A network information security assessment system

Abstract

The present invention relates to the technical field of network information security, and in particular to a network information security assessment system, comprising: a traversal module, used for traversing network information historically released in an application; an analysis module, used for real-time analysis of the popularity of the network information traversed in the traversal module; a database, used for storing verification data for evaluating network information security; the present invention takes an application with information publishing, reprinting, and commenting functions as a service target, performs security assessment on the network information released in the application, analyzes the popularity of the network information in the network information security assessment stage, and then generates a network information processing queue, further extracts key information from the network information according to the network information processing queue and performs security assessment, and finally determines the network information security according to the assessment result combined with the network information popularity, and identifies and determines the network information with security risks.

Description

Technical Field

[0001] The present invention relates to the technical field of network information security, and in particular to a network information security evaluation system. Background Art

[0002] Network information security refers to protecting the hardware, software and data in the network system from threats such as malicious attacks, tampering and leakage. It covers technical means such as cryptography, access control and firewalls.

[0003] The invention patent with application number 202111597666.6 discloses a network information security risk assessment system, which outputs a training set and a feature set, calculates a new feature selection standard AS to perform node splitting to generate a decision tree model, establishes a decision tree model rule set, and evaluates network information security through the decision tree model and the decision tree model rule set; it is characterized in that the decision tree model is an improved decision tree model. The process of improving the decision tree model algorithm is as follows: let S be a sample set, the number of sample sets is n……

[0004] The application aims to solve the problem that "existing technologies lack an effective assessment mechanism for existing security assurance capabilities, are unable to accurately perceive the security status of the system, and are difficult to detect and eliminate potential security risks in a timely manner."

[0005] However, for applications that have the ability to publish information freely, the publication and dissemination of negative online speech and online information will have a great and long-term adverse impact on the network environment;

[0006] To this end, we propose a network information security assessment system. Summary of the invention

[0007] In view of the above shortcomings of the prior art, the present invention provides a network information security assessment system, which solves the technical problems raised in the above background technology.

[0008] To achieve the above objectives, the present invention is implemented through the following technical solutions:

[0009] A network information security assessment system, comprising:

[0010] A traversal module is used to traverse the network information historically released in the application; an analysis module is used to analyze the popularity of the network information traversed in the traversal module in real time; a database is used to store verification data for evaluating the security of network information; an extraction module is used to receive the network information that performs traversal operations in the traversal module and extract key information from the received network information; a storage module is used to receive the key information of the network information extracted from the extraction module and store the key information of the network information; an evaluation module is used to obtain the key information stored in the storage module, compare the key information obtained by the application with the verification data stored in the database, and evaluate whether the network information is safe.

[0011] Furthermore, the application program for traversing network information by the traversal module is any application program with information publishing, reprinting and commenting functions, and the traversal module is provided with submodules at the lower level, including:

[0012] A setting unit, used to set a network information traversal time threshold, and control the traversal module to traverse the historical published network information within the corresponding traversal time threshold in the application program;

[0013] A collection unit, used for collecting characteristic parameters of network information;

[0014] Among them, the network information traversal time threshold set in the setting unit is customized by the system user, and the collection unit runs synchronously with the traversal module to collect corresponding characteristic parameters for each traversed network information. The network information characteristic parameters include: network information release time, network information reprint times, network information comment times, and network information comment reply times.

[0015] Furthermore, during the operation phase of the analysis module, the network information characteristic parameters are obtained in the acquisition unit, and the network information heat is analyzed based on the network information characteristic parameters. The network information heat analysis logic is expressed as follows:

[0016] ;

[0017] Where: is the network information heat performance value; is the number of times the network information is reposted within the traversal time threshold; is the number of comments on the network information within the traversal time threshold; is the maximum value of the traversal time threshold; The time when the network information is released; It is a collection of online information comments; is the number of replies to comment i; is the weight of comment i;

[0018] Among them, the network information heat performance value The larger the value is, the higher the popularity of the network information is, and vice versa, the lower the popularity of the network information is. The value of the comment weight follows: The smaller the ratio of the time span from the first reply timestamp to the last reply timestamp to the total number of times the comment is replied, the greater the comment weight is, and vice versa.

[0019] Furthermore, after collecting the network information characteristic parameters, the collection unit synchronously distinguishes and stores the network information characteristic parameters, and each group of network information is distinguished and marked based on the network information title. After analyzing the heat of the network information, the analysis module synchronously feeds back the network information heat analysis results to the collection unit, determines the network information characteristic parameters corresponding to the network information heat analysis results based on the network information title, and stores the network information heat analysis results in the network information characteristic parameters distinguished and stored under the same network information title.

