A computer security operation and maintenance service system

Abstract

The present invention discloses a computer security operation and maintenance service system, which specifically relates to the field of computer security management technology, and includes a security response monitoring module, a response analysis module, an identification module, an anomaly analysis module, an early warning module, and an operation adjustment module. The security response monitoring module monitors vulnerability processing response information in real time and transmits it to the response analysis module; the response analysis module performs analysis and transmits the results to the identification module; the identification module determines whether there are security risks; the anomaly analysis module analyzes the risks and transmits the results to the early warning module; the early warning module issues a high-risk or low-risk early warning signal and transmits it to the operation adjustment module; the operation adjustment module intelligently adjusts the sampling frequency of the low-risk signal, and performs risk level judgment on the high-risk signal and executes the corresponding strategy; the present invention can timely discover and respond to potential security threats by intelligently regulating and early warning the computer's vulnerability processing response information, thereby improving the overall security of the system.

Description

Technical Field

[0001] The present invention relates to the technical field of computer security management, and more specifically, to a computer security operation and maintenance service system. Background Art

[0002] Computer security operations and maintenance services are professional services designed to ensure the secure, stable, and efficient operation of computer systems and networks. These services include a range of measures and tools designed to protect information and data from various security threats, including cyberattacks, malware, and unauthorized access. These measures typically include firewall configuration, intrusion detection and prevention systems, data encryption, vulnerability scanning and remediation, and backup and recovery solutions.

[0003] At present, many existing security technologies have a lag in detecting and responding to network attacks. This delay may cause attackers to stay in the system longer, causing greater damage. Deploying higher-quality security operation and maintenance systems often requires high costs. Early identification can prevent system failures caused by untimely or unstable vulnerability handling, and improve system stability and reliability. Therefore, a computer security operation and maintenance service system is proposed here. Summary of the Invention

[0004] To achieve the above object, the present invention provides the following technical solutions:

[0005] A computer security operation and maintenance service system, including a security response monitoring module, a response analysis module, an identification module, an anomaly analysis module, an early warning module, and an operation adjustment module;

[0006] The security response monitoring module is used to monitor the vulnerability processing response information of the target computer in real time, and then transmit the monitored vulnerability processing response information of the target computer to the response analysis module;

[0007] The response analysis module is used to perform response analysis operations on the vulnerability processing response information of the target computer and transmit the results of the response analysis operations to the identification module;

[0008] The identification module determines whether the target computer has security operation and maintenance service risks based on the results of the response analysis operation;

[0009] The anomaly analysis module is used to perform anomaly analysis on computers with potential security operation and maintenance service risks and transmit the results of the anomaly analysis to the early warning module;

[0010] The early warning module decides to issue a high-risk early warning signal or a low-risk early warning signal based on the results of the abnormality analysis, and transmits the high-risk early warning signal or the low-risk early warning signal to the operation adjustment module;

[0011] The operation adjustment module is used to intelligently control the actual sampling frequency of the computer corresponding to the low-risk warning signal based on the initial sampling frequency of the computer's vulnerability processing response information, and to judge the danger level of the computer corresponding to the high-risk warning signal and execute the corresponding safe operation strategy according to the judgment result.

[0012] In a preferred embodiment, the vulnerability handling response information of the target computer includes a timestamp when each vulnerability of the target computer is discovered and a timestamp when each vulnerability is repaired.

[0013] In a preferred embodiment, the response analysis module is used to perform a response analysis operation on the vulnerability processing response information of the target computer, which includes:

[0014] For each vulnerability, the response time is calculated separately. The response time is the difference between the timestamp of the repair and the timestamp of the discovery. Then the response times of all vulnerabilities are summed up and divided by the total number of vulnerabilities to obtain the average value of the vulnerability processing responses. Based on the average value of the vulnerability processing responses, the standard deviation of the vulnerability processing responses is calculated. The average value and the standard deviation of the vulnerability processing responses are sent to the identification module together.

