An enterprise security risk assessment system based on big data

Abstract

The present invention discloses an enterprise security risk assessment system based on big data, which relates to the field of enterprise network security technology and solves the problem that the original network security assessment method is relatively single and the test is not comprehensive enough. The present invention targets the delayed test party locked in the time difference comparison and confirmation process, performs a delay test on such delayed test party, and identifies the specific interception time difference of the delayed test party by using an uninterrupted attack method, so as to analyze whether its delay meets the standard. For the related party that fails to meet the delay test standard, by identifying the utilization of the corresponding CPU in its processing process, it is determined whether there is a problem of uneven computing power distribution, and directly performs related display, so that the corresponding network maintenance party can quickly find the abnormal cause and perform related processing, which can not only achieve the overall effect of network security assessment, but also achieve specific identification of network problems and perform signal display.

Description

Technical Field

[0001] The present invention relates to the field of enterprise network security technology, and in particular to an enterprise security risk assessment system based on big data. Background Art

[0002] Enterprise cybersecurity refers to any technology, measure or practice used to protect an enterprise's systems, applications, computing devices, sensitive data and financial assets from cyber attacks or mitigate their impact. In today's digital age, with the rapid development of information technology and the widespread popularity of Internet applications, enterprises are facing an increasingly complex and severe cybersecurity situation.

[0003] The application with publication number CN115438949A discloses a method for evaluating the health of enterprise network security based on qualitative risk analysis, including the following steps: Step 1: Establish an enterprise network security health evaluation index model, and set positive indicators, reverse indicators and special indicators; Step 2: Design a security risk calculation model for the positive indicators, reverse indicators and special indicators set in step 1, and calculate the risk value corresponding to each indicator; Step 3: Set the weight ratio of positive indicators, reverse indicators and special indicators; Step 4: Design a health evaluation calculation model, set the risk level impact area, including healthy, low risk, medium risk and high risk; Calculate the current risk impact level according to the health evaluation model to be in the healthy, low risk, medium risk and high risk area; It has the characteristics of scientific understanding, dynamic adjustment and strong implementation.

[0004] During the relevant evaluation process of the network security risks related to its enterprise, the relevant security protection measures on the corresponding enterprise network are used to assess whether the network end of its enterprise has met the security test standards. However, the original testing method is relatively simple, and it only conducts a single network security evaluation. The network evaluation is not comprehensive, and it does not identify the relevant problems in its network security based on the relevant characteristics in its network evaluation process, and make relevant displays in a timely manner. Summary of the invention

[0005] In view of the shortcomings of the prior art, the present invention provides an enterprise security risk assessment system based on big data, which solves the problem that the original network security assessment method is relatively single and its testing is not comprehensive enough.

[0006] To achieve the above objectives, the present invention is implemented through the following technical solutions: a big data-based enterprise security risk assessment system, comprising:

[0007] The instruction database is a pre-stored instruction library on the enterprise network side, which stores a large number of different recognized related instructions, and each different related instruction has a preset interaction feature, and its interaction feature includes an interval feature or a waveform feature;

[0008] The abnormal instruction generation end randomly selects a group of related instructions from the instruction database, and based on the interaction characteristics of the related instructions, performs protocol changes on the network interaction traffic of the related instructions during the interaction process, generates a group of interaction instructions, and transmits the generated interaction instructions to the enterprise network end. The specific method is as follows:

[0009] A group of related instructions are randomly selected from the instruction data, and then a group of interactive instructions with the same request as the related instructions are generated, and the interactive features of the related instructions A are confirmed;

[0010] If the interaction feature is an interval feature, the network traffic is restricted in the interaction protocol of this interaction instruction so that the value interval generated by the network traffic exceeds the interval associated with the original interval feature, and the interaction instruction after the interaction protocol is changed is transmitted to the enterprise network end for data request;

[0011] If the interaction feature is a waveform feature, network traffic restriction is performed in the interaction protocol of the interaction instruction so that the wavelength of the waveform generated by the network traffic is inconsistent with the wavelength in the original waveform feature, and the interaction instruction after the interaction protocol is changed is transmitted to the enterprise network end for data request;

[0012] The interactive feedback confirmation end identifies whether the enterprise network end sends an interception signal with the interactive instruction to the firewall. If there is an interception signal, the enterprise network end is marked as a terminal that meets the initial test standards. If there is no interception signal, the enterprise network end is marked as a terminal that does not meet the initial test standards, and is displayed through the display end;

