Security vulnerability analysis and management system based on big data

Abstract

The invention creatively provides a security vulnerability analysis and management system based on big data, and the system comprises a data collection module which is used for collecting big data information, such as operation logs, user behavior data and network flow data, from target software and a system; the vulnerability analysis module is used for acquiring the big data information in the data acquisition module and acquiring a protection strategy through a vulnerability analysis strategy; based on the initial integrated protection strategy of each event unit queue, determining a to-be-activated staged protection strategy for each piece of vulnerability threat information; and the strategy execution module is used for executing the corresponding protection strategy under automatic or manual intervention according to the protection strategy in the vulnerability analysis module.

Description

Technical Field

[0001] The present invention relates to the technical field of vulnerability analysis, and more specifically to a security vulnerability analysis and management system based on big data. Background Art

[0002] With the rapid development of information technology, various software and systems are becoming increasingly complex, and security vulnerabilities are becoming increasingly prominent. Traditional security vulnerability analysis methods have problems such as low efficiency and poor accuracy, and are difficult to meet the current complex and changing network security needs. Therefore, a security vulnerability analysis and management system based on big data is needed to improve the accuracy and efficiency of vulnerability identification and reduce security risks. Summary of the invention

[0003] In view of the deficiencies in the prior art, the purpose of the present invention is to provide a security vulnerability analysis and management system based on big data to overcome the above-mentioned defects in the prior art.

[0004] To achieve the above object, the present invention provides the following technical solutions:

[0005] Security vulnerability analysis and management system based on big data, including:

[0006] A data collection module, which is used to collect big data information such as operation logs, user behavior data, network traffic data, etc. from the target software and system;

[0007] A vulnerability analysis module, which is used to obtain the big data information in the data acquisition module and obtain the protection strategy through the vulnerability analysis strategy;

[0008] The vulnerability analysis strategy includes:

[0009] S1: Determine at least one vulnerability threat information corresponding to the operation log of the target software according to the vulnerability attribute of the target software;

[0010] S2: Obtain the office event operation trajectory derived from the vulnerability threat information, as well as the initial protection strategy for each vulnerability threat information;

[0011] S3: grouping all event units in the running track of all office events into multiple event unit queues;

[0012] S4: Based on all the initial protection strategies, perform overall protection strategy matching on each event unit queue obtained by grouping, and determine the initial overall protection strategy of each event unit queue;

[0013] S5: Determine a to-be-activated phased protection strategy for each vulnerability threat information based on the initial integrated protection strategy of each event unit queue;

[0014] The policy execution module is used to execute the corresponding protection strategy automatically or under manual intervention according to the protection strategy in the vulnerability analysis module.

[0015] Preferably, the protection strategy includes but is not limited to blocking threat sources, repairing vulnerabilities, enhancing access control, etc.

[0016] Preferably, an intelligent analysis unit is also included, which is used to analyze semantics through natural language processing technology, identify sensitive words and perform automatic filtering and early warning, and pre-process, clean and format the collected data.

[0017] Preferably, a data security management module is also included, and the data security management module is used to perform hierarchical processing and access control on the stored data. The security management module includes

[0018] A hierarchical processing submodule is used to obtain big data information. A database is preset in the hierarchical processing submodule. The database is provided with big data information, an importance comparison table, and a sensitivity comparison table. The importance of the data and the sensitivity level are obtained according to the big data information, and different security strategies are adopted according to different levels of data.

[0019] Preferably, the data security management module is further provided with an encryption processing submodule and an access control submodule. The encryption control submodule is used to encrypt, store and transmit data with a higher sensitivity level; the access control submodule controls access rights to data based on information such as permissions, IP addresses and request frequencies.

[0020] Preferably, the encryption processing subsystem supports multiple encryption algorithms, including symmetric encryption and asymmetric encryption, and selects a suitable encryption algorithm according to the sensitivity level and importance level of the data.

[0021] Preferably, a user authentication module is also included, which performs dual authentication on the user identity by combining biometric technology and transmission secret verification to ensure the authenticity of the user identity. The biometric technology supports multi-modal fusion authentication.

[0022] Preferably, a system monitoring module is also included, which is used to monitor the operating status of the system, record key information such as user behavior and system operation logs, and record vulnerability threat information and corresponding protection strategies.

