Network security management system based on network information technology

Abstract

The present invention discloses a network security management system based on network information technology, and relates to the field of network security management based on network information technology, including a data acquisition module, a file data analysis module, a visitor analysis module, an information matching analysis module, a monitoring and early warning module, an execution terminal and a database. Through statistical analysis of the important value, confidentiality value and economic value of file data of an enterprise network platform, and then through statistical analysis of the operating time, total number of employees and annual net operating profit rate of visitors, and through statistical analysis of visitor access time and visit time interval, a level set of evaluation file data, a level of visitor judgment feedback signal and an abnormal access index of visitors in each monitoring time period are obtained, which can comprehensively consider the specific situation of the evaluation file, can restrict access rights to visitors of different levels, can better ensure the security management of the network system, and give early warning and alarm to abnormal behaviors of visitors.

Description

Technical Field

[0001] The present invention relates to the field of network security management based on network information technology, and in particular to a network security management system based on network information technology. Background Art

[0002] With the continuous development of economy and technology, network security management has become an important issue that enterprises must face. Although traditional network security management can protect the security of information files to a certain extent, it is no longer able to guarantee the security of enterprise network platform information files under increasingly complex network attacks. In this context, network security management systems based on network information technology have emerged.

[0003] When the enterprise network platform is in operation, it is impossible to comprehensively consider the inconsistency of file data, visitor strength and behavior. Security issues of the enterprise network platform often occur, which greatly increases the burden of enterprise network system management and requires long-term maintenance, increasing the cost of the enterprise.

[0004] When the enterprise network platform is in operation, there are abnormal behavior attacks from visitors, and the enterprise network platform fails to respond in time, resulting in the paralysis of the enterprise network platform from time to time, which greatly affects the normal work of the enterprise.

[0005] In order to solve the above defects, a technical solution is now provided. Summary of the invention

[0006] In order to solve the technical problems raised by the above background technology, the present invention is proposed. The embodiment of the present invention provides a network security management system based on network information technology.

[0007] The purpose of the present invention can be achieved through the following technical solutions:

[0008] Network security management system based on network information technology, data collection module, file data analysis module, visitor analysis module, information matching analysis module, monitoring and early warning module, execution terminal and database;

[0009] The file data analysis module is used to receive the file data value assessment parameters in the enterprise network platform, and perform enterprise file data determination analysis processing to obtain the first-level assessment file data set A1, the second-level assessment file data set A2 and the third-level assessment file data set A3, and send them to the information matching analysis module;

[0010] The visitor analysis module is used to receive visitor information parameters and process and analyze them, and perform visitor qualification determination analysis and processing, receive visitor behavior parameters obtained by observing the visitor's behavior of entering the network system for a certain period of time, and perform visitor behavior determination analysis and processing, thereby generating a visitor determination primary feedback signal, a visitor determination secondary feedback signal, a visitor determination third feedback signal and a visitor determination fourth feedback signal, and sending them to the information matching analysis module;

[0011] The information matching analysis module is used to receive the evaluation file data set and the visitor's judgment feedback signal, and perform two-way matching analysis processing accordingly, and match the visitor to the corresponding evaluation file data set;

[0012] The monitoring and early warning module is used to receive the visitor access monitoring parameters for determining the secondary and tertiary feedback signals, and to perform analysis and processing, and to obtain early warnings and alarms for abnormal access behaviors.

[0013] Furthermore, the specific operation steps for determining and analyzing the enterprise file data are as follows:

[0014] Identify the departments to which each enterprise file data belongs, obtain the departments to which the enterprise file data belongs, divide the enterprise departments into R&D department, finance department, legal department, marketing department, production department, administrative department and other departments, and assign corresponding scores of 10, 9, 8, 7, 6, 5 and 4 respectively, and obtain the department scores corresponding to the enterprise file data, recorded as Gb i , i is the number of each file data of the enterprise, and i is a positive integer; identify the number of signatures of important leaders of the enterprise in each file data of the enterprise. Important leaders of the enterprise refer to the deputy general manager, general manager and chairman of the enterprise. When the number is 0, 0-3, 3-5 and more than 5, the corresponding scores are 0, 3, 6 and 10 respectively. The signature number score of the important leaders corresponding to each file data of the enterprise is obtained, which is recorded as Lq i ; According to the formula Wz i =e1×Gb i +e2×Lq i , get the importance value of enterprise file data, e1 and e2 are the set weight factor coefficients;

[0015] Identify whether each enterprise file data contains confidentiality marks. If there is a confidentiality mark, it is scored as 10 points, and if there is no confidentiality mark, it is scored as 0 points. The corresponding confidentiality mark score of each enterprise file data is obtained, which is recorded as Jb i; Identify whether the file data of each enterprise contains digital amounts. If there are digital amounts, identify the corresponding digital amounts. Set no digital amounts, digital amounts between 0-10 million yuan (excluding 0 yuan), digital amounts between 10-50 million yuan, and digital amounts above 50 million yuan, with corresponding scores of 0, 3, 6, and 10, respectively, recorded as Sj i ; According to the set formula Wm i =e3×Jb i +e4×Sj i , get the confidentiality value of each enterprise file data, e3 and e4 are the set weight factor coefficients;