[0013] The associated time difference confirmation end confirms the processing time differences of the initial test standard-compliant end one by one, determines the associated time difference interval belonging to this initial test standard-compliant end from the past historical data, and checks the determined associated time difference interval with the preset standard value to determine whether the time difference of this initial test standard-compliant end meets the standard. The specific method is as follows:

[0014] Determine the several groups of abnormal instructions intercepted by the initial test standard-reaching end from the historical completion data, and then identify the specific time difference between when the initial test standard-reaching end receives the abnormal instruction and when the interception signal is generated from the interception data associated with the several groups of abnormal instructions, and determine the minimum value and the maximum value based on the several groups of time differences corresponding to the several groups of abnormal instructions, and determine the associated time difference interval [Smin, Smax] of the initial test standard-reaching end;

[0015] This associated time difference interval [Smin, Smax] is checked against the preset standard value Bz, which is the preset duration parameter:

[0016] If Smax<Bz, the terminal that meets the initial test standards is directly marked as a high-security terminal and displayed directly through the display terminal;

[0017] If Smin≤Bz≤Smax, the initial test-compliant end is calibrated as the delay-to-be-tested end, and the subsequent virus empty packet test end is executed for delay test to assess whether the delay-to-be-tested end meets the time difference delay test standard;

[0018] If Bz<Smin, the end that meets the initial test standards will be marked as a high-risk end and displayed directly through the display end;

[0019] The virus empty packet test end generates a set of virus empty packets based on the calibrated delay test party, and controls the virus empty packets to be sent to the enterprise network end, and evaluates whether the delay test of the enterprise network end meets the standard based on the corresponding interception time of the enterprise network end. The specific method is as follows:

[0020] Based on the relevant characteristics of any set of virus data in the past, a set of virus empty packets is randomly generated, and the virus empty packets are controlled to be sent to the enterprise network end at a certain interval. This time period is Bz or other values, and other values ​​are greater than Bz. When the virus empty packet is sent, its sending time is recorded, and then the time when the enterprise network end generates the interception signal is recorded. Based on the time difference between the sending time and the generation time, the associated time difference Sz corresponding to this virus empty packet is locked. k , where k = 1, 2, ..., n, where n represents the total number of times the virus empty packets are sent;

[0021] According to the relationship of k value from small to large, generate its associated time difference sequence {Sz1, Sz2, ..., Sz n}, using CL = (Sz1-Sz2) + (Sz2-Sz3) + ... (Sz n-1 -Sz n )Lock the associated evaluation value CL. If CL is less than 0, the delay party to be tested is marked as the party that fails to meet the delay standard, and the abnormal cause analysis is performed based on the process intervention analysis end;

[0022] If CL≥0, the party to be tested is marked as the party that meets the delay standard and is directly displayed on the display terminal;

[0023] The process intervention analysis end identifies the CPU utilization associated with each interception processing process of the virus empty packet test end. By specifically identifying the process of CPU utilization decline, it is assessed whether there is an uneven distribution of computing power in the party whose delay does not meet the standard. The specific method is as follows:

[0024] Determine whether the next batch of virus-free packets is received during the corresponding interception processing process period of the virus-free packets: if so, mark such interception processing process as a process to be processed; if not, do not perform any marking;

[0025] Identify the CPU utilization correlation curve related to the process to be processed, and based on the entry time of the next batch of virus empty packets, lock the same time on the CPU utilization correlation curve, and use the period between the same time and the subsequent adjacent time as the selected period, and select part of the curve segment from the CPU utilization correlation curve based on the selected period;

[0026] For each different CPU utilization correlation curve, the corresponding partial curve segment is selected;

[0027] Identify and confirm whether the selected groups of partial curve segments have consistent change trends. If they are consistent, it means that the computing power distribution of this party that does not meet the delay standard is uniform, and directly generate a computing power distribution uniformity signal belonging to this party that does not meet the delay standard, and display it through the display terminal;

[0028] If they are not consistent, it means that the computing power distribution of the party that does not meet the delay standard is uneven, and a computing power uneven distribution signal belonging to the party that does not meet the delay standard is directly generated and displayed through the display terminal.