[0020] Furthermore, the analysis module is provided with submodules at the lower level, including:

[0021] A queue unit is used to obtain the network information heat analysis result in the analysis module, apply the network information heat analysis result to sort the network information in descending order, and build a network information processing queue;

[0022] Among them, the network information processing queue constructed in the queue unit is forwarded to the extraction module through the database;

[0023] The verification data for evaluating network information security stored in the database is manually uploaded by system end users, and the verification data stored in the database is in the format of text data and image data.

[0024] Furthermore, when the extraction module extracts key information from network information, the extraction target is information in text format and image format. In the extraction stage, the predicate, object, attributive, adverbial, and complement of the text information in the network information are extracted based on the hidden Markov model, and the extracted predicate, object, attributive, adverbial, complement and image format information are used as key information;

[0025] When storing the key information of the network information, the storage module synchronously marks and stores the corresponding key information based on the network information title.

[0026] Furthermore, the storage module is provided with submodules at the lower level, including:

[0027] A retrieving unit, used to retrieve key information stored in the storage module, and forward the retrieved key information to the evaluation module;

[0028] Among them, the key information retrieved by the retrieval unit running in the storage module aims to store all the key information in each differentiated storage interval, and after completing the retrieval, continuously identify the similarity of each key information, and when two groups of key information with a similarity of 100% are identified, any one group of key information is discarded, until the retrieval unit based on the key information discarding operation, the remaining key information is different, and then the retrieval unit executes the operation of forwarding the retrieved key information to the evaluation module.

[0029] Furthermore, the comparison logic of the key information obtained in the evaluation module and the verification data stored in the database is expressed as:

[0030] ;

[0031] Where: The comprehensive similarity between the key information obtained for the evaluation module and the verification data in the database; is the total amount of key information; is the judgment function; is the jth key information; A collection of validation data in the database; The total amount of verification data in the database; is the similarity between the jth key information and the vth verification data; for The most recent common ancestor node in the semantic network; is the number of edges from node to node C in the semantic network corresponding to the jth key information; is the number of edges from node to node C in the semantic network corresponding to the vth verification data; is the number of edges from the root node to node C;

[0032] in, Table pair The average of the decision function middle, ∈ hour, =1, hour, =0, When calculating, When the key information and verification data are in text format, the calculation is based on formula (2) and the execution The two sets of key information and verification data formats are the same.

[0033] Furthermore, the The smaller the value, the more secure the network information is. On the contrary, the less secure the network information is. The evaluation module has a security threshold defined by the system end user. The evaluation module is based on the security threshold and Further comparison is conducted to assess whether the network information is safe;

[0034] Among them, when the evaluation module evaluates that the network information is unsafe, the judgment function =1 if all To capture, Transmit to database for storage and synchronous identification Source: Internet information.

[0035] Furthermore, the traversal module is interactively connected to a setting unit and a collection unit via a wireless network, the traversal module is interactively connected to an analysis module via a wireless network, the analysis module is interactively connected to a queue unit via a wireless network, the analysis module and the queue unit are interactively connected to a database via a wireless network, the database is interactively connected to an extraction module, a storage module and an evaluation module via a wireless network, the storage module is interactively connected to a retrieval unit via a wireless network, and the retrieval unit is interactively connected to the evaluation module via a wireless network.

[0036] Compared with the known public technology, the technical solution provided by the present invention has the following beneficial effects:

[0037] The present invention provides a network information security assessment system. During operation, the system takes an application with information publishing, reprinting and commenting functions as a service target, performs security assessment on the network information published in the application, analyzes the popularity of the network information in the network information security assessment stage, and then generates a network information processing queue, further extracts key information from the network information based on the network information processing queue and performs security assessment, and finally determines the network information security based on the assessment result combined with the network information popularity, and identifies and determines the network information with security risks. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the prior art descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0039] Figure 1 The figure is a structural diagram of a network information security assessment system. DETAILED DESCRIPTION

[0040] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0041] The present invention will be further described below in conjunction with the embodiments. Embodiment 1:

[0042] A network information security assessment system of this embodiment, such as Figure 1 As shown, including:

[0043] The traversal module is used to traverse the historically published network information in the application;

[0044] The application program for traversing network information by the traversal module is any application program with information publishing, reprinting and commenting functions. The traversal module is provided with sub-modules at the lower level, including:

[0045] A setting unit, used to set a network information traversal time threshold, and control the traversal module to traverse the historical published network information within the corresponding traversal time threshold in the application program;

[0046] A collection unit, used for collecting characteristic parameters of network information;

[0047] The network information traversal time threshold set in the setting unit is customized by the system end user, and the collection unit runs synchronously with the traversal module to collect corresponding characteristic parameters for each traversed network information. The network information characteristic parameters include: network information release time, network information reprint times, network information comment times, and network information comment reply times;

[0048] The analysis module is used to analyze the popularity of the network information traversed in the traversal module in real time;

[0049] During the operation phase of the analysis module, the network information characteristic parameters are obtained in the acquisition unit, and the network information heat is analyzed based on the network information characteristic parameters. The network information heat analysis logic is expressed as follows:

[0050] ;

[0051] Where: is the network information heat performance value; is the number of times the network information is reposted within the traversal time threshold; is the number of comments on the network information within the traversal time threshold; is the maximum value of the traversal time threshold; The time when the network information is released; It is a collection of online information comments; is the number of replies to comment i; is the weight of comment i;

[0052] Among them, the network information heat performance value The larger the value is, the higher the popularity of the network information is, and vice versa, the lower the popularity of the network information is. The value of the comment weight follows: The smaller the ratio of the time span from the first reply timestamp to the last reply timestamp to the total number of replies to the comment, the greater the comment weight is, and vice versa;

[0053] The analysis module is provided with submodules, including:

[0054] A queue unit is used to obtain the network information heat analysis result in the analysis module, apply the network information heat analysis result to sort the network information in descending order, and build a network information processing queue;

[0055] Among them, the network information processing queue constructed in the queue unit is forwarded to the extraction module through the database;

[0056] The verification data for evaluating network information security stored in the database is manually uploaded by the system end user, and the verification data stored in the database is in the format of text data and image data;

[0057] A database for storing verification data for evaluating network information security;

[0058] An extraction module is used to receive the network information that performs the traversal operation in the traversal module and extract key information from the received network information;

[0059] A storage module, used for receiving the key information of the network information extracted by the extraction module, and storing the key information of the network information;

[0060] The storage module is provided with submodules at the lower level, including:

[0061] A retrieving unit, used to retrieve key information stored in the storage module, and forward the retrieved key information to the evaluation module;

[0062] The target of the key information retrieved by the retrieval unit in the storage module is to store all the key information in each storage interval, and after the retrieval is completed, the similarity of each key information is continuously identified, and when two sets of key information with a similarity of 100% are identified, any one set of key information is discarded, until the key information in the remaining key information after the retrieval unit discards the key information is different, and the retrieval unit then executes the operation of forwarding the retrieved key information to the evaluation module;

[0063] An evaluation module is used to obtain key information stored in the storage module, compare the key information obtained with the verification data stored in the database, and evaluate whether the network information is safe;

[0064] The comparison logic between the key information obtained in the evaluation module and the verification data stored in the database is expressed as:

[0065] ;

[0066] Where: The comprehensive similarity between the key information obtained for the evaluation module and the verification data in the database; is the total amount of key information; is the judgment function; is the jth key information; A collection of validation data in the database; The total amount of verification data in the database; is the similarity between the jth key information and the vth verification data; for the most recent common ancestor node in the semantic network; is the number of edges from node to node C in the semantic network corresponding to the jth key information; is the number of edges from node to node C in the semantic network corresponding to the vth verification data; is the number of edges from the root node to node C;

[0067] in, Table pair The average of the decision function middle, ∈ hour, =1, hour, =0, When calculating, When the key information and verification data are in text format, the calculation based on formula (2) is performed. The two sets of key information and verification data formats are the same;

[0068] The smaller the value, the more secure the network information is. On the contrary, the less secure the network information is. The evaluation module has a security threshold defined by the system end user. The evaluation module is based on the security threshold and Further comparison is conducted to assess whether the network information is safe;

[0069] Among them, when the evaluation module evaluates that the network information is unsafe, the judgment function =1 if all To capture, Transmit to database for storage and synchronous identification Source network information;

[0070] The traversal module is interactively connected to a setting unit and a collection unit through a wireless network, the traversal module is interactively connected to an analysis module through a wireless network, the analysis module is interactively connected to a queue unit through a wireless network, the analysis module and the queue unit are interactively connected to a database through a wireless network, the database is interactively connected to an extraction module, a storage module and an evaluation module through a wireless network, the storage module is interactively connected to a retrieval unit through a wireless network, and the retrieval unit is interactively connected to the evaluation module through a wireless network.