[0016] Match the enterprise's various file data with the set file data economic level to obtain the enterprise's various file data economic levels. The specific economic levels are important, general, and unimportant, and the corresponding scores are 10 points, 5 points, and 0 points (the value is a custom value). Match the scores corresponding to the economic levels of the enterprise's various file data, marked as Wj i ;

[0017] According to the set formula The value assessment coefficient of the enterprise file data is obtained. e5, e6, and e7 are the set weight factor coefficients of the importance value, confidentiality value, and economic value of the enterprise file data. The weight factor coefficient is used to balance the weight of each data in the formula calculation, thereby promoting the accuracy of the calculation result. From the formula, we know that the higher the importance value, confidentiality value, and economic value of the file data, the higher the assessment coefficient of the file data;

[0018] Set the evaluation coefficient reference intervals M1, M2, and M3 for enterprise file data, and substitute the evaluation coefficients of the enterprise file data into the preset gradient reference intervals M1, M2, and M3 for comparative analysis, wherein the interval values ​​of M1, M2, and M3 decrease in a gradient manner;

[0019] When the evaluation coefficient of the enterprise file data is in the gradient reference interval M1, the corresponding file data is classified into the first-level evaluation file data set A1; when the evaluation coefficient of the enterprise file data is in the gradient reference interval M2, the corresponding file data is classified into the second-level evaluation file data set A2; when the evaluation coefficient of the enterprise file data is in the gradient reference interval M3, the corresponding file data is classified into the third-level evaluation file data set A3;

[0020] The first-level evaluation file data set A1, the second-level evaluation file data set A2 and the third-level evaluation file data set A3 are sent to the information matching analysis module.

[0021] Furthermore, the specific steps of visitor qualification determination and analysis are as follows:

[0022] Obtain the annual operating net profit and annual operating revenue of each visitor, obtain the visitor operation time and total number of employees of the enterprise network platform, and obtain the visitor strength coefficient of the enterprise network platform;

[0023] A visitor strength reference threshold TT1 of the enterprise network platform is set, and a visitor strength coefficient of the enterprise network platform is compared and analyzed with the set visitor strength reference threshold TT1;

[0024] When the visitor strength coefficient of the enterprise network platform is greater than the set reference threshold TT1, the visitor strength is judged as a first-level visitor strength judgment signal; when the visitor strength coefficient of the enterprise network platform is equal to the set reference threshold TT1, the visitor strength is judged as a second-level visitor strength judgment signal; when the visitor strength coefficient of the enterprise network platform is less than the set reference threshold TT1, the visitor strength is judged as a third-level visitor strength judgment signal.

[0025] Furthermore, the specific operation steps of the behavior determination analysis and processing, the primary feedback signal, the visitor determination secondary feedback signal, the visitor determination tertiary feedback signal and the visitor determination tertiary feedback signal are as follows:

[0026] With time as the horizontal axis of the two-dimensional coordinate system and the duration of each visit as the vertical axis, the duration of each visit is marked in the coordinate system, and each marked coordinate point is connected with a smooth curve to form the visitor's visit trajectory curve; a tangent is drawn at the location of the visit point, and the slope of the tangent is calculated, which is recorded as Qr, where r = 1, 2, 3...R, R is a positive integer, R represents the total number of single visits, and r is the number of any single visit;

[0027] Sort the single access durations according to the corresponding access time, calculate the time difference between the access times corresponding to two adjacent access durations to obtain the access interval, and record it as The access times corresponding to the access intervals are numbered in sequence, with the numbers as the horizontal coordinates and the access intervals as the vertical coordinates of the two-dimensional coordinate system. Each interval point is connected in sequence to obtain a line graph of the access interval changes. A tangent line is drawn at the position of the interval point, and the slope of the tangent line is calculated and recorded as The slope of the line segment formed by two adjacent interval points is recorded as the interval slope

[0028] According to the set formula The visitor behavior evaluation coefficient of the enterprise network platform is obtained, e11, e12, and e13 are the set weight factor coefficients, and Q′, G′, and J′ represent the set visitor access trajectory tangent reference slope, access interval trajectory tangent reference slope, and access reference time interval of the visitor of the enterprise network platform, respectively;

[0029] A visitor behavior evaluation reference threshold TT2 of the enterprise network platform is set, and a visitor behavior evaluation coefficient of the enterprise network platform is compared and analyzed with the set visitor behavior evaluation reference threshold TT1;

[0030] When the visitor behavior evaluation coefficient of the enterprise network platform is greater than the set reference threshold TT2, the visitor behavior evaluation is determined as a first-level visitor behavior determination signal; when the visitor behavior evaluation coefficient of the enterprise network platform is equal to the set reference threshold TT2, the visitor behavior evaluation is determined as a second-level visitor behavior determination signal; when the visitor behavior evaluation coefficient of the enterprise network platform is less than the set reference threshold TT2, the visitor behavior evaluation is determined as a third-level visitor behavior determination signal;

