Network information security monitoring system

Abstract

The present invention discloses a network information security monitoring system, which relates to the field of information security and includes: a management and control module, which is used for overall control of global function modules, and for editing, sending and running control instructions; a docking module, which is used for obtaining a data source point logged in as a designated monitoring object, and obtaining data reading and scanning permissions; a data acquisition module, which is used for reading and scanning data collected by a designated data source point, classifying image data, text data and audio data, and extracting key information one by one. By centralized inspection and hierarchical shielding of problem nodes and their associated nodes, when problem data appears, the parent source node can be processed in a timely manner, and possible problem data in the associated nodes can be screened, and corresponding processing can be performed according to the severity of the problem, thereby improving the monitoring capability of the system, so that the problem data can be shielded before causing major damage, and the shielded nodes can be continuously monitored.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, in particular to a network information security monitoring system. Background Art

[0002] The security problem of network information can be solved with the help of the application of information data mining technology and security management. By managing the objective laws of the development of things, we can analyze the development trend of events and study corresponding solutions. In network data, a large amount of problematic data is hidden in images, texts, tables, documents, etc., which need to be prevented;

[0003] However, the existing network information security monitoring system still has problems, such as:

[0004] 1. There is a lack of tracing and shielding measures for the main source nodes of abnormal data. During the data interaction process, the problem nodes continue to send problem data, causing continuous interference and pollution to the entire data source. In addition, it is difficult to conduct synchronous inspections on the nodes associated with them, and there is a lack of continuous supervision of the processed problem nodes;

[0005] 2. In the process of obtaining problem data, data is prone to tampering and loss, resulting in a lack of data support for the inspection of problem nodes, which can easily lead to missed inspections and mis-inspections, and a lack of corrective measures. Summary of the invention

[0006] 1. Technical issues to be resolved

[0007] In view of the above-mentioned shortcomings of the prior art, the present invention provides a network information security monitoring system, which can effectively solve the problems that the prior art network information security monitoring system lacks measures for tracing and shielding the main source nodes of abnormal data. In the process of data interaction, the problem node continuously sends problem data, causing continuous interference and pollution to the entire data source, and the nodes associated with it are difficult to perform synchronous inspections. There is a lack of continuous supervision of the processed problem nodes. In the process of obtaining problem data, data tampering and loss are prone to occur, resulting in a lack of data support for the inspection of the problem nodes, which is prone to missed inspections and mis-inspections, and a lack of corrective measures.

[0008] (II) Technical solution

[0009] To achieve the above objectives, the present invention is implemented through the following technical solutions:

[0010] The present invention discloses a network information security monitoring system, comprising:

[0011] The control module is used to control the global function module and edit, send and run the control instructions;

[0012] The docking module is used to obtain the registered data source point as the designated monitoring object and obtain the data reading and scanning permissions;

[0013] The data acquisition module is used to read and scan the data collected by the designated data source point, classify the image data, text data and audio data, extract key information one by one, and output the key information set;

[0014] The marking module is used to mark the data elements in the key information set and screen and determine the data frequency bands with abnormalities;

[0015] The tracing module is used to analyze the abnormal data frequency band, trace back to its parent source node, obtain the direct information sending point and the associated subsidiary sending point;

[0016] The checking module is used to centrally screen the acquired direct information sending points and their associated subsidiary sending points in all data sets in the current cycle;

[0017] A shielding module is used to shield all nodes with abnormal screening results and their information according to the preset abnormal threshold level;

[0018] The supervision module is used to re-check the blocked nodes within a preset period to determine whether there is a re-overflow of similar abnormal data;

[0019] The comparison module is used to compare the consistency of the current backtracking data before and after collection to verify whether there is any increase or loss of data;

[0020] The correction module is used to call the original collected data and resend it via an encrypted link based on the verification situation.

[0021] Furthermore, when docking with a data source point, the docking module temporarily stores the data source point with expired authority and completes the re-acquisition of authority in the temporary storage area.

[0022] Furthermore, the data acquisition module is interactively connected to a data filtering module via a wireless network, and the data filtering module is used to filter the acquired data to remove duplicate, interfering and useless data.

[0023] Furthermore, when acquiring data, the data acquisition module adopts the ICMP response delay calculation method to determine whether the link is unobstructed by comparing with the set threshold. The ICMP response delay calculation uses the ICMP protocol to enable the server to initiate active detection to the detection end. The server calculates the time difference from initiating the detection packet to receiving the ICMP response packet from the detection end, and uses this time difference as the ICMP response delay.

[0024] Furthermore, the associated subsidiary sending points in the traceability module are determined by summarizing the attack methods and forms, and performing data mining to determine high-probability attack results, and then statistically analyzing and outputting the obtained results.