[0071] In this embodiment, the traversal module runs to traverse the network information historically released in the application, the setting unit synchronously sets the network information traversal time threshold, controls the traversal module to traverse the historically released network information within the corresponding traversal time threshold in the application, the collection unit collects the characteristic parameters of the network information in real time, the analysis module further analyzes the heat of the network information traversed in the traversal module in real time, the queue unit synchronously obtains the network information heat analysis result in the analysis module, applies the network information heat analysis result to sort the network information in descending order, builds a network information processing queue, and the database post-operates to store verification data for evaluating the security of the network information. The extraction module then receives the network information that performs the traversal operation in the traversal module, extracts key information from the received network information, the storage module runs to receive the key information of the network information extracted from the extraction module, stores the key information of the network information, the retrieval unit synchronously retrieves the key information stored in the storage module, and forwards the retrieved key information to the evaluation module. Finally, the evaluation module obtains the key information stored in the storage module, and the obtained key information is compared with the verification data stored in the database to evaluate whether the network information is safe.

[0072] Through the operation of the system in the above embodiment, a network information security assessment service is provided for applications that currently have information publishing, reprinting, and commenting functions, ensuring the safety and health of application information interaction scenarios. Example 2

[0073] In terms of specific implementation, based on Example 1, this example refers to Figure 1 The network information security assessment system in Example 1 is further described in detail:

[0074] After collecting the network information characteristic parameters, the collection unit synchronously distinguishes and stores the network information characteristic parameters, and distinguishes and marks each group of network information based on the network information title. After analyzing the heat of the network information, the analysis module synchronously feeds back the network information heat analysis result to the collection unit, determines the network information characteristic parameters corresponding to the network information heat analysis result based on the network information title, and stores the network information heat analysis result in the network information characteristic parameters that are distinguished and stored under the same network information title;

[0075] When the extraction module extracts key information from network information, the extraction target is information in text format and image format. In the extraction stage, the predicate, object, attributive, adverbial and complement of the text information in the network information are extracted based on the hidden Markov model, and the extracted predicate, object, attributive, adverbial, complement and image format information are used as key information;

[0076] When storing key information of network information, the storage module synchronously marks and stores the corresponding key information based on the network information title.

[0077] In this embodiment, through the above settings, further operation data and logic support are provided for the operation of the system in Example 1, ensuring the stable operation of the system in Example 1.

[0078] In summary, in the above-mentioned embodiment, during operation, the system takes the application with information publishing, reprinting and commenting functions as the service target, performs security assessment on the network information published in the application, and in the network information security assessment stage, analyzes the popularity of the network information, and then generates a network information processing queue. Further, based on the network information processing queue, key information is extracted from the network information and a security assessment is performed. Finally, based on the assessment results and the popularity of the network information, the network information security is judged, and the network information with security risks is identified and judged.

[0079] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements will not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A network information security assessment system, characterized in that: include: The traversal module is used to traverse the historically published network information in the application; The analysis module is used to analyze the popularity of the network information traversed in the traversal module in real time; A database for storing verification data for evaluating network information security; An extraction module is used to receive the network information that performs the traversal operation in the traversal module and extract key information from the received network information; A storage module, used for receiving the key information of the network information extracted by the extraction module, and storing the key information of the network information; An evaluation module is used to obtain key information stored in the storage module, compare the key information obtained with the verification data stored in the database, and evaluate whether the network information is safe; During the operation phase of the analysis module, network information characteristic parameters are obtained, and network information heat is analyzed based on the network information characteristic parameters. The network information heat analysis logic is expressed as follows: Where: TPT is the network information heat performance value; p rep is the number of times the network information is reposted within the traversal time threshold; prem is the number of times the network information is commented within the traversal time threshold; tmax is the maximum value of the traversal time threshold; t ann is the time when the network information is released; nrem is the collection of network information comments; pi is the number of replies to comment i; ωi is the weight of comment i; Among them, the larger the network information heat performance value TPT is, the higher the network information heat is, and vice versa, the lower the network information heat is. The value of the comment weight follows: The smaller the ratio of the time span from the first reply timestamp to the last reply timestamp to the total number of replies to the comment, the greater the comment weight is, and vice versa; The comparison logic of the key information obtained in the evaluation module and the verification data stored in the database is expressed as: Where: Q is the comprehensive similarity between the key information obtained by the evaluation module and the verification data in the database; m is the total amount of key information; f(p j , A) is the decision function; pj is the jth key information; A is the set of verification data in the database; u is the total amount of verification data in the database; sim(p j ,p v ) is the similarity between the jth key information and the vth verification data; C is p j 、p v The most recent common ancestor node in the semantic network; d(p j , C) is the number of edges from node to node C in the semantic network corresponding to the jth key information; d(p v ,C) is the number of edges from node to node C in the semantic network corresponding to the vth verification data; d(root,C) is the number of edges from the root node to node C; in, Express The average value of the decision function f(p j ,A), p j ∈A, f(p j ,A)=1, When f(p j ,A)=0,sim(p j ,p v )When calculating, p j 、p v When all key information and verification data are in text format, based on formula (2), sim(p j ,p v ) have the same format for both sets of key information and verification data.