[0031] A set M is established based on visitor strength determination signals, the first-level visitor strength determination signal is determined as element a1, the second-level visitor strength determination signal is determined as element a2, the third-level visitor strength determination signal is determined as element a3, and element a1∈set M, element a2∈set M, element a3∈set M;

[0032] A set N is established according to the visitor behavior determination signal, the first-level visitor behavior determination signal is determined as element c1, the second-level visitor behavior determination signal is determined as element c2, the third-level visitor behavior determination signal is determined as element c3, and element c1∈set N, element c2∈set N, element c3∈set N;

[0033] The sets M and N are processed as a union. When M∪N={a1,c1}, a visitor-judged first-level feedback signal is generated;

[0034] When M∪N={a1, c2} or {a1, c3} or {a2, c1} or {a2, c2} or {a3, c1}, a visitor-judgment secondary feedback signal is generated;

[0035] When M∪N={a2,c3} or {a3,c2}, a visitor-judged level 3 feedback signal is generated;

[0036] When M∪N={a3,c3}, the visitor's judgment level 4 feedback signal is generated;

[0037] The generated visitor determination level 1 feedback signal, visitor determination level 2 feedback signal, visitor determination level 3 feedback signal and visitor determination level 4 feedback signal are sent to the information matching analysis module.

[0038] Furthermore, the specific operation steps of the two-way matching analysis and processing are as follows:

[0039] Obtain visitor judgment feedback signals in real time, and select evaluation file data sets that are suitable for the visitor judgment feedback signals according to the visitor judgment feedback signals;

[0040] If the visitor determines a first-level feedback signal for the visitor, the visitor obtains the permission corresponding to the selected first-level evaluation file data set and is allowed to access the data of the first-level evaluation file data set; if the visitor determines a second-level feedback signal for the visitor, the visitor obtains the permission corresponding to the selected second-level evaluation file data set and is allowed to access the data of the second-level evaluation file data set; if the visitor determines a third-level feedback signal for the visitor, the visitor obtains the permission corresponding to the selected third-level evaluation file data set and is allowed to access the data of the third-level evaluation file data set; if the visitor determines a fourth-level feedback signal for the visitor, the access permission is revoked for the corresponding selected visitor.

[0041] Furthermore, the specific steps for early warning and alarm of abnormal access behavior are as follows:

[0042] Obtain the access frequency value and the number of IP addresses in the monitoring time period for determining the second-level and third-level feedback signal visitors, and obtain the access anomaly index in each monitoring time period for determining the second-level and third-level feedback signal visitors;

[0043] It warns and alarms the abnormal visit behaviors of visitors who have received the second-level and third-level feedback signals, and analyzes them as follows:

[0044] When it is determined that the abnormal index of each monitoring time period of the visitor with the second-level or third-level feedback signal is greater than or equal to the set visitor's access abnormal index threshold, the behavior is evaluated as abnormal access behavior and corresponding early warning and alarm are executed;

[0045] For visitors who are judged to have abnormal access behavior with a second-level feedback signal, the system will pop up a warning window when they log in, and downgrade the visitor's operation, allowing them to access the corresponding third-level assessment file data set; for visitors who are judged to have abnormal access behavior with a third-level feedback signal, the system will decide to cancel the visitor's access rights.

[0046] Compared with the prior art, the present invention has the following beneficial effects:

[0047] 1. The present invention can improve the accuracy of security management of the enterprise network platform to a certain extent by obtaining the important value, confidentiality value and economic value of file data in the enterprise network platform, the operating time, total number of employees and annual operating net profit margin value of visitors to the enterprise network platform, the tangent of the visitor's access trajectory curve and the access time interval, and comprehensively considers various situations of file data and visitor's actual behavior, thereby reducing the burden of enterprise network system management to a great extent.

[0048] 2. The present invention can cancel the access rights of visitors with poor strength and poor behavior evaluation through two-way matching analysis and processing of visitor judgment feedback signals and evaluation file data sets, and grant different access rights to visitors of different levels, thereby further improving the stability of enterprise network platform security management.

[0049] 3. The present invention can conduct targeted behavior analysis by monitoring the behavior of secondary and tertiary feedback signal visitors. If abnormal behavior is determined, corresponding early warning and alarm can be executed in time, thereby protecting the normal operation of the enterprise network platform. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. The following drawings are not intentionally scaled to the actual size, and the focus is on illustrating the main purpose of the present invention.

[0051] Figure 1 It is a system block diagram of the present invention. DETAILED DESCRIPTION

[0052] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work also fall within the scope of protection of the present invention.

[0053] like Figure 1 As shown, the network security management system based on network information technology includes a data acquisition module, a file data analysis module, a visitor analysis module, an information matching analysis module, a monitoring and early warning module, an execution terminal and a database.

