A comprehensive evaluation system for network security protection based on big data
By designing a comprehensive network security protection evaluation system based on big data, the problem of difficult to understand database network attacks in the existing technology is solved, and the comprehensive network protection and security monitoring of the database is realized, ensuring the security and integrity of the data .
Patent Information
- Application Number
- CN202411388725.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-08
- Publication Date
- 2024-12-27
- Estimated Expiration
- 2044-10-08
AI Technical Summary
The prior art is difficult to effectively understand the network attack situation of databases, making it difficult to conduct database security protection assessments, affecting the security and integrity of the data.
A comprehensive network security protection evaluation system based on big data was designed. By laying out security protective covers, acquiring port information, setting up isolation space and obfuscated data, collecting status information in real time, calculating security protection evaluation index, and realizing a comprehensive network of the database. Protection and security monitoring.
It can effectively monitor the network attack situation of the database, ensure the security of the database, and understand the protection situation through the security protection evaluation index, providing data security and integrity guarantees.
Smart Images
Figure CN118940260B_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of network security technology, and in particular to a network security protection comprehensive evaluation system based on big data. Background Art
[0002] With the rapid development of big data and cloud computing technologies, the amount of data in enterprises and organizations has exploded; as a core component of data storage and management, the security and stability of databases are directly related to the operation and development of enterprises and organizations. Therefore, conducting security assessments on databases to ensure the security and integrity of data has become an important issue that society must face in the era of big data and cloud computing. At present, the database itself has security protection, but there are still security issues with the database and it is difficult to understand the data situation of network attacks on the database, and thus it is difficult to conduct security assessments on the database. Summary of the invention
[0003] The purpose of the present invention is to provide a network security protection comprehensive evaluation system based on big data to address the deficiencies in the background technology.
[0004] In order to achieve the above object, the present invention provides the following technical solution: a network security protection comprehensive evaluation system based on big data, comprising:
[0005] A deployment module is used to obtain port information of a database, wherein the port information includes an output port and an input port of the database, and deploy a safety shield based on the database and the port information;
[0006] An acquisition module, connected to the deployment module, for acquiring status information of the safety shield, wherein the status information of the safety shield includes attack information of the isolated space and the corresponding level;
[0007] The evaluation module is connected to the acquisition module and is used to obtain the safety protection evaluation index according to the status information of the safety protection cover.
[0008] In a preferred embodiment, the layout module includes:
[0009] A port acquisition unit, used to acquire an output port and an input port from a database as port information, respectively set corresponding network points corresponding to the output port and the input port, and connect the network points between the output port and the input port;
[0010] A selection unit is used to select a plurality of random station points on the database, and connect the random station points with the network station points to obtain a basic connection network;
[0011] The management unit is used to copy the basic connection network to obtain the outer connection network, set up an isolation space between the basic connection network and the outer connection network, and use the basic connection network, the outer connection network and the isolation space as a safety shield.
[0012] In a preferred embodiment, the selection unit includes:
[0013] A configuration unit, used for randomly configuring a plurality of ports on a database, and marking the plurality of ports as random station points;
[0014] An establishing unit is used to establish one-to-one channels between multiple random stations and network stations to connect them and form a connection network;
[0015] The connection unit is used to set a plurality of nodes on the channels between the plurality of random stations and the network stations, and the plurality of nodes are connected to each other to obtain a basic connection network.
[0016] In a preferred embodiment, the management unit includes:
[0017] A replication unit, used to replicate the basic connection network with the same structure as the outer connection network, correspond the random station points and the network station points on the outer connection network to a cloud server respectively, and connect the corresponding cloud servers according to the connection relationship between the random station points and the network station points on the outer connection network;
[0018] An amplification unit, used for amplifying the random station points and the network station points on the outer connection network at equal distances, and placing the outer connection network amplified at equal distances outside the database and the basic connection network;
[0019] The security unit is used to use the space between the basic connection network and the outer connection network as an isolation space, and use the basic connection network, the outer connection network and the isolation space as a safety shield.
