A computer information security monitoring system

Abstract

The present invention provides a computer information security monitoring system, which belongs to the field of security monitoring technology, and includes: a data monitoring module, which is used to send a security monitoring request to a computer to determine the storage medium that needs to be monitored on the computer, and then monitor the internal data and network data of the storage medium; an analysis and processing module, which is used to determine the influencing factor based on the network data to obtain the analysis index set for the internal data, and analyze and process the internal data to determine the abnormal data existing in the internal data and the abnormal generation efficiency and abnormal generation cause of the abnormal data; a risk analysis module, which is used to analyze the risk of the computer; a security protection module, which is used to obtain the protection method of the risk and the risk blocking position based on the computer, and perform additional mapping of the method to realize information security protection. Avoid the probability of data being tampered with, and then facilitate the security and reliability of subsequent data storage.

Description

Technical Field

[0001] The present invention relates to the technical field of security monitoring, and in particular to a computer information security monitoring system. Background Art

[0002] Computer systems are facilities used for information storage and processing, and the original intention of security is to take protective measures to prevent intentional or unintentional damage from attackers.

[0003] At present, computer systems are facing various threats, which can be roughly divided into the following three aspects: 1. Direct damage to the hardware equipment of the computer system, 2. Illegal acquisition, tampering and destruction of information stored on the system storage medium, 3. Illegal acquisition, tampering and destruction of information during information transmission. Among them, the safe storage of data stored in the storage medium is of utmost importance. The common security protection method is to place the data in the corresponding storage space and then set the encryption password. This process can only ensure that the data has a certain degree of security in the corresponding space after it is stored in the corresponding space. However, it is unknown whether the data has been tampered with during and before the data storage process, that is, risk blocking is missing, which leads to a serious reduction in the security and reliability of the data.

[0004] Therefore, the present invention proposes a computer information security monitoring system. Summary of the invention

[0005] The present invention provides a computer information security monitoring system, which is used to analyze and process internal data by acquiring the indicator set corresponding to the influencing factors under the network data in real time, effectively determine the existing abnormal causes and then reasonably determine the existing risks to achieve effective addition of protection methods, avoid the probability of data being tampered with, and facilitate the security and reliability of subsequent data storage.

[0006] The present invention provides a computer information security monitoring system, comprising:

[0007] A data monitoring module, used for sending a security monitoring request to a computer to determine a storage medium that needs to be monitored on the computer, and then performing internal data monitoring and network data monitoring on the storage medium;

[0008] An analysis and processing module, configured to determine the influencing factors based on the network data to obtain an analysis indicator set for the internal data, and to analyze and process the internal data to determine abnormal data existing in the internal data and the abnormality generation efficiency and abnormality generation cause of the abnormal data;

[0009] A risk analysis module, used to analyze the risk of the computer based on the abnormal data of each storage medium, the abnormality generation efficiency, and the abnormality generation cause;

[0010] The security protection module is used to obtain the risky protection method and the risk blocking position based on the computer, and perform additional mapping of the method to achieve information security protection.

[0011] Preferably, the data monitoring module includes:

[0012] A first matching unit, configured to match a request field of the security monitoring request with a field database of the computer to obtain a monitoring description;

[0013] The second matching unit is used to match the monitoring description with the medium database to obtain the storage medium that needs to be monitored.

[0014] Preferably, the data monitoring module further includes:

[0015] An internal monitoring unit, used for monitoring the data stored in the storage medium at a current moment, wherein the stored data is regarded as internal data;

[0016] The tracing unit is used to trace the computer-based storage communication thread in the process of data storage in the corresponding storage medium at the current moment, and to capture the node network data of the storage communication thread.

[0017] Preferably, the analysis and processing module includes:

[0018] A history acquisition unit, used to monitor the first stored data of the last storage cycle of the storage medium before the last random locking moments, and at the same time, monitor the second stored data of the storage medium at each last moment;

[0019] A change determination unit, used to obtain change data based on the last storage cycle after a storage operation is performed on the corresponding storage medium at a previous moment;

[0020] A one-by-one comparison and analysis unit, used to compare and analyze the data to be stored in the last storage cycle and the data to be stored corresponding to the previous moment with the first stored data and the second stored data corresponding to the previous moment one by one, and construct a trend curve, wherein the abscissa of the trend curve is the time when the corresponding storage medium is stored in sequence, and the ordinate of the trend curve is the data difference of the one-by-one comparison and analysis;

[0021] A coefficient determination unit, used to determine an initial abnormal coefficient of a corresponding storage medium at a corresponding previous moment based on the trend curve and the change data;

[0022] A threat determination unit, configured to determine, based on each node network data, a possible threat type of the corresponding communication node to the internal data and a probability of occurrence of each possible threat type;

[0023] A sub-construction unit, used for constructing a sub-thread based on the storage communication thread based on each possible threat occurrence type and occurrence probability;

[0024] A factor analysis unit, used for analyzing the influence factor of each sub-thread on the internal data;

[0025] An indicator acquisition unit, configured to perform coefficient correction on each initial abnormality coefficient based on all influencing factors to determine a storage abnormality level of a corresponding storage medium, and acquire an analysis indicator set from a level-analysis comparison table depending on the storage abnormality level;

[0026] A standardization unit, used for obtaining an abnormal analysis model under a corresponding analysis index, and inputting the internal data into the corresponding abnormal analysis model to obtain separate data under the corresponding analysis index;

[0027] The efficiency determination unit is used to lock the position of all individual data under the same storage medium in the internal data at the current moment and the similar description of the difference between all individual data and the reference data under the standard abnormal cause, so as to determine the abnormality generation efficiency and the abnormality generation cause.