[0023] The beneficial effects of the present invention are as follows: by analyzing the time running trajectory derived from the vulnerability threat information, and setting up a database, in which initial protection strategies for different events are preset; grouping office hours into multiple time unit queues, and generating different initial integrated protection strategies for different event unit queues, and on the basis of the initial protection strategy, combining the initial integrated protection strategy, generating a staged protection strategy to be activated, and using a strategy execution module to execute the staged protection strategy to be activated, thereby repairing the vulnerability. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 It is the overall structure diagram of the present invention;

[0025] Figure 2 It is a flow chart of the vulnerability analysis strategy of the present invention. DETAILED DESCRIPTION

[0026] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0027] It should be noted that when a component is referred to as being "fixed to" another component, it may be directly on the other component or there may also be a component centered. When a component is considered to be "connected to" another component, it may be directly connected to the other component or there may also be a component centered. When a component is considered to be "set on" another component, it may be directly set on the other component or there may also be a component centered. The terms "vertical", "horizontal", "left", "right" and similar expressions used herein are for illustrative purposes only.

[0028] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art of the present invention. The terms used herein in the specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. The term "and / or" used herein includes any and all combinations of one or more related listed items.

[0029] The embodiments of the present invention are further described in detail below with reference to the accompanying drawings:

[0030] Security vulnerability analysis and management system based on big data, including:

[0031] Data collection module: The data collection module is used to collect big data information such as operation logs, user behavior data, network traffic data, etc. from the target software and system; the data collection module is used to collect data in the target software migration system;

[0032] It also includes an intelligent analysis unit, which is used to analyze semantics through natural language processing technology, identify sensitive words and automatically filter and warn, and pre-process, clean and format the collected data. Through semantic analysis, sensitive words are automatically filtered and warned to avoid the reappearance of sensitive words. At the same time, the data is pre-processed, cleaned and formatted to improve data quality, unify data format, and improve data analysis efficiency.

[0033] Vulnerability analysis module: The vulnerability analysis module is used to obtain the big data information in the data collection module and obtain the protection strategy through the vulnerability analysis strategy;

[0034] Vulnerability analysis strategies include:

[0035] S1: Determine at least one vulnerability threat information corresponding to the operation log of the target software according to the vulnerability attribute of the target software;

[0036] S2: Obtain the office event operation trajectory derived from the vulnerability threat information, as well as the initial protection strategy for each vulnerability threat information;

[0037] S3: grouping all event units in the running track of all office events into multiple event unit queues;

[0038] S4: Based on all the initial protection strategies, an overall protection strategy is matched for each event unit queue obtained by grouping, and an initial overall protection strategy for each event unit queue is determined;

[0039] S5: Based on the initial overall protection strategy of each event unit queue, determine the staged protection strategy to be activated for each vulnerability threat information;

[0040] The policy execution module is used to execute the corresponding protection strategy automatically or under manual intervention according to the protection strategy in the vulnerability analysis module.

[0041] By analyzing the time running trajectory derived from the vulnerability threat information, and setting up a database, the initial protection strategies for different events are preset in the database; the office hours are grouped into multiple time unit queues, and different initial integrated protection strategies are generated for different event unit queues, and on the basis of the initial protection strategy, combined with the initial integrated protection strategy, a staged protection strategy to be activated is generated, and the strategy execution module is used to execute the staged protection strategy to be activated to achieve vulnerability repair.

[0042] Protection strategies include but are not limited to blocking threat sources, repairing vulnerabilities, and enhancing access control.

[0043] It also includes a data security management module, which is used for hierarchical processing and access control of stored data. The security management module includes a hierarchical processing sub-module, which is used to obtain big data information. The hierarchical processing sub-module is preset with a database, and the database is provided with big data information and an importance comparison table and a sensitivity comparison table. According to the big data information, the importance of the data and the sensitivity level are obtained, and different security strategies are adopted according to the different levels of data. The hierarchical processing sub-module is used to register and divide the big data information according to the importance and sensitivity level, and different levels of data have corresponding different security strategies. During operation, different security strategies are adopted according to the different levels of data to improve the security of the data operation process.

[0044] The data security management module also includes an encryption processing submodule and an access control submodule. The encryption control submodule is used to encrypt, store and transmit data with a higher sensitivity level; the access control submodule controls access rights to data based on information such as user permissions, IP addresses and request frequencies.