[0020] In a preferred embodiment, the security unit comprises:
[0021] A filling unit, used to fill the obfuscated data in the space between the basic connection network and the outer connection network;
[0022] A corresponding unit, used to establish mapping lines between a plurality of random station points and network station points in the basic connection network and corresponding plurality of random station points and network station points in the outer connection network and connect them;
[0023] A determination unit, configured to obtain position information between the obfuscated data and the mapping line, wherein the position information includes the position of the obfuscated data between the surrounding mapping lines;
[0024] The network protection unit is used to use the basic connection network, the outer connection network and the isolation space as a safety shield.
[0025] In a preferred embodiment, the acquisition module includes:
[0026] A level division unit, used for classifying the database according to the storage location to obtain a database level, and marking the isolation space in the safety protection cover at the corresponding location with the level corresponding to the database level;
[0027] An information acquisition unit, used to acquire status information of the safety protection cover, wherein the status information includes attack information of the isolated space and the corresponding level;
[0028] The storage unit is used to accumulate and store the status information.
[0029] In a preferred embodiment, the information acquisition unit includes:
[0030] A real-time acquisition unit, used for acquiring difference information of obfuscated data in real time, wherein the difference information includes the amount of change of obfuscated data and the change information of the data storage position between the obfuscated data and the mapping line;
[0031] A judgment unit, used to take the difference information exceeding the preset condition as the attacked information of the isolated space, obtain the position corresponding to the attacked information in the isolated space and obtain the corresponding level;
[0032] The comprehensive unit is used to use the attack information of the isolated space and the corresponding level as status information.
[0033] In a preferred embodiment, the evaluation module comprises:
[0034] The evaluation unit is used to calculate the safety protection evaluation index according to the status information of the safety protection cover.
[0035] In the above technical solution, the technical effects and advantages provided by the present invention are:
[0036] After setting up the isolation space and the obfuscated data therein, the present invention uses the basic connection network, the outer connection network and the isolation space as a security shield. The security shield can provide a comprehensive network protection for the database. In the subsequent use process, the situation of the database being attacked by the network can be obtained while also ensuring the security of the database. The protection situation of the database can be understood based on the network attack situation of the security shield. BRIEF DESCRIPTION OF THE DRAWINGS
[0037] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.
[0038] Figure 1 It is a system block diagram of the present invention. DETAILED DESCRIPTION
[0039] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.
[0040] Example 1, please refer to Figure 1 As shown, the network security protection comprehensive evaluation system based on big data described in this embodiment includes:
[0041] A deployment module is used to obtain port information of a database, wherein the port information includes an output port and an input port of the database, and deploy a safety shield based on the database and the port information;
[0042] An acquisition module, connected to the deployment module, for acquiring status information of the safety shield, wherein the status information of the safety shield includes attack information of the isolated space and the corresponding level;
[0043] An evaluation module, connected to the acquisition module, for obtaining a safety protection evaluation index according to the status information of the safety protection cover;
[0044] It should be noted that with the rapid development of big data and cloud computing technologies, the amount of data in enterprises and organizations has exploded; as a core component of data storage and management, the security and stability of databases are directly related to the operation and development of enterprises and organizations. Therefore, conducting security assessments on databases to ensure the security and integrity of data has become an important issue that society must face in the era of big data and cloud computing. At present, the database itself has security protection, but there are still security issues with the database and it is difficult to understand the data situation of network attacks on the database, and thus it is difficult to conduct security assessments on the database. In this application, after setting up the isolation space and the obfuscated data therein, the basic connection network, the outer connection network and the isolation space are used as a security shield. The security shield can provide a comprehensive network protection for the database, and in the subsequent use process, it can obtain the situation of the database being attacked by the network while also ensuring the security of the database;
[0045] In one embodiment, the deployment module includes:
[0046] A port acquisition unit, used to acquire an output port and an input port from a database as port information, respectively set corresponding network points corresponding to the output port and the input port, and connect the network points between the output port and the input port;
[0047] A selection unit is used to select a plurality of random station points on the database, and connect the random station points with the network station points to obtain a basic connection network;
[0048] A management unit, used for duplicating the basic connection network to obtain an outer connection network, setting an isolation space between the basic connection network and the outer connection network, and using the basic connection network, the outer connection network and the isolation space as a safety shield;