[0028] Preferably, the efficiency determination unit comprises:

[0029] The result usage subunit is used to determine the position anomaly ratio of all individual data based on the internal data and the number of anomalies involved in the same position according to the position locking result;

[0030] A proportion correction subunit, used to correct the position abnormality proportion based on the abnormality number to obtain the abnormality generation efficiency;

[0031] ;in, Indicates the corresponding abnormality generation efficiency; Indicates the corresponding position abnormality ratio; represents the correction coefficient; n1 represents the total number of locations where the corresponding internal data exists; n2 represents the number of analysis indicators in the corresponding analysis indicator set; represents the set weight of the i1th position; Indicates the number of anomalies involved in the i1th position; Indicates all The maximum value in ; Indicates all The variance of Indicates the number of positions involved in the individual data under the i2th analysis indicator; Indicates all Variance of ; ln represents the sign of logarithmic function.

[0032] Preferably, the risk analysis module includes:

[0033] a matrix construction unit, for dividing all storage media into regions of storage function according to the internal position of each storage medium in the computer, and constructing an analysis matrix corresponding to the divided regions, wherein the analysis matrix is ​​related to abnormal data, abnormality generation efficiency, and abnormality generation cause;

[0034] A feature extraction unit, used for extracting features from the analysis matrix to obtain a feature vector;

[0035] A weight assigning unit, used for classifying the abnormal data of the storage medium involved in the corresponding divided area according to the same abnormality generating cause to obtain a plurality of abnormal blocks, and assigning a cause weight to the corresponding abnormality generating cause according to all abnormality generating efficiencies under the same abnormality generating cause and the feature vector;

[0036] The model analysis unit is used to construct an abnormality vector according to the abnormality cause and the cause weight, and input the abnormality vector into the risk analysis model to output the existence risk of the computer.

[0037] Preferably, the security protection module includes:

[0038] A test instance acquisition unit, used to acquire a protection method matching the corresponding existing risk from a risk-protection comparison table, and acquire a test instance set matching the protection method from a test database;

[0039] A response verification unit, used for acquiring a protection firmware matching the protection mode and attaching it to a corresponding risk blocking position, and performing response verification on the protection firmware at the corresponding risk blocking position according to each test instance in the test instance set;

[0040] When the number of successful response verifications is greater than the preset number, the corresponding protection method is determined to be qualified;

[0041] Otherwise, obtaining a first instance of a response verification failure and a failure indication of each first instance during the verification process, wherein the failure indication is related to the number of symbol failures and the instance type;

[0042] A cluster analysis unit, used for cluster analysis of all failure indications under the same protection mode;

[0043] A weight calculation unit, used to determine a failure weight of a corresponding cluster analysis result based on each failure indication in each cluster analysis result and a preset blocking weight;

[0044] An array construction unit, used to determine the failure blocking type with the maximum weight and the second largest weight among all failure weights under the same protection mode, and construct a new array;

[0045] The reattaching unit is used to match the reinforcement method from the array-reinforcement comparison table according to the new array, and reattach the reinforcement firmware matching the reinforcement method to the corresponding risk blocking position.

[0046] Preferably, the weight assigning unit comprises:

[0047] The coefficient subunit is used to calculate the analysis coefficient of each abnormality cause;

[0048] ; Among them, max represents the maximum value symbol; Indicates the cause of the j1th exception Causes of abnormality related to feature vectors Similarity function of ; Indicates all abnormal data under the abnormal block corresponding to the j1th abnormal cause Abnormal data related to the feature vector Similarity function of ; represents the exponential correction function; Indicates the number of abnormality generation efficiencies involved in the j1th abnormality generation cause; It indicates the efficiency of the j2nd abnormality caused by the j1th abnormality; The sum of the position weights of the j2th abnormality generation efficiency involved in the j1th abnormality generation cause and the position occupied by the abnormal data corresponding to the abnormality data in the corresponding storage medium based on the internal data; Indicates the abnormal production efficiency involved in the feature vector;

[0049] A weight subunit, used for assigning a cause weight to a corresponding cause of anomaly generation based on all analysis coefficients;

[0050] ;in, represents the cause weight assigned to the cause of the j1th anomaly; represents the analysis coefficient of the j1th abnormality cause; m1 represents the total number of abnormality causes.

[0051] Compared with the prior art, the present invention has the following beneficial effects:

[0052] By acquiring the indicator set corresponding to the influencing factors under the network data in real time to analyze and process the internal data, the cause of the abnormality can be effectively determined, and then the risk can be reasonably determined to achieve the effective addition of protection methods, which can effectively avoid the probability of data tampering and facilitate the security and reliability of subsequent data storage.

[0053] Other features and advantages of the present invention will be described in the following description, and partly become apparent from the description, or understood by practicing the present invention. The purpose and other advantages of the present invention can be realized and obtained by the structures particularly pointed out in the written description and the accompanying drawings.