[0025] Furthermore, during the screening process, the inspection module judges and tracks high attendance rate events in the current network, collects cases that have occurred, analyzes whether the current data will cause hidden dangers exceeding preset thresholds to the designated monitoring objects, and analyzes and predicts future trends.

[0026] Furthermore, during the judgment process of the supervision module, if it is determined that there is re-overflow of abnormal data, the inspection mechanism will be re-called, the parent source node will be shielded for the second time, and a trigger alarm mechanism will be generated to disable the information section with repeated overflow data. If it is determined that there is no re-overflow of abnormal data, it will continue to run according to the predetermined settings.

[0027] Furthermore, the supervision module analyzes the amount of re-overflow data, performs standardization processing, and obtains negative indicators, the calculation formula of which is:

[0028] ;

[0029] In the formula, Represents the standardized value of the jth indicator in the i-th sample;

[0030] Represents the minimum value of index j in the sample set;

[0031] Represents the maximum value of index j in the sample set;

[0032] Represents the original data.

[0033] Furthermore, during the inspection process in the comparison module, if it is determined that there is data addition and loss, the data is first re-traced to obtain secondary traceability data and compared with the primary traceability data. If there are differences in the comparison results, a reminder report is sent to the management and control module to perform a self-check of the functional module. If there are no differences, the primary traceability data is directly re-encrypted and transmitted.

[0034] Furthermore, the management and control module is interactively connected to the docking module through a wireless network, the docking module is interactively connected to the data acquisition module through a wireless network, the data acquisition module is interactively connected to the marking module through a wireless network, the marking module is interactively connected to the traceability module through a wireless network, the traceability module is interactively connected to the inspection module through a wireless network, the inspection module is interactively connected to the shielding module through a wireless network, the shielding module is interactively connected to the supervision module through a wireless network, the traceability module is interactively connected to the comparison module through a wireless network, and the comparison module is interactively connected to the correction module through a wireless network.

[0035] (III) Beneficial effects

[0036] Compared with the prior art, the technical solution provided by the present invention has the following beneficial effects:

[0037] Through centralized inspection and hierarchical shielding of problem nodes and their associated nodes, the parent source node can be processed in a timely manner when problem data appears, and the possible problem data in the associated nodes can be screened and handled accordingly according to the severity of the problem, thereby improving the system's monitoring capabilities, so that the problem data can be shielded before it causes major damage, and the shielded nodes can be continuously monitored to maintain a stable shielding effect.

[0038] Through proofreading measures on the traced data, the transmission and arrival of the acquired data are monitored, and abnormal data is corrected to prevent the arriving data from being tampered with by external malicious behavior, thereby improving the security of data transmission, ensuring the accuracy of the inspection process, and effectively avoiding omissions and errors. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the prior art descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0040] Figure 1 It is a schematic diagram of the framework of the present invention;

[0041] The numbers in the figure represent: 1. Management and control module; 2. Docking module; 3. Data acquisition module; 4. Marking module; 5. Traceability module; 6. Inspection module; 7. Shielding module; 8. Supervision module; 9. Comparison module; 10. Correction module; 11. Data filtering module. DETAILED DESCRIPTION

[0042] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0043] The present invention will be further described below in conjunction with the embodiments. Example

[0044] The network information security monitoring system of this embodiment is as follows: Figure 1 As shown, including:

[0045] Control module 1 is used to control the global function module and edit, send and run control instructions;

[0046] The docking module 2 is used to obtain the registered data source point as the designated monitoring object and obtain the data reading and scanning authority. When docking the data source point, the docking module 2 temporarily stores the data source point with expired authority and completes the re-acquisition of authority in the temporary storage area;

[0047] The data acquisition module 3 is used to read and scan the data collected from the designated data source point, classify the image data, text data and audio data, extract key information one by one, and output the key information set. The data acquisition module 3 is interactively connected to the data filtering module 11 through a wireless network. The data filtering module 11 is used to filter the acquired data to remove duplicate, interfering and useless data;

[0048] When acquiring data, the data acquisition module 3 uses the ICMP response delay calculation method to determine whether the link is unblocked by comparing with the set threshold value. The ICMP response delay calculation uses the ICMP protocol to enable the server to initiate active detection to the detection end. The server calculates the time difference from initiating the detection packet to receiving the ICMP response packet from the detection end, and uses this time difference as the ICMP response delay;

[0049] The marking module 4 is used to mark the data elements in the key information set and screen and determine the data frequency bands with abnormalities;

[0050] The tracing module 5 is used to analyze the frequency band of abnormal data, trace back to its parent source node, obtain the direct information sending point and the associated subsidiary sending point. The associated subsidiary sending point in the tracing module 5 is determined by summarizing the attack method and attack form, and performing data mining to determine the high-probability attack result, and the obtained results are counted and output;

[0051] The inspection module 6 is used to centrally screen the acquired direct information sending points and their associated subsidiary sending points in all data sets in the current cycle. During the screening process of the inspection module 6, the high attendance rate events in the current network are judged and tracked, and the cases that have occurred are collected to analyze whether the current data will cause hidden dangers exceeding the preset threshold to the designated monitoring object, and analyze and predict future trends;

[0052] Shielding module 7, used to perform intensity shielding on all nodes with abnormal screening results and their information according to preset abnormal threshold levels;

[0053] The monitoring module 8 is used to re-check the blocked nodes within a preset period to determine whether there is a re-overflow of the same type of abnormal data.