[0049] It should be noted that the output port and input port of the database are usually closely related to network communication. In order to ensure the security of the database, the determination and security configuration of the port are indispensable. The output port and input port are used as setting positions, and the corresponding network station is configured at the setting position. The network station is bound to the corresponding output port and input port. There are multiple network stations. Then the network station between the output port and the input port is connected. The connection here is a communication connection. The output port and input port in the database can be marked through the network station, which is convenient for subsequent security protection analysis to evaluate the network security protection capability. In order to better protect the database security, Comprehensive, select multiple random station points on the database, through the combination of random station points and network station points, the database can be better protected, the random station points are connected to the network station points to obtain a basic connection network, the basic connection network is a network layer that fits the database and is formed by connecting multiple random station points and network station points, the basic connection network is copied as the outer connection network, after the outer connection network is moved outward, there will be an isolation space between the basic connection network and the outer connection network, and then the set basic connection network, outer connection network and isolation space are used as a safety shield, through which the database can be protected and sensed, and the network security of the database can be obtained;
[0050] In one embodiment, the selection unit includes:
[0051] A configuration unit, used for randomly configuring a plurality of ports on a database, and marking the plurality of ports as random station points;
[0052] An establishing unit is used to establish one-to-one channels between multiple random stations and network stations to connect them and form a connection network;
[0053] A connection unit, used for setting a plurality of nodes on the channels between the plurality of random resident points and the network resident points, and connecting the plurality of nodes to each other to obtain a basic connection network;
[0054] It should be noted that the database is an important means of storing information. In order to evaluate the security protection of the database, it is necessary to layout the security protection technology through the port. In this application, multiple ports are randomly configured on the database, and the multiple ports are marked as random resident points. The port here does not participate in the acquisition and input of information in the database. The port is only attached to the database. As a system architecture attached to the database as a basic connection network, the port is then marked as a random resident point. The mark here represents that the port is randomly configured and does not participate in the acquisition and input of data in the database. Then, channels are established one-to-one between multiple random resident points and network resident points to form a connection network. Then, in order to make the connection network tighter, multiple nodes need to be set on the channels between multiple random resident points and network resident points. Multiple nodes are connected to each other to form a tight channel network. The nodes set in the wireless channel usually refer to devices with wireless communication functions, such as wireless routers, wireless access points (APs), wireless sensors, etc.; through the built-in wireless transceiver module, wireless communication with surrounding nodes can be carried out. Each node device needs to be properly configured to ensure that they can correctly access the wireless channel and communicate with other nodes. This includes setting the SSID (service set identifier), channel number, encryption method and other parameters of the wireless network. When the node devices are correctly configured and connected to the wireless channel, a communication link can be established between them. This connection is based on the broadcast and reception of wireless signals. The node devices discover the surrounding nodes by listening to the signals on the wireless channel and establish connections with them. It is used as the basic connection network outside the database, which can better protect the database and has a good security function. At the same time, it can respond to the network attacks received by the database in the future, and can achieve a comprehensive evaluation of the network security protection of a database.
[0055] In one embodiment, the management unit includes:
[0056] A replication unit, used to replicate the basic connection network with the same structure as the outer connection network, correspond the random station points and the network station points on the outer connection network to a cloud server respectively, and connect the corresponding cloud servers according to the connection relationship between the random station points and the network station points on the outer connection network;
[0057] An amplification unit, used for amplifying the random station points and the network station points on the outer connection network at equal distances, and placing the outer connection network amplified at equal distances outside the database and the basic connection network;
[0058] A security unit is used to use the space between the basic connection network and the outer connection network as an isolation space, and use the basic connection network, the outer connection network and the isolation space as a safety shield;
[0059] It should be noted that the basic connection network is replicated with the same structure. The structure here represents the connection relationship between multiple random stations and network stations in the basic connection network, as well as multiple nodes set on the channels between the multiple random stations and network stations, and the connection relationship between the multiple nodes. The same structure is replicated. After the replication, the positions of the random stations and network stations in the outer connection network have no corresponding database attachment. Therefore, it is necessary to correspond to a cloud server for the random stations and network stations on the outer connection network respectively, and connect the corresponding cloud servers according to the connection relationship between the random stations and network stations on the outer connection network. The outer connection network can be used as a network that can communicate and is separated from the database. After that, the random stations and network stations on the outer connection network are equidistantly enlarged, and the equidistantly enlarged outer connection network is placed outside the database and the basic connection network. The purpose here is to enable the outer connection network to wrap the database and the basic connection network. After that, there will be a space between the outer connection network and the basic connection network, and random and unintentional connections are