[0015] In a preferred embodiment, the identification module determines whether the target computer has a security operation and maintenance service risk based on the result of the response analysis operation, which means:

[0016] The identification module is preset with a vulnerability processing response standard average value and a vulnerability processing response standard value threshold. The average value of the vulnerability processing response is compared with the preset vulnerability processing response standard average value, and the standard deviation of the vulnerability processing response is compared with the preset vulnerability processing response standard value threshold. If the average value of the vulnerability processing response is less than or equal to the preset vulnerability processing response standard average value and the standard deviation of the vulnerability processing response is less than or equal to the preset vulnerability processing response standard value threshold, a normal signal is generated. If the average value of the vulnerability processing response is less than or equal to the preset vulnerability processing response standard average value and the standard deviation of the vulnerability processing response is less than or equal to the preset vulnerability processing response standard value threshold, a hidden danger signal is generated. When the hidden danger signal is generated, it is determined that the target computer has a security operation and maintenance service hidden danger.

[0017] In a preferred embodiment, the anomaly analysis module is used to perform an anomaly analysis operation on a computer with a security operation and maintenance service risk, which means: obtaining the network performance information and computer system performance information of the computer with a security operation and maintenance service risk, and then performing feature extraction and anomaly analysis to obtain a network quality index and a system quality index, and transmitting the network quality index and the system quality index together to a pre-trained machine learning model to generate a computer safety operation coefficient.

[0018] In a preferred embodiment, the logic for obtaining the network quality index is:

[0019] Extract the corresponding data of bandwidth utilization characteristic index, average round-trip delay characteristic index, jitter characteristic index, and packet loss rate characteristic index from the network performance information, and then normalize the data of different magnitudes so that they can be compared on the same scale. Then use the entropy weight method to calculate the weight of the characteristic index, and establish the fuzzy matrix R based on the normalized data. Use r in the fuzzy matrix R. ij Represents the normalized value of the i-th sample on the j-th index, and calculates the comprehensive evaluation vector. The calculation formula is: B = W × R; B is the comprehensive evaluation vector, R is the fuzzy matrix, W = [w1, w2, ..., w m ], W is the weight vector;

[0020] Calculate the network quality index using the following formula: NQI is the network quality index, w j is the weight of the jth indicator, r j is the normalized value of the jth performance indicator, and m is the total number of weights in the weight vector.

[0021] In a preferred embodiment, the logic for obtaining the system quality index is:

[0022] Extract multiple preset performance indicator data from the computer system performance information, then perform normalization processing. Based on the normalized data, construct a comparison sequence and a reference sequence. The comparison sequence is a sequence composed of the normalized performance indicator values, and the reference sequence is a sequence composed of the ideal performance indicator values. Calculate the correlation coefficient of each performance indicator. The calculation formula of the correlation coefficient is: Δ ij =|x′ i -x′ j |;Δ ij represents the absolute difference between the i-th sample and the j-th ideal value, Δ min Indicates the minimum difference between all compared sequences and the reference sequence, Δ max represents the maximum value of the difference between all comparison sequences and the reference sequence, ρ is the resolution coefficient, ξ ij is the correlation coefficient between the i-th sample and the j-th ideal value, and then the grey correlation degree is calculated using the following formula: n is the total number of performance indicators, γ i is the grey relational degree;

[0023] Construct a decision matrix and determine the ideal solution and negative ideal solution. The ideal solution is A + , represents the optimal value of each performance indicator, and the negative ideal solution is A -, represents the worst value of each performance indicator, and then calculates the relative closeness: and Represents the distance between the sample and the ideal solution and the negative ideal solution, C i Represents relative proximity, and the system quality index is the average of all relative proximity.

[0024] In a preferred embodiment, the early warning module decides to issue a high-risk early warning signal or a low-risk early warning signal based on the result of the abnormality analysis, which means:

[0025] The computer safety operation coefficient is compared with the preset warning threshold in the warning module. If the computer safety operation coefficient is greater than or equal to the preset warning threshold, a low-risk warning signal is issued; if the computer safety operation coefficient is less than the preset warning threshold, a high-risk warning signal is issued.

[0026] In a preferred embodiment, the operation adjustment module is used to intelligently adjust the actual sampling frequency of the computer corresponding to the low-risk warning signal based on the initial sampling frequency of the vulnerability processing response information of the computer, which means:

[0027] For computers corresponding to low-risk warning signals, the actual sampling frequency is intelligently regulated based on the initial sampling frequency of the computer's vulnerability processing response information. The regulation formula is: K is the ratio of the current computer safety operation coefficient to the preset warning threshold, TK is the adjusted sampling frequency, and T0 is the initial sampling frequency.