[0054] The data collection module is used to collect the file data value assessment parameters, visitor information parameters, visitor behavior parameters and visitor access monitoring parameters in the enterprise network platform, and send them to the file data analysis module, visitor analysis module and monitoring and early warning module. The file data value assessment parameters in the enterprise network platform include the department to which each enterprise file data belongs, the number of signatures of important enterprise leaders in each enterprise file data, whether each enterprise file data contains confidentiality marks, whether the enterprise file data contains digital amounts and sizes, and the economic level of each enterprise file data; visitor information parameters include the visitor's annual operating net profit, annual operating revenue, visitor operation time and total number of employees; visitor behavior parameters include data on the observation of the visitor's behavior of entering the network system for a certain period of time; visitor access monitoring parameters include the visit frequency value and IP address number of the visitor monitoring time period for determining the secondary and tertiary feedback signals.

[0055] When the file data analysis module receives the file data value assessment parameters in the enterprise network platform and performs judgment and analysis on the enterprise file data, the specific analysis is as follows:

[0056] Identify the departments to which each enterprise file data belongs, obtain the departments to which the enterprise file data belongs, divide the enterprise departments into R&D department, finance department, legal department, marketing department, production department, administrative department and other departments, and assign corresponding scores of 10, 9, 8, 7, 6, 5 and 4 respectively, and obtain the department scores corresponding to the enterprise file data, recorded as Gb i , i is the number of each file data of the enterprise, and i is a positive integer; identify the number of signatures of important leaders of the enterprise in each file data of the enterprise. Important leaders of the enterprise refer to the deputy general manager, general manager and chairman of the enterprise. When the number is 0, 0-3, 3-5 and more than 5, the corresponding scores are 0, 3, 6 and 10 respectively. The signature number score of the important leaders corresponding to each file data of the enterprise is obtained, which is recorded as Lq i ; According to the formula Wz i =e1×Gb i +e2×Lq ii , get the importance value of enterprise file data, e1 and e2 are the set weight factor coefficients;

[0057] Identify whether each enterprise file data contains confidentiality marks. If there is a confidentiality mark, it is scored as 10 points, and if there is no confidentiality mark, it is scored as 0 points. The corresponding confidentiality mark score of each enterprise file data is obtained, which is recorded as Jb i ; Identify whether the file data of each enterprise contains digital amounts. If there are digital amounts, identify the corresponding digital amounts. Set no digital amounts, digital amounts between 0-10 million yuan (excluding 0 yuan), digital amounts between 10-50 million yuan, and digital amounts above 50 million yuan, with corresponding scores of 0, 3, 6, and 10, respectively, recorded as Sj i ; According to the set formula Wm i =e3×Jb i +e4×Sj i , get the confidentiality value of each enterprise file data, e3 and e4 are the set weight factor coefficients;

[0058] Match the enterprise's various file data with the set file data economic level to obtain the enterprise's various file data economic levels. The specific economic levels are important, general, and unimportant, and the corresponding scores are 10 points, 5 points, and 0 points (the value is a custom value). Match the scores corresponding to the economic levels of the enterprise's various file data, marked as Wj i ;

[0059] According to the set formula The value assessment coefficient of the enterprise file data is obtained. e5, e6, and e7 are the set weight factor coefficients of the importance value, confidentiality value, and economic value of the enterprise file data. The weight factor coefficient is used to balance the weight of each data in the formula calculation, thereby promoting the accuracy of the calculation result. From the formula, we know that the higher the importance value, confidentiality value, and economic value of the file data, the higher the assessment coefficient of the file data.

[0060] Set the evaluation coefficient reference intervals M1, M2, and M3 for enterprise file data, and substitute the evaluation coefficients of the enterprise file data into the preset gradient reference intervals M1, M2, and M3 for comparative analysis, wherein the interval values ​​of M1, M2, and M3 decrease in a gradient manner.

[0061] When the evaluation coefficient of the enterprise file data is in the gradient reference interval M1, the corresponding file data is classified into the first-level evaluation file data set A1; when the evaluation coefficient of the enterprise file data is in the gradient reference interval M2, the corresponding file data is classified into the second-level evaluation file data set A2; when the evaluation coefficient of the enterprise file data is in the gradient reference interval M3, the corresponding file data is classified into the third-level evaluation file data set A3.

[0062] The first-level evaluation file data set A1, the second-level evaluation file data set A2 and the third-level evaluation file data set A3 are sent to the information matching analysis module.