[0045] The encryption processing subsystem supports multiple encryption algorithms, including symmetric encryption and asymmetric encryption. The appropriate encryption algorithm is selected according to the sensitivity and importance of the data.

[0046] It also includes a user authentication module, which performs dual authentication of user identity by combining biometric technology and transmission secret verification method to ensure the authenticity of the user identity. Biometric technology supports multi-modal fusion authentication.

[0047] It also includes a system monitoring module, which is used to monitor the system's operating status, record key information such as user behavior, system operation logs, and vulnerability threat information and corresponding protection strategies. The system monitoring module is used to monitor the system's operating status, which facilitates the recording of key information such as user behavior, system operation logs, and vulnerability threat information and corresponding protection strategies, so as to facilitate system monitoring and timely repair and management of vulnerabilities.

[0048] The above are only preferred embodiments of the present invention. The protection scope of the present invention is not limited to the above embodiments. All technical solutions under the concept of the present invention belong to the protection scope of the present invention. It should be pointed out that for ordinary technicians in this technical field, some improvements and modifications without departing from the principle of the present invention should also be regarded as the protection scope of the present invention.

Claims

1. Security vulnerability analysis and management system based on big data, characterized by: include: A data collection module, which is used to collect big data information such as operation logs, user behavior data, network traffic data, etc. from the target software and system; A vulnerability analysis module, which is used to obtain the big data information in the data acquisition module and obtain the protection strategy through the vulnerability analysis strategy; The vulnerability analysis strategy includes: S1: Determine at least one vulnerability threat information corresponding to the operation log of the target software according to the vulnerability attribute of the target software; S2: Obtain the office event operation trajectory derived from the vulnerability threat information, as well as the initial protection strategy for each vulnerability threat information; S3: grouping all event units in the running track of all office events into multiple event unit queues; S4: Based on all the initial protection strategies, perform overall protection strategy matching on each event unit queue obtained by grouping, and determine the initial overall protection strategy of each event unit queue; S5: Determine a to-be-activated phased protection strategy for each vulnerability threat information based on the initial integrated protection strategy of each event unit queue; The policy execution module is used to execute the corresponding protection strategy automatically or under manual intervention according to the protection strategy in the vulnerability analysis module.

2. The security vulnerability analysis and management system based on big data according to claim 1 is characterized in that: The protection strategies include but are not limited to blocking threat sources, repairing vulnerabilities, enhancing access control, etc.

3. The security vulnerability analysis and management system based on big data according to claim 1 is characterized in that: It also includes an intelligent analysis unit, which is used to analyze semantics through natural language processing technology, identify sensitive words and perform automatic filtering and early warning, and pre-process, clean and format the collected data.

4. The security vulnerability analysis and management system based on big data according to claim 1 is characterized in that: It also includes a data security management module, which is used to perform hierarchical processing and access control on the stored data. The security management module includes A hierarchical processing submodule is used to obtain big data information. A database is preset in the hierarchical processing submodule. The database is provided with big data information, an importance comparison table, and a sensitivity comparison table. The importance of the data and the sensitivity level are obtained according to the big data information, and different security strategies are adopted according to different levels of data.

5. The security vulnerability analysis and management system based on big data according to claim 4 is characterized in that: The data security management module is also provided with an encryption processing submodule and an access control submodule. The encryption control submodule is used to encrypt, store and transmit data with a higher sensitivity level; the access control submodule controls access rights to data based on information such as permissions, IP addresses and request frequencies.

6. The security vulnerability analysis and management system based on big data according to claim 5 is characterized in that: The encryption processing subsystem supports multiple encryption algorithms, including symmetric encryption and asymmetric encryption, and selects a suitable encryption algorithm according to the sensitivity level and importance level of the data.

7. The security vulnerability analysis and management system based on big data according to claim 1 is characterized in that: It also includes a user authentication module, which performs dual authentication on the user identity by combining biometric technology and transmission secret verification to ensure the authenticity of the user identity. The biometric technology supports multi-modal fusion authentication.

8. The security vulnerability analysis and management system based on big data according to claim 1 is characterized in that: It also includes a system monitoring module, which is used to monitor the operating status of the system, record key information such as user behavior and system operation logs, and record vulnerability threat information and corresponding protection strategies.

Images