[0028] In a preferred embodiment, determining the danger level of a computer corresponding to a high-risk warning signal means: presetting a danger range-level table, searching for the level corresponding to the danger range into which the computer safety operation coefficient of the computer corresponding to the high-risk warning signal falls and using it as the danger level of the computer.

[0029] Technical effects and advantages of the present invention:

[0030] The present invention can timely discover and respond to potential security threats through intelligent regulation and early warning mechanism of computer vulnerability processing response information, thereby improving the overall security of the system. By real-time monitoring of the computer's safe operation coefficient, it can timely issue early warning signals and adopt corresponding security strategies according to the risk level, thereby improving the efficiency of vulnerability repair and reducing the time the system is exposed to security threats. Through the judgment of the computer's safe operation coefficient and early warning signals, quantitative security indicators are provided, which facilitates management personnel to understand and evaluate the security status of the system.

[0031] The present invention can intelligently control the sampling frequency, thereby optimizing resource utilization and reducing system burden. The sampling frequency can be dynamically adjusted according to the computer's safe operation coefficient, so that when the system security status is good, the sampling frequency can be reduced to save system resources; when the system security status is poor, the sampling frequency can be increased to strengthen monitoring. By rationally allocating monitoring resources, unnecessary system overhead can be reduced, the service life of the equipment can be extended, and the overall operation and maintenance efficiency can be improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to facilitate understanding by those skilled in the art, the present invention will be further described below with reference to the accompanying drawings;

[0033] Figure 1 This is a schematic diagram of a computer security operation and maintenance service system in the present invention. DETAILED DESCRIPTION

[0034] The following will provide a clear and complete description of the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0035] Example 1

[0036] A computer security operation and maintenance service system includes a security response monitoring module, a response analysis module, an identification module, an anomaly analysis module, an early warning module, and an operation adjustment module; and signal connections are established among the security response monitoring module, the response analysis module, the identification module, the anomaly analysis module, the early warning module, and the operation adjustment module.

[0037] The security response monitoring module is used to monitor the vulnerability processing response information of the target computer in real time, and then transmit the monitored vulnerability processing response information of the target computer to the response analysis module; the response analysis module is used to perform response analysis operations on the vulnerability processing response information of the target computer and transmit the results of the response analysis operations to the identification module; the identification module judges whether the target computer has security operation and maintenance service risks based on the results of the response analysis operations; the anomaly analysis module is used to perform anomaly analysis operations on computers with security operation and maintenance service risks and transmit the results of the anomaly analysis to the early warning module; the early warning module decides to issue a high-risk early warning signal or a low-risk early warning signal based on the results of the anomaly analysis, and transmits the high-risk early warning signal or the low-risk early warning signal to the operation adjustment module; the operation adjustment module is used to intelligently adjust the actual sampling frequency of the computer corresponding to the low-risk early warning signal based on the initial sampling frequency of the computer's vulnerability processing response information, and judge the danger level of the computer corresponding to the high-risk early warning signal and execute the corresponding safe operation strategy according to the judgment result.

[0038] The vulnerability handling response information of the target computer includes the timestamp of each vulnerability discovered and repaired on the target computer. The response analysis module is used to perform response analysis on the vulnerability handling response information of the target computer. The response time is calculated for each vulnerability. The response time is the difference between the timestamp of repair and the timestamp of discovery. The response times of all vulnerabilities are then summed and divided by the total number of vulnerabilities to obtain the average value of the vulnerability handling responses. Based on the average value of the vulnerability handling responses, the standard deviation of the vulnerability handling responses is calculated. The average value and the standard deviation of the vulnerability handling responses are transmitted to the identification module together. The average value is the arithmetic mean of all vulnerability handling response times and reflects the overall efficiency of the system in handling vulnerabilities. Specifically, the average value provides an intuitive indicator of how long it takes for the system to handle a vulnerability on average. It can be used to measure the current vulnerability handling performance of the system and compare it with past data or industry standards. The standard deviation is a measure of the distribution of all vulnerability handling response times and reflects the degree of dispersion of the response times. Specifically: the smaller the standard deviation, the closer the vulnerability handling response time is to the average value, and the more stable the system vulnerability management performance is; the larger the standard deviation, the greater the fluctuation in the vulnerability handling response time, and the system vulnerability management may be unstable. Moreover, these data are easy to process and obtain, and are highly feasible.