[0054] The technical solution of the present invention is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0056] Figure 1 A structural diagram of a computer information security monitoring system in an embodiment of the present invention;

[0057] Figure 2 This is a comparative analysis diagram of each embodiment of the present invention. DETAILED DESCRIPTION

[0058] The preferred embodiments of the present invention are described below in conjunction with the accompanying drawings. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present invention, and are not used to limit the present invention.

[0059] The present invention provides a computer information security monitoring system, such as Figure 1 As shown, including:

[0060] A data monitoring module, used for sending a security monitoring request to a computer to determine a storage medium that needs to be monitored on the computer, and then performing internal data monitoring and network data monitoring on the storage medium;

[0061] An analysis and processing module, configured to determine the influencing factors based on the network data to obtain an analysis indicator set for the internal data, and to analyze and process the internal data to determine abnormal data existing in the internal data and the abnormality generation efficiency and abnormality generation cause of the abnormal data;

[0062] A risk analysis module, used to analyze the risk of the computer based on the abnormal data of each storage medium, the abnormality generation efficiency, and the abnormality generation cause;

[0063] The security protection module is used to obtain the risky protection method and the risk blocking position based on the computer, and perform additional mapping of the method to achieve information security protection.

[0064] In this embodiment, the computer may be a desktop computer, a notebook, etc., and the security monitoring request is related to the storage medium to be monitored. For example, the security monitoring request (comprising two fields) is: qqy01 qqy02, wherein qqy01 is described as monitoring the storage medium numbered y01, and qqy02 is described as monitoring the storage medium numbered y02 (monitoring description). At this time, the storage media to be monitored are: the storage media numbered y01 and y02.

[0065] In this embodiment, the internal data of the storage medium refers to the data stored in the medium, and in this application, the internal data generally refers to text data.

[0066] In this embodiment, network data refers to the data corresponding to the node attack and defense. For example, the internal data is transferred from the D disk to the r1 folder in the file library in the C disk (storage address: EE00--EEF0). At this time, it will pass through node D--node C--node file library--node r1 folder. Every time the data passes through a node, there may be an attack on the node, and then defense information based on the attack behavior is generated based on the node. If the defense is in place, that is, the attack behavior will not cause tampering to the data passing through the node. If the defense is not in place, the tampered data is determined.

[0067] In this embodiment, the impact factor refers to the factor determined based on the network data involved in the storage thread of the internal data.

[0068] In this embodiment, the purpose of the analysis indicator set is to specifically determine reasonable analysis indicators for internal data. The analysis indicator sets corresponding to different influencing factors are different, specifically: the number of indicators is different and the indicator weights are different. For example, the analysis indicators are: text completeness indicator, text accuracy indicator, etc.

[0069] In this embodiment, the individual data under each analysis indicator constitutes the abnormal data existing in the internal data, and the individual data is the abnormal data existing under the analysis indicator.

[0070] In this embodiment, the abnormal generation efficiency and the abnormal production cause are specific to the storage medium, providing a basis for subsequent determination of the existence of risks. For example, the abnormal generation cause is caused by the existence of attack behavior 1.

[0071] In this embodiment, the risk exists when the computer has a Class A attack behavior, and the risk exists based on the relevant information of all storage media (abnormal data and the abnormality generation efficiency and cause of the abnormality of the abnormal data), such as virus attacks and software malicious attacks.

[0072] In this embodiment, the protection method refers to a method of preventing virus attacks. For example, for attacks against malware, an encryption key program is set up. For example, for DDoS attacks, a firewall or intrusion prevention system is set up. For example, for SQL injection attacks, a verification password is set up. For example, for zero-day attacks, an anti-virus method is set up.

[0073] In this embodiment, the risk blocking position refers to the position where the corresponding risk occurs. For example, in a computer, a zero-day attack occurs when node C communicates. At this time, an antivirus method is set at node C to avoid the possibility of data tampering caused by the attack.

[0074] The beneficial effect of the above technical solution is: by acquiring the indicator set corresponding to the influencing factors under the network data in real time to analyze and process the internal data, the cause of the abnormality can be effectively determined and then the risk can be reasonably determined to realize the effective addition of protection methods, which can effectively avoid the probability of data being tampered with, thereby facilitating the security and reliability of subsequent data storage.

[0075] The present invention provides a computer information security monitoring system, wherein the data monitoring module comprises:

[0076] A first matching unit, configured to match a request field of the security monitoring request with a field database of the computer to obtain a monitoring description;

[0077] The second matching unit is used to match the monitoring description with the medium database to obtain the storage medium that needs to be monitored.

[0078] Preferably, the data monitoring module further includes:

[0079] An internal monitoring unit, used for monitoring the data stored in the storage medium at a current moment, wherein the stored data is regarded as internal data;

[0080] The tracing unit is used to trace the computer-based storage communication thread in the process of data storage in the corresponding storage medium at the current moment, and to capture the node network data of the storage communication thread.

[0081] In this embodiment, the field database includes different request fields and monitoring descriptions matching the request fields, and the medium database includes different monitoring descriptions and storage media matching the descriptions, which are all pre-set for standardization.

[0082] In this embodiment, the data stored at the current moment refers to the data a1a2a3a4 stored in the medium at the current time.

[0083] In this embodiment, during the storage process at the current moment, multiple different data may be stored in the medium separately. For example, data 1 obtained from the U1 file library of the C drive is stored in the U0 folder of the D drive, and data 2 obtained from the U2 file library of the C drive is stored in the U0 folder of the D drive. At this time, the internal data is: data 1 and data 2 stored in the U0 folder, among which the storage communication threads are: C drive U1 file library-D drive R file library-D drive U0 folder (child thread), C drive U2 file library-D drive R file library-D drive U0 folder (child thread).