[0063] The visitor analysis module is used to receive visitor information parameters and analyze and process visitor qualifications. The specific analysis is as follows:

[0064] Get the annual operating net profit and annual operating income of each visitor, recorded as Nj respectively n and Ns n , according to the formula Get the annual operating net profit margin value of each visitor, where n is the visitor ID of the enterprise platform and n is a positive integer;

[0065] Get the visitor operation time and total number of employees of the enterprise network platform and mark it as Fy n and Fx n , according to the set formula The visitor strength coefficient of the enterprise network platform is obtained, Fy′, Fx′, and Fj′ respectively represent the reference operating time, reference total number of employees, and reference annual operating net profit margin of the visitors of the set enterprise network platform, ΔFy, ΔFx, and ΔFj respectively represent the reference operating time difference, reference total number of employees, and reference annual operating net profit margin difference of the visitors of the set network security management system, and e8, e9, and e10 are the set weight factor coefficients. The weight factor coefficients are used to balance the weights of various data in the formula calculation, thereby promoting the accuracy of the calculation results.

[0066] It should be noted that the visitor operating time of the enterprise network platform is a statistical value of the visitor operating time, and the total number of visitor employees of the enterprise network platform is a statistical value of the total number of visitor employees.

[0067] A visitor strength reference threshold TT1 of the enterprise network platform is set, and a visitor strength coefficient of the enterprise network platform is compared and analyzed with the set visitor strength reference threshold TT1;

[0068] When the visitor strength coefficient of the enterprise network platform is greater than the set reference threshold TT1, the visitor strength is judged as a first-level visitor strength judgment signal; when the visitor strength coefficient of the enterprise network platform is equal to the set reference threshold TT1, the visitor strength is judged as a second-level visitor strength judgment signal; when the visitor strength coefficient of the enterprise network platform is less than the set reference threshold TT1, the visitor strength is judged as a third-level visitor strength judgment signal.

[0069] Receive the visitor behavior parameters obtained by observing the visitor's behavior of entering the network system for a certain period of time, and perform visitor behavior determination and analysis. The specific analysis is as follows:

[0070] With time as the horizontal axis of the two-dimensional coordinate system and the duration of each visit as the vertical axis, the duration of each visit is marked in the coordinate system, and each marked coordinate point is connected with a smooth curve to form the visitor's visit trajectory curve; a tangent is drawn at the location of the visit point, and the slope of the tangent is calculated, which is recorded as Qr, where r = 1, 2, 3...R, R is a positive integer, R represents the total number of single visits, and r is the number of any single visit;

[0071] Sort the single access durations according to the corresponding access time, calculate the time difference between the access times corresponding to two adjacent access durations to obtain the access interval, and record it as The access times corresponding to the access intervals are numbered in sequence, with the numbers as the horizontal coordinates and the access intervals as the vertical coordinates of the two-dimensional coordinate system. Each interval point is connected in sequence to obtain a line graph of the access interval changes. A tangent line is drawn at the position of the interval point, and the slope of the tangent line is calculated and recorded as The slope of the line segment formed by two adjacent interval points is recorded as the interval slope

[0072] According to the set formula The visitor behavior evaluation coefficient of the enterprise network platform is obtained, e11, e12, and e13 are the set weight factor coefficients, Q′, G′, and J′ respectively represent the set visitor access trajectory tangent reference slope, access interval trajectory tangent reference slope, and access reference time interval of the enterprise network platform. It can be seen from the formula that the smaller the access trajectory tangent reference slope, the smaller the access interval trajectory tangent reference slope, and the closer the access time interval is to the reference time interval, the larger the visitor behavior evaluation coefficient is.

[0073] A visitor behavior evaluation reference threshold TT2 of the enterprise network platform is set, and a visitor behavior evaluation coefficient of the enterprise network platform is compared and analyzed with the set visitor behavior evaluation reference threshold TT1;

[0074] When the visitor behavior evaluation coefficient of the enterprise network platform is greater than the set reference threshold TT2, the visitor behavior evaluation is determined as a first-level visitor behavior determination signal; when the visitor behavior evaluation coefficient of the enterprise network platform is equal to the set reference threshold TT2, the visitor behavior evaluation is determined as a second-level visitor behavior determination signal; when the visitor behavior evaluation coefficient of the enterprise network platform is less than the set reference threshold TT2, the visitor behavior is determined as a third-level visitor behavior determination signal.

[0075] A set M is established based on the visitor strength determination signal, the first-level visitor strength determination signal is determined as element a1, the second-level visitor strength determination signal is determined as element a2, and the third-level visitor strength determination signal is determined as element a3, and element a1∈set M, element a2∈set M, and element a3∈set M.

[0076] A set N is established based on the visitor behavior determination signal, the first-level visitor behavior determination signal is determined as element c1, the second-level visitor behavior determination signal is determined as element c2, and the third-level visitor behavior determination signal is determined as element c3, and element c1∈set N, element c2∈set N, and element c3∈set N.

[0077] The sets M and N are processed as a union. When M∪N={a1,c1}, a visitor-judged first-level feedback signal is generated;

[0078] When M∪N={a1, c2} or {a1, c3} or {a2, c1} or {a2, c2} or {a3, c1}, a visitor-judgment secondary feedback signal is generated;

[0079] When M∪N={a2,c3} or {a3,c2}, a visitor-judged level 3 feedback signal is generated;

[0080] When M∪N={a3,c3}, the visitor's judgment level 4 feedback signal is generated;

[0081] The generated visitor determination level 1 feedback signal, visitor determination level 2 feedback signal, visitor determination level 3 feedback signal and visitor determination level 4 feedback signal are sent to the information matching analysis module.