[0039] The identification module judges whether the target computer has a security operation and maintenance service risk based on the result of the response analysis operation, which means: the identification module presets a vulnerability processing response standard average value and a vulnerability processing response standard value threshold, compares the average value of the vulnerability processing response with the preset vulnerability processing response standard average value, and compares the standard deviation of the vulnerability processing response with the preset vulnerability processing response standard value threshold. If the average value of the vulnerability processing response is less than or equal to the preset vulnerability processing response standard average value and the standard deviation of the vulnerability processing response is less than or equal to the preset vulnerability processing response standard value threshold, a normal signal is generated; if the average value of the vulnerability processing response is less than or equal to the preset vulnerability processing response standard average value and the standard deviation of the vulnerability processing response is less than or equal to the preset vulnerability processing response standard value threshold, a risk signal is generated. When the risk signal is generated, it is judged that the target computer has a security operation and maintenance service risk.

[0040] By comparing the mean and standard deviation of vulnerability handling responses, efficiency issues in system vulnerability management can be promptly identified, ensuring that vulnerabilities are remediated within a reasonable timeframe. Based on these findings, security resources can be rationally allocated, directing more attention and resources to systems with potential vulnerabilities, thereby improving the efficiency of overall security operations and maintenance. Promptly addressing security risks reduces the time a system is exposed to threats, thereby reducing the risk of attack. By continuously monitoring and analyzing vulnerability handling responses, the system's ability to respond to security threats is gradually enhanced, building a more robust security protection system. Regulations in many industries and regions require that known vulnerabilities be fixed within a specified timeframe. Using the mean and standard deviation to determine compliance can help systems meet these compliance requirements. Detailed recording and analysis of vulnerability handling response data can provide a reliable basis for audits and reports, demonstrating the security and maintenance status of the system. The standard deviation reflects fluctuations in vulnerability handling response times; a larger standard deviation indicates system instability that may require further investigation and resolution. Early identification and resolution of potential vulnerabilities can prevent system failures caused by untimely or unstable vulnerability handling, improving system stability and reliability.

[0041] The anomaly analysis module is used to perform an anomaly analysis operation on computers with security operation and maintenance service risks, which means: obtaining network performance information and computer system performance information of computers with security operation and maintenance service risks, then performing feature extraction and anomaly analysis to obtain a network quality index and a system quality index, and transmitting the network quality index and the system quality index together to a pre-trained machine learning model to generate a computer safety operation coefficient; the machine learning model is not specifically limited here, and any model that can perform a comprehensive analysis of the network quality index and the system quality index to generate a computer safety operation coefficient is acceptable. In order to implement the technical solution of the present invention, the present invention provides a specific implementation method: both the network quality index and the system quality index are standardized so that their data range is within the same scale, and then substituted into the pre-trained machine learning model, such as: CP is the computer safety operation coefficient, k1 and k2 are preset proportional coefficients used to adjust the degree of influence of parameters on the results, SQI norm NQI is the normalized system quality index. norm It is a standardized network quality index. The larger the value of the computer security operation coefficient is, the higher the quality of the computer security operation is.

[0042] The Network Quality Index (NQI) is a comprehensive indicator used to measure the overall performance and quality of a network. It combines multiple network performance indicators to provide a comprehensive performance evaluation perspective, covering bandwidth utilization, latency, jitter, and packet loss rate. The NQI standardizes different types of network performance data to provide an easy-to-understand comprehensive score. The NQI is derived by extracting data corresponding to the bandwidth utilization, average round-trip delay, jitter, and packet loss rate characteristic indicators from network performance information. The data of different magnitudes is then normalized for comparison on the same scale. The commonly used linear normalization formula is as follows: x is the original value, x min and x max are the minimum and maximum values ​​of the indicator respectively, x′ is the normalized value, and then the entropy weight method is used to calculate the weight of the characteristic indicator, and the fuzzy matrix R is established based on the normalized data. r ij is the normalized value of the i-th sample on the j-th index, and r is used in the fuzzy matrix R ij Represents the normalized value of the i-th sample on the j-th index, and calculates the comprehensive evaluation vector. The calculation formula is: B = W × R; B is the comprehensive evaluation vector, R is the fuzzy matrix, W = [w1, w2, ..., w m ], W is the weight vector;

[0043] Calculate the network quality index using the following formula: NQI is the network quality index, w j is the weight of the jth indicator, r j is the normalized value of the jth performance indicator, and m is the total number of weights in the weight vector; an example is:

[0044] Assume that the normalized fuzzy matrix R and weight vector W are as follows: W = [0.25 0.25 0.25 0.25];

[0045]

[0046] NQI = 0.25 × 0.8 + 0.25 × 0.9 + 0.25 × 0.7 + 0.25 × 0.95 = 0.8375; the final network quality index is 0.8375.