[0054] As a preferred implementation method in this embodiment, during the inspection process in the comparison module 9, if it is determined that there is data addition and loss, the source is first re-traced to obtain secondary traceability data and compare it with the primary traceability data. If there is a difference in the comparison result, a reminder report is sent to the management and control module 1 to perform a self-check of the functional module. If there is no difference, the primary traceability data is directly re-encrypted and transmitted.

[0055] like Figure 1 As shown, the management and control module 1 is interactively connected to the docking module 2 through a wireless network, the docking module 2 is interactively connected to the data acquisition module 3 through a wireless network, the data acquisition module 3 is interactively connected to the marking module 4 through a wireless network, the marking module 4 is interactively connected to the traceability module 5 through a wireless network, the traceability module 5 is interactively connected to the inspection module 6 through a wireless network, the inspection module 6 is interactively connected to the shielding module 7 through a wireless network, and the shielding module 7 is interactively connected to the supervision module 8 through a wireless network.

[0056] In the specific implementation of this embodiment, the control module 1 controls the overall situation, determines the monitoring object through the docking module 2, obtains the interactive data through the data acquisition module 3, filters the data through the data filtering module 11, marks the abnormal data through the marking module 4, and the tracing module 5 traces the parent source node and the associated node of the marked data, checks through the inspection module 6, and completes the shielding through the shielding module 7, and then the supervision module 8 continues to supervise;

[0057] Through centralized inspection and hierarchical shielding of problem nodes and their associated nodes, the parent source node can be processed in a timely manner when problem data appears, and the possible problem data in the associated nodes can be screened and handled accordingly according to the severity of the problem, thereby improving the system's monitoring capabilities, so that the problem data can be shielded before it causes major damage, and the shielded nodes can be continuously monitored to maintain a stable shielding effect. Example

[0058] In this embodiment, the traceability module 5 is interactively connected to the comparison module 9 via a wireless network, and the comparison module 9 is interactively connected to the correction module 10 via a wireless network. The comparison module 9 is used to compare the consistency of the current backtracking data before and after collection, and to verify whether there is any increase or loss of data; the correction module 10 is used to call the original collected data and resend it via an encrypted link based on the verification situation.

[0059] Compared with the existing technology, through the proofreading measures of the traced data, the transmission and arrival of the acquired data are monitored, and the abnormal data is corrected to prevent the arriving data from being tampered with by external malicious behavior, thereby improving the security of data transmission, ensuring the accuracy of the inspection process, and effectively avoiding omissions and errors. Example

[0060] In this embodiment, during the judgment process of the supervisory module 8, if it is determined that there is a re-overflow of abnormal data, the inspection mechanism is re-called, the parent source node is shielded for the second time, and a trigger alarm mechanism is generated to disable the information section with repeated overflow data. If it is determined that there is no re-overflow of abnormal data, it continues to run according to the predetermined settings;

[0061] The monitoring module 8 analyzes the amount of re-overflow data, performs standardization processing, and obtains negative indicators, the calculation formula of which is:

[0062] ;

[0063] In the formula, Represents the standardized value of the jth indicator in the i-th sample;

[0064] Represents the minimum value of index j in the sample set;

[0065] Represents the maximum value of index j in the sample set;

[0066] Represents the original data.

[0067] Working principle: When the present invention is in use, the control module 1 controls the overall situation, determines the monitoring object through the docking module 2, obtains the interactive data through the data acquisition module 3, filters the data through the data filtering module 11, marks the abnormal data through the marking module 4, and the tracing module 5 traces the parent source node and the associated node of the marked data, checks through the inspection module 6, and completes the shielding through the shielding module 7, and then the supervision module 8 continues to supervise;

[0068] Through centralized inspection and hierarchical shielding of problem nodes and their associated nodes, when problem data appears, the parent source node can be processed in a timely manner, and the possible problem data in the associated nodes can be screened and processed accordingly according to the severity of the problem, thereby improving the monitoring capability of the system, so that the problem data can be shielded before it causes major damage, and the shielded nodes can be continuously monitored to maintain a stable shielding effect;

[0069] Through proofreading measures on the traced data, the transmission and arrival of the acquired data are monitored, and abnormal data is corrected to prevent the arriving data from being tampered with by external malicious behavior, thereby improving the security of data transmission, ensuring the accuracy of the inspection process, and effectively avoiding omissions and errors.