2. A network information security assessment system according to claim 1, characterized in that: The application program for traversing network information by the traversal module is any application program with information publishing, reprinting and commenting functions. The traversal module is provided with submodules at the lower level, including: A setting unit, used to set a network information traversal time threshold, and control the traversal module to traverse the historical published network information within the corresponding traversal time threshold in the application program; A collection unit, used for collecting characteristic parameters of network information; Among them, the network information traversal time threshold set in the setting unit is customized by the system user, and the collection unit runs synchronously with the traversal module to collect corresponding characteristic parameters for each traversed network information. The network information characteristic parameters include: network information release time, network information reprint times, network information comment times, and network information comment reply times.

3. A network information security assessment system according to claim 2, characterized in that: After collecting the network information characteristic parameters, the collection unit synchronously distinguishes and stores the network information characteristic parameters, and each group of network information is distinguished and marked based on the network information title. After analyzing the heat of the network information, the analysis module synchronously feeds back the network information heat analysis result to the collection unit, determines the network information characteristic parameters corresponding to the network information heat analysis result based on the network information title, and stores the network information heat analysis result in the network information characteristic parameters distinguished and stored under the same network information title.

4. A network information security assessment system according to claim 1, characterized in that: The analysis module is provided with submodules at the lower level, including: A queue unit is used to obtain the network information heat analysis result in the analysis module, apply the network information heat analysis result to sort the network information in descending order, and build a network information processing queue; Among them, the network information processing queue constructed in the queue unit is forwarded to the extraction module through the database; The verification data for evaluating network information security stored in the database is manually uploaded by system end users, and the verification data stored in the database is in the format of text data and image data.

5. A network information security assessment system according to claim 1, characterized in that: When the extraction module extracts key information from network information, the extraction target is information in text format and image format. In the extraction stage, the predicate, object, attributive, adverbial and complement of the text information in the network information are extracted based on the hidden Markov model, and the extracted predicate, object, attributive, adverbial, complement and image format information are used as key information; When storing the key information of the network information, the storage module synchronously marks and stores the corresponding key information based on the network information title.

6. A network information security assessment system according to claim 1, characterized in that: The storage module is provided with submodules at the lower level, including: A retrieving unit, used to retrieve key information stored in the storage module, and forward the retrieved key information to the evaluation module; Among them, the key information retrieved by the retrieval unit running in the storage module aims to store all the key information in each differentiated storage interval, and after completing the retrieval, continuously identify the similarity of each key information, and when two groups of key information with a similarity of 100% are identified, any one group of key information is discarded, until the retrieval unit based on the key information discarding operation, the remaining key information is different, and then the retrieval unit executes the operation of forwarding the retrieved key information to the evaluation module.

7. A network information security assessment system according to claim 1, characterized in that: The smaller the Q is, the more secure the network information is, and vice versa, the less secure the network information is. The evaluation module has a security determination threshold that is defined by the system end user. The evaluation module further compares the security determination threshold with Q to evaluate whether the network information is secure. When the evaluation module evaluates that the network information is unsafe, the judgment function f(p j ,A)=1, all p j Capture, transfer pj to the database for storage, and simultaneously identify the source network information of pj.

8. A network information security assessment system according to claim 1, characterized in that: The traversal module is interactively connected to a setting unit and a collection unit via a wireless network, the traversal module is interactively connected to an analysis module via a wireless network, the analysis module is interactively connected to a queue unit via a wireless network, the analysis module and the queue unit are interactively connected to a database via a wireless network, the database is interactively connected to an extraction module, a storage module and an evaluation module via a wireless network, the storage module is interactively connected to a retrieval unit via a wireless network, and the retrieval unit is interactively connected to the evaluation module via a wireless network.

Images