[0082] The information matching analysis module is used to receive the evaluation file data set and the visitor's judgment feedback signal, and perform two-way matching analysis and processing accordingly. The specific operation process is as follows:

[0083] Obtain visitor judgment feedback signals in real time, and select evaluation file data sets that are suitable for the visitor judgment feedback signals according to the visitor judgment feedback signals;

[0084] If the visitor determines a first-level feedback signal for the visitor, the visitor obtains the permission corresponding to the selected first-level evaluation file data set and is allowed to access the data of the first-level evaluation file data set; if the visitor determines a second-level feedback signal for the visitor, the visitor obtains the permission corresponding to the selected second-level evaluation file data set and is allowed to access the data of the second-level evaluation file data set; if the visitor determines a third-level feedback signal for the visitor, the visitor obtains the permission corresponding to the selected third-level evaluation file data set and is allowed to access the data of the third-level evaluation file data set; if the visitor determines a fourth-level feedback signal for the visitor, the access permission is revoked for the corresponding selected visitor.

[0085] The monitoring and early warning module is used to receive visitor access monitoring parameters for determining the secondary and tertiary feedback signals, and to perform analysis and processing. The specific analysis is as follows:

[0086] Obtain the visit frequency value and IP address number of the visitor monitoring period for determining the secondary and tertiary feedback signals, recorded as Fp m and Fs m , m is the number of the monitoring time period for determining the second-level and third-level feedback signal visitors, and m is a positive integer, according to the following formula

[0087]

[0088] The access anomaly index for each monitoring time period of the visitors who determine the secondary and tertiary feedback signals is calculated. e14, e15, e16 and e17 are respectively represented as the set influencing factors, Fp′ and Fs′ are respectively the set reference visitor access frequency value and IP address number, and d is represented as a natural constant.

[0089] It should be noted that the visit frequency value of the visitor monitoring time period is the statistical value of the number of visits during the monitoring time period; the number of IP addresses of the visitor monitoring time period is the statistical value of the number of IP addresses used during the monitoring time period;

[0090] It warns and alarms the abnormal visit behaviors of visitors who have received the second-level and third-level feedback signals, and analyzes them as follows:

[0091] When it is determined that the abnormal index of each monitoring time period of the visitor with the second-level or third-level feedback signal is greater than or equal to the set visitor's access abnormal index threshold, the behavior is evaluated as abnormal access behavior and corresponding early warning and alarm are executed;

[0092] The evaluation behavior is abnormal access behavior and corresponding early warning and alarm are executed. Specifically, when a visitor with a second-level feedback signal is judged to have abnormal access behavior, the system will pop up a warning window when the visitor logs in, and downgrade the operation to the visitor, and readjust it to allow access to the corresponding third-level evaluation file data set; when a visitor with a third-level feedback signal is judged to have abnormal access behavior, the system will decide to cancel the visitor's access rights.

[0093] When it is determined that the abnormal index of each monitoring time period of the second-level and third-level feedback signal visitors is less than the set visit abnormal index threshold of the visitor, no other operation is performed.

[0094] The execution terminal performs processing operations based on the abnormal access index of the visitor in each monitoring time period of the second-level and third-level feedback signal visitor and the two-way matching analysis of the received evaluation file data set and the visitor's judgment feedback.

[0095] The database stores the visitor reference operation time difference, reference reputation value difference, reference data completeness value difference and reference operating financial value difference of the set network security management system, visitor behavior evaluation reference threshold and visitor access anomaly index, etc.

[0096] The above is an explanation of the present invention and should not be considered as a limitation thereof. Although several exemplary embodiments of the present invention have been described, it will be readily appreciated by those skilled in the art that many modifications may be made to the exemplary embodiments without departing from the novel teachings and advantages of the present invention. Therefore, all such modifications are intended to be included within the scope of the present invention as defined in the claims. It should be understood that the above is an explanation of the present invention and should not be considered as being limited to the specific embodiments disclosed, and modifications to the disclosed embodiments and other embodiments are intended to be included within the scope of the appended claims. The present invention is defined by the claims and their equivalents.