[0084] In this embodiment, the capture of node network data is to determine whether there is corresponding attack and defense on the corresponding node during the information transmission process inside the computer.

[0085] The beneficial effects of the above technical solution are: by matching fields and descriptions from two preset databases, it is convenient to directly lock the storage medium, providing a basic foundation for subsequent data protection, and further by determining the storage communication thread, advance defense deployment is made for attacks that may be encountered during subsequent transmission, thereby effectively ensuring the security and reliability of data transmission and storage.

[0086] The present invention provides a computer information security monitoring system, wherein the analysis and processing module comprises:

[0087] A history acquisition unit, used to monitor the first stored data of the last storage cycle of the storage medium before the last random locking moments, and at the same time, monitor the second stored data of the storage medium at each last moment;

[0088] A change determination unit, used to obtain change data based on the last storage cycle after a storage operation is performed on the corresponding storage medium at a previous moment;

[0089] A one-by-one comparison and analysis unit, used to compare and analyze the data to be stored in the last storage cycle and the data to be stored corresponding to the previous moment with the first stored data and the second stored data corresponding to the previous moment one by one, and construct a trend curve, wherein the abscissa of the trend curve is the time when the corresponding storage medium is stored in sequence, and the ordinate of the trend curve is the data difference of the one-by-one comparison and analysis;

[0090] A coefficient determination unit, used to determine an initial abnormal coefficient of a corresponding storage medium at a corresponding previous moment based on the trend curve and the change data;

[0091] A threat determination unit, configured to determine, based on each node network data, a possible threat type of the corresponding communication node to the internal data and a probability of occurrence of each possible threat type;

[0092] A sub-construction unit, used for constructing a sub-thread based on the storage communication thread based on each possible threat occurrence type and occurrence probability;

[0093] A factor analysis unit, used for analyzing the influence factor of each sub-thread on the internal data;

[0094] An indicator acquisition unit, configured to perform coefficient correction on each initial abnormality coefficient based on all influencing factors to determine a storage abnormality level of a corresponding storage medium, and acquire an analysis indicator set from a level-analysis comparison table depending on the storage abnormality level;

[0095] A standardization unit, used for obtaining an abnormal analysis model under a corresponding analysis index, and inputting the internal data into the corresponding abnormal analysis model to obtain separate data under the corresponding analysis index;

[0096] The efficiency determination unit is used to lock the position of all individual data under the same storage medium in the internal data at the current moment and the similar description of the difference between all individual data and the reference data under the standard abnormal cause, so as to determine the abnormality generation efficiency and the abnormality generation cause.

[0097] In this embodiment, for example, storage medium 1 involves monitoring moments t1, t2, t3, and t4, wherein it is assumed that two previous moments are randomly locked. At this time, the randomly locked moments are: moment t1 and moment t3. At this time, the last storage cycle corresponding to storage medium 1 is T1, that is, moment t1 is immediately following the end of the last storage cycle T1. If the last storage cycle is incomplete, all data before moment t1 will be taken as the first stored data.

[0098] It should be noted that the storage period of each storage medium may be different, and there is a medium-period mapping table, which contains different storage media and storage periods matching the media. The storage period is related to the frequency of use of the medium. The higher the frequency of use, the longer the corresponding storage period. This is mainly to ensure the authenticity and reliability of the acquisition of the first stored data and provide a reliable basis.

[0099] In this embodiment, the second stored data refers to the data stored at the corresponding moment.

[0100] In this embodiment, first, after the data of the last storage cycle is stored, new data (second stored data) is stored at the time t1 of the last storage cycle. In the process of storing the new data, it is determined whether the storage data of the corresponding last storage cycle will be changed. If so, the changed data is extracted from the storage data of the last storage cycle and regarded as the changed data. If not, it is determined that there is no changed data.

[0101] In this embodiment, the data to be stored in the last storage cycle and the data to be stored at the previous moment refer to the data to be stored in the corresponding storage medium, which is the data that has not been tampered with at this time, and the first stored data and the second stored data refer to the data stored in the corresponding medium, which may contain tampered data at this time.

[0102] In this embodiment, if Figure 2 As shown, compare and analyze the figures one by one.

[0103] The data to be stored in the last storage cycle: a1, a2, a3, a4, corresponding to the data to be stored at the previous moment: a5;

[0104] The first stored data of the last storage cycle: a1, a2, a3, b0, corresponds to the second stored data of the previous moment: a6.

[0105] Among them, the tampered data that exists are: a4 corresponds to b0, a5 corresponds to a6, the data difference is related to the similarity between the corresponding data that has not been stored and has been stored, and the data difference = 1-the similarity at the corresponding moment. When the stored data has not been tampered with, the corresponding data difference is 0.

[0106] In this embodiment, the initial abnormal coefficient ; Among them, h1 is the data difference corresponding to the previous moment; ha is the average value of all non-zero points on the trend curve; bp is the variance of all non-zero points on the trend curve; ln is the sign of the logarithmic function; Ln is the total number of all points on the trend curve; Lz is the number of zero points on the trend curve.

