient according to the risk analysis parameters through the risk analysis module; generates the notification management instruction and the security defense instruction according to the risk analysis coefficient through the analysis and judgment module; reminds the network security management after receiving the notification management instruction through the notification management module; disconnects the network connection of the analysis object after receiving the security defense instruction through the security defense module; and generates the threat identification instruction at the same time; obtains the threat analysis parameters of the identification object after receiving the threat identification instruction through the threat identification module, wherein the threat analysis parameters include distance information, access time information, and access information; obtains the threat analysis coefficient according to the threat analysis parameters through the threat analysis module; obtains the threat object according to the threat analysis coefficient through the analysis and judgment module; adds the threat object to the blacklist through the security defense module, and restricts the threat object from accessing the analysis object again; The system first conducts risk monitoring on university computers and obtains risk analysis parameters. The risk analysis coefficient obtained based on the risk analysis parameters can comprehensively measure the risk level of university computers, and the larger the risk analysis coefficient, the higher the risk level, which also indicates that there are defects in network security. Then, notification reminders and security defense are carried out to achieve risk isolation. Then, threat monitoring is carried out on the IP address that accesses the analysis object, and threat analysis parameters are obtained. The threat analysis coefficient obtained based on the threat analysis parameters can comprehensively measure the threat level of the IP address, and the larger the threat analysis coefficient, the higher the threat level. Finally, the threat object is added to the blacklist, and the threat object is restricted from accessing the analysis object again, further achieving risk isolation. The system can monitor the security status of university computers in real time, accurately monitor and identify various security threats without manual intervention, greatly improving the defense efficiency of network security, and once a threat is detected, the system automatically triggers defense measures and starts a security emergency plan to protect university computers from security threats, ensuring the real-time nature of network security.

[0123] In summary, the automated defense system for university computer network security of the present invention can realize accurate monitoring and comprehensive protection of university computer networks, improve the defense efficiency and real-time performance of network security, and provide powerful guarantees for teaching, scientific research, management and other aspects of universities.

[0124] It should be further explained that the above formulas are obtained by collecting a large amount of data and performing software simulation, and a formula close to the actual value is selected. The coefficients in the formula are set by technical personnel in this field according to actual conditions.

[0125] In the description of this specification, the description with reference to the terms "one embodiment", "example", "specific example", etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner.

[0126] The above contents are merely examples and explanations of the present invention. Those skilled in the art may make various modifications or additions to the specific embodiments described or replace them in a similar manner. As long as they do not deviate from the invention or exceed the scope defined in this application, they shall all fall within the protection scope of the present invention.

Claims

1. An automated defense system for university computer network security, characterized in that: include: The hazard monitoring module is used to obtain the hazard analysis parameters of the analysis object and send the hazard analysis parameters to the hazard analysis module; wherein the hazard analysis parameters include transmission information TR, access information FW, loss and modification information DG and value information JZ; The risk analysis module is used to obtain the risk analysis coefficient WX according to the risk analysis parameters, and send the risk analysis coefficient WX to the analysis and judgment module; The specific process of the risk analysis module obtaining the risk analysis coefficient WX is as follows: The values ​​of the transmission information TR, the access information FW, the loss and modification information DG and the value information JZ are quantified according to the preset risk analysis function to obtain the risk analysis coefficient WX, and the risk analysis coefficient WX is sent to the analysis and judgment module; The hazard analysis function is as follows: Where: κ is the preset error adjustment factor; Both π and e are mathematical constants; w1, w2, w3 and w4 are respectively the preset weight factors corresponding to the transmission information TR, access information FW, loss and modification information DG and value information JZ; The analysis and judgment module is used to generate a notification management instruction and a security defense instruction according to the risk analysis coefficient WX, and send the notification management instruction to the notification management module and send the security defense instruction to the security defense module; A notification management module is used to remind network security management after receiving notification management instructions; The security defense module is used to disconnect the network connection of the analysis object after receiving the security defense instruction.