[0047] The system quality index is a comprehensive indicator used to evaluate and quantify the overall performance and quality of the system. SQI provides a comprehensive perspective on system performance evaluation by integrating multiple performance indicators (such as CPU utilization, memory usage, disk I / O rate, network latency, etc.). The logic for obtaining the system quality index is as follows: multiple preset performance indicator data are extracted from the computer system performance information. Performance indicators include but are not limited to CPU utilization, remaining memory space, and other performance indicators. Then normalization is performed. Based on the normalized data, a comparison sequence and a reference sequence are constructed. The comparison sequence is a sequence composed of the normalized performance indicator values, and the reference sequence is a sequence composed of the ideal performance indicator values. Grey correlation analysis is performed, that is, the correlation between each indicator and the ideal indicator is calculated. The correlation coefficient of each performance indicator is first calculated. The calculation formula of the correlation coefficient is: Δ ij =|x′ i -x′ j |;Δ ij represents the absolute difference between the i-th sample and the j-th ideal value, Δ min Indicates the minimum difference between all compared sequences and the reference sequence, Δ max It represents the maximum value of the difference between all comparison sequences and reference sequences, ρ is the resolution coefficient, which is usually 0.5, and ξ ij is the correlation coefficient between the i-th sample and the j-th ideal value, and then the grey correlation degree is calculated using the following formula: n is the total number of performance indicators, γ i is the grey relational degree;

[0048] Use the TOPSIS method to conduct a comprehensive evaluation, calculate the system quality index, and construct a decision matrix, such as the decision matrix D: x′ ij is the normalized value of the i-th sample on the j-th index, and determines the ideal solution and the negative ideal solution. The ideal solution is A + , represents the optimal value of each performance indicator, and the negative ideal solution is A - , represents the worst value of each performance indicator, and then calculates the relative closeness: and Represents the distance between the sample and the ideal solution and the negative ideal solution respectively. The distance calculation method is to calculate the Euclidean distance between the sample and the ideal solution and the negative ideal solution respectively. iThe system quality index (SQI) represents relative proximity. The system quality index is the average of all relative proximity measures. An SQI close to 1 indicates that the system's performance is close to ideal, with high overall quality. All performance indicators are excellent, and the system is stable. An SQI close to 0 indicates that the system's performance is close to its worst state, with low overall quality and serious performance issues. The entropy weight method is used to calculate the weights of each performance indicator, ensuring that the weights are based on the objective information content of the data and reducing the influence of subjective factors. The TOPSIS method calculates relative proximity by distance from the ideal solution and the negative ideal solution, further quantifying and objectifying system quality assessment.

[0049] The early warning module decides whether to issue a high-risk early warning signal or a low-risk early warning signal based on the results of anomaly analysis. This means: the computer safety operation coefficient is compared with the early warning threshold preset in the early warning module. If the computer safety operation coefficient is greater than or equal to the preset early warning threshold, a low-risk early warning signal is issued; if the computer safety operation coefficient is less than the preset early warning threshold, a high-risk early warning signal is issued; the computer safety operation coefficient is a comprehensive indicator that reflects the overall security status of the system. The early warning threshold is a benchmark value set inside the early warning module and is used to judge the security status of the system. By comparing the computer safety operation coefficient with the early warning threshold preset in the early warning module, the early warning module can promptly issue an early warning signal of an appropriate level. This mechanism can help system managers identify and deal with potential safety hazards in a timely manner, ensuring the stable operation and safety protection of the system.

[0050] The operation adjustment module is used to intelligently adjust the actual sampling frequency of the computer corresponding to the low-risk warning signal based on the initial sampling frequency of the computer's vulnerability processing response information.