[0107] In this embodiment, feature extraction of node network data can obtain possible threat types and occurrence probabilities, and is based on network feature model analysis. The network feature model is obtained by training a neural network model based on different network data and threat types and occurrence probabilities based on network data. Because network data includes attack and defense information, the type of attack behavior can be determined, and the probability of occurrence = the number of attacks of the same attack type / the total number of attacks of all attack types determined based on network data.

[0108] In this embodiment, the communication threads are stored: C disk U1 file library - D disk R file library - D disk U0 folder (sub-thread 01), C disk U2 file library - D disk R file library - D disk U0 folder (sub-thread 02).

[0109] For example, the U1 file library on the C drive -- attack type 1 (probability of occurrence 0.3), attack type 2 (probability of occurrence 0.7);

[0110] D disk R file library-attack type 1 (probability of occurrence 1);

[0111] D drive U0 folder-attack type 3 (probability of occurrence 1);

[0112] At this time, the impact factor is obtained for the attack type and occurrence probability of sub-thread 01, and the impact factor is a correction coefficient for the anomaly;

[0113] Among them, the impact factor , where m3 represents the total number of nodes in the subthread; Indicates the total number of possible threat occurrence types under the j3th node; represents the probability of occurrence of the j4th possible threat type under the j3th node; Indicates the possibility of overcoming the j4th possible threat type under the j3th node, with a value range of (0, 1);

[0114] In this embodiment, the corrected coefficient = initial abnormal coefficient × (average value of all influencing factors + 1).

[0115] In this embodiment, the abnormal level is stored , where the level unit is generally 0.3, The floor symbol.

[0116] In this embodiment, the level-analysis comparison table includes different storage anomaly levels and analysis indicator sets for the levels, and the number of indicators and indicator weights included in the analysis indicator sets corresponding to different levels are different.

[0117] In this embodiment, each analysis indicator corresponds to several anomaly analysis models, and a final model is selected from the several anomaly analysis models according to the indicator weight as the anomaly analysis model corresponding to the analysis indicator (the anomaly analysis accuracy of the anomaly analysis models corresponding to different weights is different, which is convenient for targeted locking of relevant anomalies in the internal data and ensuring the accuracy of the anomaly analysis), and the anomaly analysis model is obtained by training the neural network model based on the corresponding data and the analysis results of the data based on the indicator as samples.

[0118] For example, the internal data is: r1r2r3r5;

[0119] After analyzing the internal data with the exception analysis model of the text completeness indicator, it is found that the data of r6 is missing. At this time, r6 is regarded as a separate data;

[0120] After analyzing the internal data with the anomaly analysis model of the text accuracy indicator, it was found that r5 should have been r0. At this time, r5 was regarded as a separate data.

[0121] In this embodiment, for example: r1 corresponds to position 1, r2 corresponds to position 2, r3 corresponds to position 3, and r5 corresponds to position 4. At this time, r6 corresponds to position 5 but is missing. At this time, the tampered data disappears, and r5 corresponds to position 4.

[0122] In this embodiment, the standard abnormality reasons and the matching reference data are pre-set and can be used directly.

[0123] For example, the description of r5 is A1. At this time, it is matched with the description of the possible abnormal reasons for r0 being tampered with, and the reason with the smallest description difference similarity is selected as the cause of the abnormality, and the cause of the abnormality is related to the result change caused by the attack behavior.

[0124] The beneficial effect of the above technical solution is: by comparing and analyzing the data to be stored and the stored data at different previous moments and the last storage cycle, a trend curve is constructed and the initial anomaly coefficient is effectively calculated in combination with the change data, providing a basis for the subsequent screening of the indicator set, and further calculating the impact factor by analyzing the threat type and probability of occurrence of the node, and correcting the coefficient to improve the accuracy of the level determination, thereby obtaining an analysis indicator set, and realizing accurate analysis of the internal data.

[0125] The present invention provides a computer information security monitoring system, wherein the efficiency determination unit comprises:

[0126] The result usage subunit is used to determine the position anomaly ratio of all individual data based on the internal data and the number of anomalies involved in the same position according to the position locking result;

[0127] A proportion correction subunit, used to correct the position abnormality proportion based on the abnormality number to obtain the abnormality generation efficiency;

[0128] ,in, Indicates the corresponding abnormality generation efficiency; Indicates the corresponding position abnormality ratio; represents the correction coefficient; n1 represents the total number of locations where the corresponding internal data exists; n2 represents the number of analysis indicators in the corresponding analysis indicator set; represents the set weight of the i1th position; Indicates the number of anomalies involved in the i1th position; Indicates all The maximum value in ; Indicates all The variance of Indicates the number of positions involved in the individual data under the i2th analysis indicator; Indicates all Variance of ; ln represents the sign of logarithmic function.

[0129] In this embodiment, before the data is stored, the weight of the position corresponding to each data is set, that is, the importance of the data at the position corresponding to different position weights is also different, and the position weight corresponds to the importance of the data at the position one by one, and the sum of the position weights of all positions corresponding to the data that needs to be stored is 1.

[0130] In this embodiment, the number of exceptions is implemented based on indicators. If the data at position 1 is neither complete nor accurate, the number of exceptions is 2.

[0131] In this embodiment, there are as many positions as there are data. Because it is for text, every 5 text symbols can be set as one data, which corresponds to one position, and the number of text symbols is greater than 100.

[0132] The beneficial effects of the above technical solution are: determining the proportion of position anomalies and the number of anomalies through locking results, calculating the efficiency of anomaly generation, providing convenience for determining the protection method, and ensuring the accuracy of the method acquisition.