required in the space. Meaningful filling obfuscation data, the obfuscation data is meaningless random data, for example, some meaningless text data or image data, etc., and then in order to better complete the security operation through the isolation space, it is necessary to establish and connect the multiple random station points and network station points in the basic connection network with the corresponding multiple random station points and network station points in the outer connection network. The mapping line here is the network line between the multiple random station points and network station points in the basic connection network and the corresponding multiple random station points and network station points in the outer connection network. The positional relationship between the obfuscated data and the mapping line can be obtained through the direction of the network line. For example, in the isolation space, the image data of the obfuscated data is at a certain storage position of one of the mapping lines, which can be used to determine the stability of the obfuscated data. After setting up the isolation space and the obfuscated data therein, the basic connection network, the outer connection network and the isolation space are used as a safety shield. The safety shield can provide a comprehensive network protection for the database. In the subsequent use process, the situation of the database being attacked by the network can be obtained while also ensuring the security of the database;
[0060] In one embodiment, the security unit comprises:
[0061] A filling unit, used to fill the obfuscated data in the space between the basic connection network and the outer connection network;
[0062] A corresponding unit, used to establish mapping lines between a plurality of random station points and network station points in the basic connection network and corresponding plurality of random station points and network station points in the outer connection network and connect them;
[0063] A determination unit, configured to obtain position information between the obfuscated data and the mapping line, wherein the position information includes the position of the obfuscated data between the surrounding mapping lines;
[0064] The network protection unit is used to use the basic connection network, the outer connection network and the isolation space as a safety shield.
[0065] In one embodiment, the acquisition module includes:
[0066] A level division unit, used for classifying the database according to the storage location to obtain a database level, and marking the isolation space in the safety protection cover at the corresponding location with the level corresponding to the database level;
[0067] An information acquisition unit, used to acquire status information of the safety protection cover, wherein the status information includes attack information of the isolated space and the corresponding level;
[0068] A storage unit, used for accumulating and storing status information;
[0069] In one embodiment, the information acquisition unit includes:
[0070] A real-time acquisition unit, used for acquiring difference information of obfuscated data in real time, wherein the difference information includes the amount of change of obfuscated data and the change information of the data storage position between the obfuscated data and the mapping line;
[0071] A judgment unit, used to take the difference information exceeding the preset condition as the attacked information of the isolated space, obtain the position corresponding to the attacked information in the isolated space and obtain the corresponding level;
[0072] A comprehensive unit, used for taking the attack information of the isolated space and the corresponding level as status information;
[0073] It should be noted that, since the data stored in the database is diverse and the data has different importance, data of different importance is stored in different locations. Then, the data is graded according to its corresponding storage location based on its importance to obtain the database level. Then, the database level and the isolation space in the security shield at the corresponding position are graded. For example, if the corresponding level value on one side of the database is X, then the corresponding position on one side of the isolation space is also X. In order to understand the information of the database being attacked by the network, the status information of the security shield is used to respond here, and the situation of the database being attacked can be directly understood. The database itself is equipped with a corresponding firewall, so the security shield here is to understand the situation of being attacked by the network when the database is protected, and then conduct a comprehensive security evaluation of big data. Estimate, here it is necessary to collect the difference information of the obfuscated data in real time, wherein the difference information includes the change data volume of the obfuscated data and the change information of the data storage position between the obfuscated data and the mapping line, and then the difference information exceeding the preset condition is used as the attacked information of the isolated space, and the position corresponding to the attacked information in the isolated space is obtained to obtain the corresponding level, wherein the preset condition is the preset change data volume of the obfuscated data, and when there is a change in the change information of the data storage position between the obfuscated data and the mapping line, it is directly recorded as the attacked information of the isolated space, and at the same time, the position corresponding to the attacked information in the isolated space is obtained to obtain the corresponding level, and the attacked information of the isolated space and the corresponding level are used as the state information, so that the protection situation of the database can be understood according to the network attack situation of the security shield, and at the same time, the database has further security protection;
[0074] In one embodiment, the evaluation module comprises:
[0075] The evaluation unit is used to calculate the safety protection evaluation index according to the status information of the safety protection cover, wherein the calculation formula of the safety protection evaluation index is:
[0076] ,in, is the safety protection evaluation index, To obfuscate the amount of data changes, is the level of the attacked information in the isolated space, is the level weight corresponding to the attacked information in the isolation space, To isolate the number of times the space has been attacked by the network, it should be noted that , The larger the value of The larger the value is, the worse the comprehensive security protection status of the database is.