[0051] For computers corresponding to low-risk warning signals, the actual sampling frequency is intelligently regulated based on the initial sampling frequency of the computer's vulnerability processing response information. The regulation formula is: K is the ratio of the current computer security operation coefficient to the preset warning threshold, TK is the adjusted sampling frequency, T0 is the initial sampling frequency, which is the sampling frequency of vulnerability processing response information when the system is in normal operation. The initial sampling frequency is the frequency at which the system collects vulnerability processing information within a set period of time. If the system's security status is good, the sampling frequency will be reduced to reduce resource consumption; if the system's security status is poor, the sampling frequency will be increased to increase monitoring efforts.

[0052] For computers corresponding to high-risk warning signals, the risk level judgment means: a risk range-level table is preset, and the level corresponding to the risk range of the computer corresponding to the high-risk warning signal is found and used as the risk level of the computer; for example: 0-20 is extremely high risk, 21-40 is high risk, 41-60 is medium risk, and the current computer's computer safety operation coefficient is 35, which falls into the range of 21-40, so the corresponding risk level is "high risk", and the corresponding safe operation strategy is executed, for example: stop using the computer immediately when the risk is extremely high, disconnect all network connections, switch to the internal network when the risk is high, restrict external access, and restrict high-risk applications when the risk is medium.

[0053] The above formulas are all dimensionless and numerical calculations. The formulas are obtained by collecting a large amount of data and performing software simulation to obtain the most recent real situation. The preset parameters in the formulas are set by technicians in this field according to actual conditions.

[0054] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0055] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0056] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0057] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. A computer security operation and maintenance service system, characterized in that: It includes security response monitoring module, response analysis module, identification module, abnormality analysis module, early warning module, and operation adjustment module; The security response monitoring module is used to monitor the vulnerability processing response information of the target computer in real time, and then transmit the monitored vulnerability processing response information of the target computer to the response analysis module; The response analysis module is used to perform response analysis operations on the vulnerability processing response information of the target computer and transmit the results of the response analysis operations to the identification module; The identification module determines whether the target computer has security operation and maintenance service risks based on the results of the response analysis operation; The anomaly analysis module is used to perform anomaly analysis on computers with potential security operation and maintenance service risks and transmit the results of the anomaly analysis to the early warning module; The early warning module decides to issue a high-risk early warning signal or a low-risk early warning signal based on the results of the abnormality analysis, and transmits the high-risk early warning signal or the low-risk early warning signal to the operation adjustment module; The operation adjustment module is used to intelligently control the actual sampling frequency of the computer corresponding to the low-risk warning signal based on the initial sampling frequency of the computer's vulnerability processing response information, and to judge the danger level of the computer corresponding to the high-risk warning signal and execute the corresponding safe operation strategy according to the judgment result.

2. A computer security operation and maintenance service system according to claim 1, characterized in that: The vulnerability processing response information of the target computer includes the timestamp when each vulnerability of the target computer is discovered and the timestamp when it is repaired.

3. A computer security operation and maintenance service system according to claim 1, characterized in that: The response analysis module is used to perform response analysis on the vulnerability processing response information of the target computer, which includes: For each vulnerability, the response time is calculated separately. The response time is the difference between the timestamp of the repair and the timestamp of the discovery. Then the response times of all vulnerabilities are summed up and divided by the total number of vulnerabilities to obtain the average value of the vulnerability processing responses. Based on the average value of the vulnerability processing responses, the standard deviation of the vulnerability processing responses is calculated. The average value and the standard deviation of the vulnerability processing responses are sent to the identification module together.

4. A computer security operation and maintenance service system according to claim 3, characterized in that: The identification module determines whether the target computer has security operation and maintenance service risks based on the results of the response analysis operation. The identification module is preset with a vulnerability processing response standard average value and a vulnerability processing response standard value threshold. The average value of the vulnerability processing response is compared with the preset vulnerability processing response standard average value, and the standard deviation of the vulnerability processing response is compared with the preset vulnerability processing response standard value threshold. If the average value of the vulnerability processing response is less than or equal to the preset vulnerability processing response standard average value and the standard deviation of the vulnerability processing response is less than or equal to the preset vulnerability processing response standard value threshold, a normal signal is generated. If the average value of the vulnerability processing response is less than or equal to the preset vulnerability processing response standard average value and the standard deviation of the vulnerability processing response is less than or equal to the preset vulnerability processing response standard value threshold, a hidden danger signal is generated. When the hidden danger signal is generated, it is determined that the target computer has a security operation and maintenance service hidden danger.