Claims

1. A network security management system based on network information technology, including a data acquisition module, an execution terminal and a database, characterized in that: Also includes: The file data analysis module is used to receive the file data value assessment parameters in the enterprise network platform, and perform enterprise file data determination analysis and processing to obtain the first-level assessment file data set A1, the second-level assessment file data set A2 and the third-level assessment file data set A3, and send them to the information matching analysis module; The specific analysis method of the enterprise file data determination and analysis process is as follows: Identify the departments to which each enterprise file data belongs, obtain the department to which the enterprise file data belongs, divide the enterprise departments into R&D department, finance department, legal department, marketing department, production department, administrative department and other departments, and assign corresponding scores of 10, 9, 8, 7, 6, 5 and 4 respectively, thus obtaining the department score corresponding to the enterprise file data, recorded as Gb i , i is the number of each file data of the enterprise; Identify the number of signatures of important leaders in each enterprise file data. Important leaders of enterprises include deputy general managers, general managers, and chairman of the board. When the number is 0, 0-3, 3-5, and more than 5, the corresponding scores are 0, 3, 6, and 10, respectively. The signature number score of important leaders corresponding to each enterprise file data is obtained, recorded as Lq i ; According to the formula Wz i =e1×Gb i +e2×Lq i , get the importance value of enterprise file data, e1 and e2 are the set weight factor coefficients; Identify whether each enterprise file data contains confidentiality marks. If there is a confidentiality mark, it is scored as 10 points, and if there is no confidentiality mark, it is scored as 0 points. The corresponding confidentiality mark score of each enterprise file data is obtained, which is recorded as Jb i ; Identify whether the data in each enterprise file contains digital amounts. If so, identify the corresponding digital amounts. Set no digital amounts, digital amounts between 0 and 10 million yuan, digital amounts between 10 million and 50 million yuan, and digital amounts above 50 million yuan, with corresponding scores of 0, 3, 6, and 10, respectively, recorded as Sj i ; According to the set formula Wm i =e3×Jb i +e4×Sj i Get the confidentiality value of each enterprise file data, e3 and e4 are the set weight factor coefficients; Match the enterprise's various file data with the set file data economic level to obtain the economic level of the enterprise's various file data. The specific economic levels are important, general and unimportant, and the corresponding scores are 10 points, 5 points and 0 points. The scores corresponding to the economic levels of the enterprise's various file data are matched and marked as Wj i ; According to the set formula The value assessment coefficient of the enterprise document data is obtained, where e5, e6, and e7 are the set weight factor coefficients for the importance value, confidentiality value, and economic value of the enterprise document data; Set the evaluation coefficient reference intervals M1, M2, and M3 for enterprise file data, and substitute the evaluation coefficients of the enterprise file data into the preset gradient reference intervals M1, M2, and M3 for comparative analysis, wherein the interval values ​​of M1, M2, and M3 decrease in a gradient manner; When the evaluation coefficient of the enterprise file data is in the gradient reference interval M1, the corresponding file data is classified into the first-level evaluation file data set A1; when the evaluation coefficient of the enterprise file data is in the gradient reference interval M2, the corresponding file data is classified into the second-level evaluation file data set A2; when the evaluation coefficient of the enterprise file data is in the gradient reference interval M3, the corresponding file data is classified into the third-level evaluation file data set A3; The visitor analysis module is used to receive visitor information parameters and process and analyze them, and to perform visitor qualification determination and analysis, receive visitor behavior parameters obtained by observing the visitor's behavior of entering the network system for a certain period of time, and perform visitor behavior determination and analysis, thereby generating a visitor determination primary feedback signal, a visitor determination secondary feedback signal, a visitor determination third feedback signal, and a visitor determination fourth feedback signal, and send them to the information matching analysis module; The visitor qualification determination and analysis process is specifically performed in the following manner: Obtain the annual operating net profit and annual operating revenue of each visitor, the visitor operation time and total number of employees of the enterprise network platform, and obtain the visitor strength coefficient of the enterprise network platform; A visitor strength reference threshold TT1 of the enterprise network platform is set, and a visitor strength coefficient of the enterprise network platform is compared and analyzed with the set visitor strength reference threshold TT1; When the visitor strength coefficient of the enterprise network platform is greater than the set reference threshold TT1, the visitor strength is determined as a first-level visitor strength determination signal; when the visitor strength coefficient of the enterprise network platform is equal to the set reference threshold TT1, the visitor strength is determined as a second-level visitor strength determination signal; when the visitor strength coefficient of the enterprise network platform is less than the set reference threshold TT1, the visitor strength is determined as a third-level visitor strength determination signal; An information matching analysis module is used to receive the evaluation file data set and the visitor's judgment feedback signal, and perform two-way matching analysis and processing accordingly, and match the visitor to the corresponding evaluation file data set; The monitoring and early warning module is used to receive the visitor access monitoring parameters for determining the secondary and tertiary feedback signals, analyze and process them to obtain abnormal access behaviors, and issue early warnings and alarms.