[0133] The present invention provides a computer information security monitoring system, wherein the risk analysis module comprises:

[0134] a matrix construction unit, for dividing all storage media into regions of storage function according to the internal position of each storage medium in the computer, and constructing an analysis matrix corresponding to the divided regions, wherein the analysis matrix is ​​related to abnormal data, abnormality generation efficiency, and abnormality generation cause;

[0135] A feature extraction unit, used for extracting features from the analysis matrix to obtain a feature vector;

[0136] A weight assigning unit, used for classifying the abnormal data of the storage medium involved in the corresponding divided area according to the same abnormality generating cause to obtain a plurality of abnormal blocks, and assigning a cause weight to the corresponding abnormality generating cause according to all abnormality generating efficiencies under the same abnormality generating cause and the feature vector;

[0137] The model analysis unit is used to construct an abnormality vector according to the abnormality cause and the cause weight, and input the abnormality vector into the risk analysis model to output the existence risk of the computer.

[0138] In this embodiment, the risk analysis model is obtained by training a neural network model based on different abnormal vectors and risk analysis of the abnormal vectors as samples.

[0139] In this embodiment, the exception vector = {all the causes of the exception and the weights of the exceptions}.

[0140] In this embodiment, since the abnormal data in each storage medium may involve multiple abnormal causes, for example, storage medium 1: abnormal data 11 (cause e1), abnormal data 12 (cause e2), abnormal data 13 (cause e3);

[0141] Storage medium 2: abnormal data 21 (reason e1);

[0142] Storage medium 3: abnormal data 32 (reason e2);

[0143] At this time, for reason e1: abnormal data 11, abnormal data 21;

[0144] For reason e2: abnormal data 12, abnormal data 32;

[0145] For reason e3: abnormal data 13, wherein the data involved in each reason is the abnormal block.

[0146] In this embodiment, all the abnormality generation efficiencies under the same abnormality generation cause are the abnormality generation efficiencies corresponding to the internal data in the corresponding storage medium.

[0147] In this embodiment, there are storage medium 1, storage medium 2, storage medium 3, storage medium 4, and storage medium 5. At this time, storage medium 1, storage medium 2, and storage medium 4 are storage media for text type entertainment text, and storage medium 3 and storage medium 5 are storage media for text type working text. The storage functions are: entertainment text storage function and working text storage function.

[0148] .

[0149] In this embodiment, the feature extraction of the matrix is ​​implemented based on the principal component analysis method, which belongs to the prior art.

[0150] Feature vector = {feature data, feature generation efficiency, feature generation reason}.

[0151] Preferably, the weight assigning unit comprises:

[0152] The coefficient subunit is used to calculate the analysis coefficient of each abnormality cause;

[0153] ; Among them, max represents the maximum value symbol; Indicates the cause of the j1th exception Causes of abnormality related to feature vectors Similarity function of ; Indicates all abnormal data under the abnormal block corresponding to the j1th abnormal cause Abnormal data related to the feature vector Similarity function of ; represents the exponential correction function; Indicates the number of abnormality generation efficiencies involved in the j1th abnormality generation cause; It indicates the efficiency of the j2nd abnormality caused by the j1th abnormality; The sum of the position weights of the j2th abnormality generation efficiency involved in the j1th abnormality generation cause and the position occupied by the abnormal data corresponding to the abnormality data in the corresponding storage medium based on the internal data; Indicates the abnormal production efficiency involved in the feature vector;

[0154] A weight subunit, used for assigning a cause weight to a corresponding cause of anomaly generation based on all analysis coefficients;

[0155] ;in, represents the cause weight assigned to the cause of the j1th anomaly; represents the analysis coefficient of the j1th abnormality cause; m1 represents the total number of abnormality causes.

[0156] In this embodiment, the value range of the abnormality generation efficiency is (0, 1).

[0157] The beneficial effects of the above technical solution are: by dividing the causes of the exceptions into the same blocks to calculate the weights of the causes of the exceptions, the accuracy of vector construction is ensured, and the risks are obtained through model analysis to ensure the rationality and reliability of risk acquisition, thereby providing a basis for subsequent targeted protection of computers.

[0158] The present invention provides a computer information security monitoring system, wherein the security protection module comprises:

[0159] A test instance acquisition unit, used to acquire a protection method matching the corresponding existing risk from a risk-protection comparison table, and acquire a test instance set matching the protection method from a test database;

[0160] A response verification unit, used for acquiring a protection firmware matching the protection mode and attaching it to a corresponding risk blocking position, and performing response verification on the protection firmware at the corresponding risk blocking position according to each test instance in the test instance set;

[0161] When the number of successful response verifications is greater than the preset number, the corresponding protection method is determined to be qualified;

[0162] Otherwise, obtaining a first instance of a response verification failure and a failure indication of each first instance during the verification process, wherein the failure indication is related to the number of symbol failures and the instance type;

[0163] A cluster analysis unit, used for cluster analysis of all failure indications under the same protection mode;

[0164] A weight calculation unit, used to determine a failure weight of a corresponding cluster analysis result based on each failure indication in each cluster analysis result and a preset blocking weight;

[0165] An array construction unit, used to determine the failure blocking type with the maximum weight and the second largest weight among all failure weights under the same protection mode, and construct a new array;

[0166] The reattaching unit is used to match the reinforcement method from the array-reinforcement comparison table according to the new array, and reattach the reinforcement firmware matching the reinforcement method to the corresponding risk blocking position.