[0077] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.
Claims
1. A network security protection comprehensive evaluation system based on big data, characterized in that: include: A deployment module is used to obtain port information of a database, wherein the port information includes an output port and an input port of the database, and deploy a safety shield based on the database and the port information; The layout module includes: A port acquisition unit, used to acquire an output port and an input port from a database as port information, respectively set corresponding network points corresponding to the output port and the input port, and connect the network points between the output port and the input port; A selection unit is used to select a plurality of random station points on the database, and connect the random station points with the network station points to obtain a basic connection network; The selection unit comprises: A configuration unit, used for randomly configuring a plurality of ports on a database, and marking the plurality of ports as random station points; An establishing unit is used to establish one-to-one channels between multiple random stations and network stations to connect them and form a connection network; A connection unit, used for setting a plurality of nodes on the channels between the plurality of random resident points and the network resident points, and connecting the plurality of nodes to each other to obtain a basic connection network; A management unit, used for duplicating the basic connection network to obtain an outer connection network, setting an isolation space between the basic connection network and the outer connection network, and using the basic connection network, the outer connection network and the isolation space as a safety shield; The management unit comprises: A replication unit, used to replicate the basic connection network with the same structure as the outer connection network, correspond the random station points and the network station points on the outer connection network to a cloud server respectively, and connect the corresponding cloud servers according to the connection relationship between the random station points and the network station points on the outer connection network; An amplification unit, used for amplifying the random station points and the network station points on the outer connection network at equal distances, and placing the outer connection network amplified at equal distances outside the database and the basic connection network; A security unit is used to use the space between the basic connection network and the outer connection network as an isolation space, and use the basic connection network, the outer connection network and the isolation space as a safety shield; The security unit comprises: A filling unit, used to fill the obfuscated data in the space between the basic connection network and the outer connection network; A corresponding unit, used to establish mapping lines between a plurality of random station points and network station points in the basic connection network and corresponding plurality of random station points and network station points in the outer connection network and connect them; A determination unit, configured to obtain position information between the obfuscated data and the mapping line, wherein the position information includes the position of the obfuscated data between the surrounding mapping lines; A network protection unit is used to use the basic connection network, the outer connection network and the isolation space as a safety shield; An acquisition module, connected to the deployment module, for acquiring status information of the safety shield, wherein the status information of the safety shield includes attack information of the isolated space and the corresponding level; The evaluation module is connected to the acquisition module and is used to obtain the safety protection evaluation index according to the status information of the safety protection cover.
2. A network security protection comprehensive evaluation system based on big data according to claim 1, characterized in that: The acquisition module comprises: A level division unit, used for classifying the database according to the storage location to obtain a database level, and marking the isolation space in the safety protection cover at the corresponding location with the level corresponding to the database level; An information acquisition unit, used to acquire status information of the safety protection cover, wherein the status information includes attack information of the isolated space and the corresponding level; The storage unit is used to accumulate and store the status information.
3. A network security protection comprehensive evaluation system based on big data according to claim 2, characterized in that: The information acquisition unit comprises: A real-time acquisition unit, used for acquiring difference information of obfuscated data in real time, wherein the difference information includes the amount of change of obfuscated data and the change information of the data storage position between the obfuscated data and the mapping line; A judgment unit, used to take the difference information exceeding the preset condition as the attacked information of the isolated space, obtain the position corresponding to the attacked information in the isolated space and obtain the corresponding level; The comprehensive unit is used to use the attack information of the isolated space and the corresponding level as status information.
4. A network security protection comprehensive evaluation system based on big data according to claim 1, characterized in that: The evaluation module includes: The evaluation unit is used to calculate the safety protection evaluation index according to the status information of the safety protection cover.