2. The network security management system based on network information technology according to claim 1 is characterized in that: The visitor behavior determination analysis and processing, the visitor determination primary feedback signal, the visitor determination secondary feedback signal, the visitor determination third level feedback signal and the visitor determination fourth level feedback signal, the specific analysis method is: With time as the horizontal axis of the two-dimensional coordinate system and the duration of each visit as the vertical axis, the duration of each visit is marked in the coordinate system, and each marked coordinate point is connected with a smooth curve to form the visitor's visit trajectory curve; a tangent is drawn at the location of the visit point, and the slope of the tangent is calculated, which is recorded as Qr, where r = 1, 2, 3...R, R represents the total number of single visits, and r is the number of any single visit; Sort the single access durations according to the corresponding access time, calculate the time difference between the access times corresponding to two adjacent access durations to obtain the access interval, and record it as The access times corresponding to the access intervals are numbered in sequence, with the numbers as the horizontal coordinates and the access intervals as the vertical coordinates of the two-dimensional coordinate system. Each interval point is connected in sequence to obtain a line graph of the access interval changes. A tangent line is drawn at the position of the interval point, and the slope of the tangent line is calculated and recorded as The slope of the line segment formed by two adjacent interval points is recorded as the interval slope According to the set formula The visitor behavior evaluation coefficient of the enterprise network platform is obtained, e11, e12, and e13 are the set weight factor coefficients, and Q′, G′, and J′ represent the set visitor access trajectory tangent reference slope, access interval trajectory tangent reference slope, and access reference time interval of the visitor of the enterprise network platform, respectively; A visitor behavior evaluation reference threshold TT2 of the enterprise network platform is set, and a visitor behavior evaluation coefficient of the enterprise network platform is compared and analyzed with the set visitor behavior evaluation reference threshold TT1; When the visitor behavior evaluation coefficient of the enterprise network platform is greater than the set reference threshold TT2, the visitor behavior evaluation is determined as a first-level visitor behavior determination signal; when the visitor behavior evaluation coefficient of the enterprise network platform is equal to the set reference threshold TT2, the visitor behavior evaluation is determined as a second-level visitor behavior determination signal; when the visitor behavior evaluation coefficient of the enterprise network platform is less than the set reference threshold TT2, the visitor behavior evaluation is determined as a third-level visitor behavior determination signal; A set M is established based on visitor strength determination signals, the first-level visitor strength determination signal is determined as element a1, the second-level visitor strength determination signal is determined as element a2, the third-level visitor strength determination signal is determined as element a3, and element a1∈set M, element a2∈set M, element a3∈set M; A set N is established according to the visitor behavior determination signal, the first-level visitor behavior determination signal is determined as element c1, the second-level visitor behavior determination signal is determined as element c2, the third-level visitor behavior determination signal is determined as element c3, and element c1∈set N, element c2∈set N, element c3∈set N; The sets M and N are processed as a union. When M∪N={a1,c1}, a visitor-judged first-level feedback signal is generated; When M∪N={a1, c2} or {a1, c3} or {a2, c1} or {a2, c2} or {a3, c1}, a visitor-judgment secondary feedback signal is generated; When M∪N={a2,c3} or {a3,c2}, a visitor-judged level 3 feedback signal is generated; When M∪N={a3,c3}, the visitor's judgment level 4 feedback signal is generated; The generated visitor determination level 1 feedback signal, visitor determination level 2 feedback signal, visitor determination level 3 feedback signal and visitor determination level 4 feedback signal are sent to the information matching analysis module.

3. The network security management system based on network information technology according to claim 1 is characterized in that: The specific analysis method of the two-way matching analysis process is as follows: Obtain visitor judgment feedback signals in real time, and select evaluation file data sets that are suitable for the visitor judgment feedback signals according to the visitor judgment feedback signals; If the visitor determines a first-level feedback signal for the visitor, the visitor obtains the permission corresponding to the selected first-level evaluation file data set and is allowed to access the data of the first-level evaluation file data set; if the visitor determines a second-level feedback signal for the visitor, the visitor obtains the permission corresponding to the selected second-level evaluation file data set and is allowed to access the data of the second-level evaluation file data set; if the visitor determines a third-level feedback signal for the visitor, the visitor obtains the permission corresponding to the selected third-level evaluation file data set and is allowed to access the data of the third-level evaluation file data set; if the visitor determines a fourth-level feedback signal for the visitor, the access permission is revoked for the corresponding selected visitor.

4. The network security management system based on network information technology according to claim 1 is characterized in that: The abnormal access behavior is warned and alarmed, and the specific analysis method is as follows: Obtain the access frequency value and the number of IP addresses in the monitoring time period for determining the second-level and third-level feedback signal visitors, and obtain the access anomaly index in each monitoring time period for determining the second-level and third-level feedback signal visitors; It warns and alarms the abnormal visit behaviors of visitors who have received the second-level and third-level feedback signals, and analyzes them as follows: When it is determined that the abnormal index of each monitoring time period of the visitor with the second-level or third-level feedback signal is greater than or equal to the set visitor's access abnormal index threshold, the behavior is evaluated as abnormal access behavior and corresponding early warning and alarm are executed; For visitors who are judged to have abnormal access behavior with a second-level feedback signal, the system will pop up a warning window when they log in, and downgrade the visitor's operation, allowing them to access the corresponding third-level assessment file data set; for visitors who are judged to have abnormal access behavior with a third-level feedback signal, the system will decide to cancel the visitor's access rights.

Images