2. The automated defense system for university computer network security according to claim 1 is characterized in that: The specific process of the hazard monitoring module obtaining hazard analysis parameters is as follows: Obtain the university computer for automated defense as the analysis object, take the current time as the end of the time period, take the preset duration as the danger monitoring duration, obtain the time period start point, obtain the time period between the time period start point and the time period end point, and mark it as the danger monitoring time; The number of bytes of data transmitted in the computer network during the danger monitoring period of the analyzed object is obtained, and it is marked as the transmission value CS. The maximum data transmission rate during the danger monitoring period of the analyzed object is obtained, and it is marked as the transmission speed value CV. The transmission value CS and the transmission speed value CV are quantified to obtain the transmission information TR. Obtain the number of illegal access behaviors within the danger monitoring time of the analysis object, and mark it as the current non-secondary value FC0; obtain the number of illegal access behaviors within the same time period of the danger monitoring time three days, ten days and thirty days before the current moment of the analysis object, and mark them as the first non-secondary value FC1, the second non-secondary value FC2 and the third non-secondary value FC3 respectively; quantize the first non-secondary value FC1, the second non-secondary value FC2 and the third non-secondary value FC3 to obtain the non-secondary standard value FCb; obtain the difference between the current non-secondary value FC0 and the non-secondary standard value FCb, and mark it as access information FW; wherein, illegal access behaviors include information theft attacks, denial of service attacks, remote control attacks and application vulnerability attacks; Obtain the number of bytes lost and bytes tampered during the dangerous monitoring period of the analyzed object, obtain the average of the two, and mark them as loss and modification information DG; Obtain the number and average price of network devices in the same local area network as the analysis object, obtain the product of the two, and mark it as value information JZ; The transmission information TR, access information FW, loss and modification information DG and value information JZ are sent to the risk analysis module.

3. The automated defense system for university computer network security according to claim 1 is characterized in that: The specific process of the analysis and judgment module generating notification management instructions and security defense instructions is as follows: The risk analysis coefficient WX is compared with the preset risk analysis threshold WXy, and the comparison results are as follows: If the risk analysis coefficient WX≥risk analysis threshold WXy, a notification management instruction and a security defense instruction are generated, and the notification management instruction is sent to the notification management module, and the security defense instruction is sent to the security defense module.

4. The automated defense system for university computer network security according to claim 1, characterized in that: Also includes: The threat identification module is used to obtain the threat analysis parameters of the identification object i after receiving the threat identification instruction, and send the threat analysis parameters to the threat analysis module; wherein the threat analysis parameters include distance information JL, access time information FS and access information FW.

5. The automated defense system for university computer network security according to claim 4 is characterized in that: The specific process of the threat identification module obtaining threat analysis parameters is as follows: After receiving the threat identification instruction, obtain the IP addresses of all access analysis objects in the recent preset identification time period, and mark them as identification object i in turn; Obtain the position of the identification object i and the position of the analysis object, obtain the distance between the two, and mark it as distance information JL; Obtain the time when the identification object i first accesses the analysis object and the current time, obtain the time difference between the two, and mark it as access time information FS; Obtain the total number of times the identification object i has recently accessed the analysis object within a preset identification time period, and mark it as the access value FC; obtain the average data transmission rate during the identification object i's most recent access to the analysis object, and mark it as the access speed value FV; obtain the product of the access value FC and the access speed value FV, and mark it as the access information FW; The distance information JL, access time information FS and access information FW are sent to the threat analysis module.

6. The automated defense system for university computer network security according to claim 1 is characterized in that: Also includes: The threat analysis module is used to obtain the threat analysis coefficient WF according to the threat analysis parameters, and send the threat analysis coefficient WF to the analysis and judgment module.

7. The automated defense system for university computer network security according to claim 6, characterized in that: The specific process of the threat analysis module obtaining the threat analysis coefficient WF is as follows: The distance information JL and the access information FW are quantified to obtain the threat sub-value, the access time information FS is quantified to obtain the threat parent value, the ratio of the threat sub-value and the threat parent value is obtained, and it is marked as the threat index, and the threat index is used as the exponent, and the preset threat base is used as the base to obtain the exponential power, and it is marked as the threat analysis coefficient WF; The threat analysis coefficient WF is sent to the analysis and judgment module.

8. The automated defense system for university computer network security according to claim 1 is characterized in that: The analysis and judgment module is also used to obtain a threat object according to the threat analysis coefficient WF, and send the threat object to the security defense module.

9. The automated defense system for university computer network security according to claim 8, characterized in that: The specific process of the analysis and judgment module obtaining the threat object is as follows: The threat analysis coefficient WF is compared with the preset threat analysis threshold WFy. The comparison results are as follows: If the threat analysis coefficient WF ≥ the threat analysis threshold WFy, the identification object i corresponding to the threat analysis coefficient WF is marked as a threat object, and the threat object is sent to the security defense module.

10. The automated defense system for university computer network security according to claim 1, characterized in that: The security defense module is also used to add the threat object to a blacklist, restricting the threat object from accessing the analysis object again.

Images