[0167] In this embodiment, a test request matching the test example is generated and sent to the protection firmware to generate an instance to be stored;

[0168] If the test instance is consistent with the corresponding instance to be stored, it is determined that the response verification is successful;

[0169] Otherwise, the response verification is determined to have failed.

[0170] In this embodiment, the protection firmware is a protection program for protecting data security storage, such as a firewall program, which prevents stored data from being illegally tampered with. Before the firewall program is set up, the data: a1a2a3g1 is stored as an instance and the result is: a1a2a8g1. At this time, the change from a3 to a8 is an illegal tampering. However, after the firewall program is set up, the result after storage is still: a1a2a3g1. At this time, it means that the response verification is successful, wherein the instance to be stored is the data obtained after the test instance passes through the firewall. After the response is successful, the protection firmware corresponding to the protection method is set at the location where the risk is generated.

[0171] In this embodiment, the risk-protection comparison table includes different existing risks and protection methods matching the risks, which are pre-set, and the protection methods all belong to existing known technologies.

[0172] In this embodiment, the test database includes different protection modes and test instances matching the modes, so as to facilitate using the test instances to test the corresponding protection modes to determine whether the protection modes are qualified.

[0173] In this embodiment, the preset number Yc is: the number of corresponding test instances in the corresponding test embodiment set × 0.85, and rounded up. If Yc = the number of corresponding test instances in the corresponding test embodiment set, then Yc-1 is used as the final preset number of values. Otherwise, Yc is still: the number of corresponding test instances in the corresponding test embodiment set × 0.85, and rounded up.

[0174] In this embodiment, the failure indication is a log generated during the test process, which is captured based on a log engine tool, that is, related information of the protection failure.

[0175] In this embodiment, the first instance of failure refers to an instance in which the protection mode fails to defend against the corresponding test instance.

[0176] In this embodiment, the number of symbol failures refers to the number of text symbols that have been tampered with in the first embodiment.

[0177] In this embodiment, the instance type refers to the corresponding text attack type.

[0178] In this embodiment, cluster analysis is implemented based on K-means algorithm, which belongs to the prior art.

[0179] In this embodiment, the failure weight is: the mean square value of the sum of the number of failures of all symbols involved / the average value of the total number of symbols involved in the corresponding embodiment×the average value of the sum of the preset blocking weights corresponding to all embodiments.

[0180] In this embodiment, there are as many failure blocking types as there are clustering results under the same protection mode. If there is only one, then there is only one in the new array, otherwise there are two.

[0181] In this embodiment, the new array = [the failure blocking type involved].

[0182] In this embodiment, the array-consolidation comparison table includes different new arrays and reinforcement methods that match the new arrays, and is pre-set, mainly to prevent data tampering by attacks.

[0183] The beneficial effects of the above technical solution are: by obtaining a set of test examples to verify the response of the protection firmware of the protection method, it is convenient to obtain an effective protection method, and then calculate the failure weight through cluster analysis of the failure indication of the first instance, which facilitates the subsequent construction of a new array, ensures the accuracy of the reinforcement method acquisition and the accuracy of the defense, and thus ensures the security of the data.

[0184] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A computer information security monitoring system, characterized in that: include: A data monitoring module, used for sending a security monitoring request to a computer to determine a storage medium that needs to be monitored on the computer, and then performing internal data monitoring and network data monitoring on the storage medium; An analysis and processing module, configured to determine the influencing factors based on the network data to obtain an analysis indicator set for the internal data, and to analyze and process the internal data to determine abnormal data existing in the internal data and the abnormality generation efficiency and abnormality generation cause of the abnormal data; A risk analysis module, used to analyze the risk of the computer based on the abnormal data of each storage medium, the abnormality generation efficiency, and the abnormality generation cause; A security protection module is used to obtain the risky protection method and the risk blocking position based on the computer, and perform additional mapping of the method to achieve information security protection; The analysis and processing module comprises: A history acquisition unit, used to monitor the first stored data of the last storage cycle of the storage medium before the last random locking moments, and at the same time, monitor the second stored data of the storage medium at each last moment; A change determination unit, used to obtain change data based on the last storage cycle after a storage operation is performed on the corresponding storage medium at a previous moment; A one-by-one comparison and analysis unit, used to compare and analyze the data to be stored in the last storage cycle and the data to be stored corresponding to the previous moment with the first stored data and the second stored data corresponding to the previous moment one by one, and construct a trend curve, wherein the abscissa of the trend curve is the time when the corresponding storage medium is stored in sequence, and the ordinate of the trend curve is the data difference of the one-by-one comparison and analysis; A coefficient determination unit, used to determine an initial abnormal coefficient of a corresponding storage medium at a corresponding previous moment based on the trend curve and the change data; A threat determination unit, configured to determine, based on each node network data, a possible threat type of the corresponding communication node to the internal data and a probability of occurrence of each possible threat type; A sub-construction unit, used for constructing a sub-thread based on the storage communication thread based on each possible threat occurrence type and occurrence probability; A factor analysis unit, used for analyzing the influence factor of each sub-thread on the internal data; An indicator acquisition unit, configured to perform coefficient correction on each initial abnormality coefficient based on all influencing factors to determine a storage abnormality level of a corresponding storage medium, and acquire an analysis indicator set from a level-analysis comparison table depending on the storage abnormality level; A standardization unit, used for obtaining an abnormal analysis model under a corresponding analysis index, and inputting the internal data into the corresponding abnormal analysis model to obtain separate data under the corresponding analysis index; An efficiency determination unit, used to lock the position of all individual data in the same storage medium in the internal data at the current moment and the similar description of the difference between all individual data and the reference data under the standard abnormal cause, so as to determine the abnormality generation efficiency and the abnormality generation cause; The efficiency determination unit comprises: The result usage subunit is used to determine the position anomaly ratio of all individual data based on the internal data and the number of anomalies involved in the same position according to the position locking result; A proportion correction subunit, used to correct the position abnormality proportion based on the abnormality number to obtain the abnormality generation efficiency; ； in, Indicates the corresponding abnormality generation efficiency; Indicates the corresponding position abnormality ratio; represents the correction coefficient; n1 represents the total number of locations where the corresponding internal data exists; n2 represents the number of analysis indicators in the corresponding analysis indicator set; represents the set weight of the i1th position; Indicates the number of anomalies involved in the i1th position; Indicates all The maximum value in ; Indicates all The variance of Indicates the number of positions involved in the individual data under the i2th analysis indicator; Indicates all Variance of ; ln represents the sign of logarithmic function.