5. A computer security operation and maintenance service system according to claim 4, characterized in that: The anomaly analysis module is used to perform anomaly analysis on computers with potential security operation and maintenance service risks. The operation means: obtaining network performance information and computer system performance information of computers with potential security operation and maintenance service risks, then performing feature extraction and anomaly analysis to obtain network quality index and system quality index, and then transmitting the network quality index and system quality index together to a pre-trained machine learning model to generate a computer safety operation coefficient.

6. A computer security operation and maintenance service system according to claim 5, characterized in that: The logic for obtaining the network quality index is as follows: Extract the corresponding data of bandwidth utilization characteristic index, average round-trip delay characteristic index, jitter characteristic index, and packet loss rate characteristic index from the network performance information, and then normalize the data of different magnitudes so that they can be compared on the same scale. Then use the entropy weight method to calculate the weight of the characteristic index, and establish the fuzzy matrix R based on the normalized data. Use r in the fuzzy matrix R. ij Represents the normalized value of the i-th sample on the j-th index, and calculates the comprehensive evaluation vector. The calculation formula is: B = W × R; B is the comprehensive evaluation vector, R is the fuzzy matrix, W = [w1, w2, ..., w m ], W is the weight vector; Calculate the network quality index using the following formula: NQI is the network quality index, w j is the weight of the jth indicator, r j is the normalized value of the jth performance indicator, and m is the total number of weights in the weight vector.

7. A computer security operation and maintenance service system according to claim 6, characterized in that: The logic for obtaining the system quality index is: Extract multiple preset performance indicator data from the computer system performance information, then perform normalization processing. Based on the normalized data, construct a comparison sequence and a reference sequence. The comparison sequence is a sequence composed of the normalized performance indicator values, and the reference sequence is a sequence composed of the ideal performance indicator values. Calculate the correlation coefficient of each performance indicator. The calculation formula of the correlation coefficient is: Δ ij =|x′ i -x′ j |;Δ ij represents the absolute difference between the i-th sample and the j-th ideal value, Δ min Indicates the minimum difference between all compared sequences and the reference sequence, Δ max represents the maximum value of the difference between all comparison sequences and the reference sequence, ρ is the resolution coefficient, ξ ij is the correlation coefficient between the i-th sample and the j-th ideal value, and then the grey correlation degree is calculated using the following formula: n is the total number of performance indicators, γ i is the grey relational degree; Construct a decision matrix and determine the ideal solution and negative ideal solution. The ideal solution is A + , represents the optimal value of each performance indicator, and the negative ideal solution is A - , represents the worst value of each performance indicator, and then calculates the relative closeness: and Represents the distance between the sample and the ideal solution and the negative ideal solution, C i Represents relative proximity, and the system quality index is the average of all relative proximity.

8. A computer security operation and maintenance service system according to claim 7, characterized in that: The early warning module decides to issue a high-risk warning signal or a low-risk warning signal based on the results of abnormal analysis. Compare the computer's safe operation coefficient with the preset warning threshold in the warning module. If the computer's safe operation coefficient is greater than or equal to the preset warning threshold, a low-risk warning signal is issued. If the computer's safe operation coefficient is less than the preset warning threshold, a high-risk warning signal will be issued.

9. A computer security operation and maintenance service system according to claim 8, characterized in that: The operation adjustment module is used to intelligently adjust the actual sampling frequency of the computer corresponding to the low-risk warning signal based on the initial sampling frequency of the computer's vulnerability processing response information. For computers corresponding to low-risk warning signals, the actual sampling frequency is intelligently regulated based on the initial sampling frequency of the computer's vulnerability processing response information. The regulation formula is: K is the ratio of the current computer safety operation coefficient to the preset warning threshold, TK is the adjusted sampling frequency, and T0 is the initial sampling frequency.

10. A computer security operation and maintenance service system according to claim 9, characterized in that: Determining the danger level of a computer corresponding to a high-risk warning signal means: presetting a danger range-level table, finding the level corresponding to the danger range into which the computer safety operation coefficient of the computer corresponding to the high-risk warning signal falls and using it as the danger level of the computer.

Images