[0070] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements will not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. Network information security monitoring system, characterized in that: include: The control module (1) is used to control the global function module and edit, send and run the control instructions; The docking module (2) is used to obtain the registered data source point as the designated monitoring object and obtain the data reading and scanning permissions; The data acquisition module (3) is used to read and scan the data collected from the designated data source point, classify the image data, text data and audio data, extract key information one by one, and output a key information set; A marking module (4) is used to mark the data elements in the key information set and screen and determine the data frequency bands with abnormalities; The tracing module (5) is used to analyze the abnormal data frequency band, trace back to its parent source node, obtain the direct information sending point and the associated subsidiary sending point; A checking module (6) is used to centrally screen the acquired direct information sending points and their associated subsidiary sending points in all data sets in the current cycle; A shielding module (7) is used to perform intensity shielding on all nodes with abnormal screening results and their information according to a preset abnormal threshold classification; A monitoring module (8) is used to re-check the blocked nodes within a preset period to determine whether there is a re-overflow of similar abnormal data; A comparison module (9) is used to compare the consistency of the current backtracking data before and after collection to verify whether there is any increase or loss of data; A correction module (10) is used to call the original collected data and resend it via an encrypted link according to the verification situation; During the judgment process of the monitoring module (8), if it is determined that there is a re-overflow of abnormal data, the inspection mechanism is re-called, the mother source node is shielded for the second time, and a trigger alarm mechanism is generated to disable the information section with repeated overflow data. If it is determined that there is no re-overflow of abnormal data, it continues to run according to the predetermined settings.

2. The network information security monitoring system according to claim 1, characterized in that: When docking with a data source point, the docking module (2) temporarily stores the data source point with expired permissions and completes the re-acquisition of permissions in the temporary storage area.

3. The network information security monitoring system according to claim 1, characterized in that: The data acquisition module (3) is interactively connected to a data filtering module (11) via a wireless network, and the data filtering module (11) is used to filter the acquired data to remove duplicate, interfering and useless data.

4. The network information security monitoring system according to claim 1, characterized in that: When acquiring data, the data acquisition module (3) uses an ICMP response delay calculation method to determine whether the link is unobstructed by comparing it with a set threshold value, wherein the ICMP response delay calculation uses the ICMP protocol to enable the server to initiate an active detection to the detection end, and the server calculates the time difference from initiating the detection packet to receiving the ICMP response packet from the detection end, and uses this time difference as the ICMP response delay.

5. The network information security monitoring system according to claim 1, characterized in that: The method for determining the associated subsidiary sending points in the traceability module (5) is as follows: by summarizing the attack methods and attack forms, and performing data mining, a high-probability attack result is determined, and the obtained results are counted and output.

6. The network information security monitoring system according to claim 1, characterized in that: During the screening process, the inspection module (6) judges and tracks high attendance rate events in the current network, collects existing cases, analyzes whether the current data will cause hidden dangers exceeding the preset threshold to the designated monitoring object, and analyzes and predicts future trends.

7. The network information security monitoring system according to claim 1, characterized in that: The monitoring module (8) analyzes the amount of re-overflow data, performs standardization processing, and obtains negative indicators, the calculation formula of which is: ; In the formula, Represents the standardized value of the jth indicator in the i-th sample; Represents the minimum value of index j in the sample set; Represents the maximum value of index j in the sample set; Represents the original data.

8. The network information security monitoring system according to claim 1, characterized in that: During the inspection process in the comparison module (9), if it is determined that there is data addition or loss, the data is first re-traced to obtain secondary traceability data and compared with the primary traceability data. If there is a difference in the comparison result, a reminder report is sent to the control module (1) to perform a self-check of the functional module. If there is no difference, the primary traceability data is directly re-encrypted and transmitted.

9. The network information security monitoring system according to claim 1, characterized in that: The control module (1) is interactively connected to the docking module (2) via a wireless network, the docking module (2) is interactively connected to the data acquisition module (3) via a wireless network, the data acquisition module (3) is interactively connected to the marking module (4) via a wireless network, the marking module (4) is interactively connected to the traceability module (5) via a wireless network, the traceability module (5) is interactively connected to the inspection module (6) via a wireless network, the inspection module (6) is interactively connected to the shielding module (7) via a wireless network, the shielding module (7) is interactively connected to the supervision module (8) via a wireless network, the traceability module (5) is interactively connected to the comparison module (9) via a wireless network, and the comparison module (9) is interactively connected to the deviation correction module (10) via a wireless network.

Images