2. The computer information security monitoring system according to claim 1, characterized in that: The data monitoring module comprises: A first matching unit, configured to match a request field of the security monitoring request with a field database of the computer to obtain a monitoring description; The second matching unit is used to match the monitoring description with the medium database to obtain the storage medium that needs to be monitored.

3. The computer information security monitoring system according to claim 1, characterized in that: The data monitoring module further includes: An internal monitoring unit, used for monitoring the data stored in the storage medium at a current moment, wherein the stored data is regarded as internal data; The tracing unit is used to trace the computer-based storage communication thread in the process of data storage in the corresponding storage medium at the current moment, and to capture the node network data of the storage communication thread.

4. The computer information security monitoring system according to claim 1, characterized in that: The risk analysis module comprises: a matrix construction unit, for dividing all storage media into regions of storage function according to the internal position of each storage medium in the computer, and constructing an analysis matrix corresponding to the divided regions, wherein the analysis matrix is ​​related to abnormal data, abnormality generation efficiency, and abnormality generation cause; A feature extraction unit, used for extracting features from the analysis matrix to obtain a feature vector; A weight assigning unit, used for classifying the abnormal data of the storage medium involved in the corresponding divided area according to the same abnormality generating cause to obtain a plurality of abnormal blocks, and assigning a cause weight to the corresponding abnormality generating cause according to all abnormality generating efficiencies under the same abnormality generating cause and the feature vector; The model analysis unit is used to construct an abnormality vector according to the abnormality cause and the cause weight, and input the abnormality vector into the risk analysis model to output the existence risk of the computer.

5. The computer information security monitoring system according to claim 4, characterized in that: The security protection module comprises: A test instance acquisition unit, used to acquire a protection method matching the corresponding existing risk from a risk-protection comparison table, and acquire a test instance set matching the protection method from a test database; A response verification unit, used for acquiring a protection firmware matching the protection mode and attaching it to a corresponding risk blocking position, and performing response verification on the protection firmware at the corresponding risk blocking position according to each test instance in the test instance set; When the number of successful response verifications is greater than the preset number, the corresponding protection method is determined to be qualified; Otherwise, obtaining a first instance of a response verification failure and a failure indication of each first instance during the verification process, wherein the failure indication is related to the number of symbol failures and the instance type; A cluster analysis unit, used for cluster analysis of all failure indications under the same protection mode; A weight calculation unit, used to determine a failure weight of a corresponding cluster analysis result based on each failure indication in each cluster analysis result and a preset blocking weight; An array construction unit, used to determine the failure blocking type with the maximum weight and the second largest weight among all failure weights under the same protection mode, and construct a new array; The reattaching unit is used to match the reinforcement method from the array-reinforcement comparison table according to the new array, and reattach the reinforcement firmware matching the reinforcement method to the corresponding risk blocking position.

6. The computer information security monitoring system according to claim 5, characterized in that: The weight assigning unit comprises: The coefficient subunit is used to calculate the analysis coefficient of each abnormality cause; ； Among them, max represents the maximum value symbol; Indicates the cause of the j1th exception Causes of abnormality related to feature vectors Similarity function of ; Indicates all abnormal data under the abnormal block corresponding to the j1th abnormal cause Abnormal data related to the feature vector Similarity function of ; represents the exponential correction function; Indicates the number of abnormality generation efficiencies involved in the j1th abnormality generation cause; It indicates the efficiency of the j2nd abnormality caused by the j1th abnormality; The sum of the position weights of the j2th abnormality generation efficiency involved in the j1th abnormality generation cause and the position occupied by the abnormal data corresponding to the abnormality data in the corresponding storage medium based on the internal data; Indicates the abnormal production efficiency involved in the feature vector; A weight subunit, used for assigning a cause weight to a corresponding cause of anomaly generation based on all analysis coefficients; ； in, represents the cause weight assigned to the cause of the j1th anomaly; represents the analysis coefficient of the j1th abnormality cause; m1 represents the total number of abnormality causes.

Images