[0029] The present invention provides an enterprise security risk assessment system based on big data. Compared with the prior art, it has the following beneficial effects:

[0030] The present invention generates abnormal interaction instructions of the same type of data requests from the relevant instruction database stored in the enterprise, and uses such abnormal interaction instructions to perform relevant tests on the enterprise network end to assess whether there are relevant network security problems on the enterprise network end, and locks the party that meets the test standards. The processing method is simple and fast, and the party that meets the test standards can be quickly locked;

[0031] For the test-compliant parties, the relevant time differences are identified from the historical completion data of such compliant parties, and then such relevant time differences are compared with the corresponding standard values. Through the specific comparison results, it is determined whether the time difference meets the standard, and the second stage of security testing is completed, so that the comprehensiveness of the network security risk assessment can be fully guaranteed;

[0032] For the delayed test party locked in the time difference comparison and confirmation process, a delay test is performed on such delayed test party. By using an uninterrupted attack method, the specific interception time difference of the delayed test party is identified, so as to analyze whether its delay meets the standard. For the related parties that do not meet the delay test standard, by identifying the utilization of the corresponding CPU in its processing process, it is determined whether there is a problem of uneven computing power distribution, and directly display the correlation, so that the corresponding network maintenance party can quickly find the cause of the abnormality and perform correlation processing. It can not only achieve the overall effect of network security assessment, but also achieve specific identification of network problems and signal display, which is convenient for the corresponding network personnel to handle and solve the problems in time. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 It is a schematic diagram of the principle framework of the present invention. DETAILED DESCRIPTION

[0034] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. Example

[0035] See also Figure 1 , the present application provides an enterprise security risk assessment system based on big data, including an instruction database, an abnormal instruction generation end, an interactive feedback confirmation end, an associated time difference confirmation end, a virus empty packet test end, a process intervention analysis end and a display end, wherein the instruction database, the abnormal instruction generation end, the interactive feedback confirmation end, the associated time difference confirmation end, the virus empty packet test end, and the process intervention analysis end are electrically connected from the output node to the input node in sequence, and the interactive feedback confirmation end, the associated time difference confirmation end, the virus empty packet test end, and the process intervention analysis end are electrically connected to the display end input node respectively;

[0036] Its enterprise security risk assessment is mainly aimed at the overall risk assessment of enterprise network security. Based on its specific risk assessment related process, it identifies the network security prevention capabilities of its enterprise. Its related enterprises identify whether the data request instructions generated by different data requesters are the security instructions determined by the enterprise, and then monitor whether their interactive traffic is normal through the IDS network traffic monitoring system, so as to carry out overall security prevention. For example: the proposed requester is A, and the network end of this enterprise is B. A sends relevant data request instructions to B. B compares this data request instruction with the instructions pre-stored in the database to assess whether such instructions exist. If so, B transmits the relevant data requested by this data request instruction to A, and simultaneously conducts data interaction, and conducts traffic monitoring during the data interaction process to identify whether this requester A has abnormal behavior, and take timely precautions to ensure the network security of the network end B of this enterprise;

[0037] Its instruction database is a pre-stored instruction library on the enterprise network side, which stores a large number of different recognized related instructions, and each different related instruction has a preset interaction feature, and its interaction feature includes interval feature or waveform feature. The so-called interval feature means that the data network interaction traffic of this instruction has a peak value and a valley value. No matter how the waveform changes, the peak value and valley value generated will not change, that is, its network traffic changes within this interval. The so-called waveform feature means that the data network interaction traffic of this instruction is a regular waveform, that is, the network interaction traffic feature of such instructions has been limited. If the network interaction traffic generated by this instruction is inconsistent with this regular waveform, it will be directly intercepted, indicating that the data network traffic interacted by this instruction is abnormal. The stored related instructions and preset interaction features are all prepared in advance by network personnel based on the associated features of the corresponding instructions. Since this application is mainly aimed at the overall evaluation of the network security trend, the related prior art of the determined corresponding features is not described one by one. Its interval feature can be confirmed based on the maximum and minimum values ​​generated in the normal interaction process, and its waveform feature can be confirmed based on the regular waveform generated in the normal interaction process. Its feature expression form can be wavelength or other forms;

[0038] The abnormal instruction generating end randomly selects a group of related instructions from the instruction database, and based on the interactive characteristics of the related instructions, changes the protocol of the network interactive traffic of the related instructions in the interactive process, generates a group of interactive instructions, and transmits the generated interactive instructions to the enterprise network end. The specific way of generating the interactive instructions is as follows:

[0039] A group of related instructions A is randomly selected from the instruction data, a group of interactive instructions with the same request as the related instructions is generated, and the interactive features of the related instructions A are confirmed;

[0040] If the interaction feature is an interval feature, the network traffic is restricted within the interaction protocol of this interaction instruction so that the value interval generated by the network traffic exceeds the interval associated with the original interval feature (that is, during interaction, the maximum and minimum values ​​of the network traffic offset the feature interval determined by this related instruction), and the interaction instruction after the interaction protocol is changed is transmitted to the enterprise network end for data request;

[0041] If the interaction feature is a waveform feature, network traffic restriction is performed in the interaction protocol of the interaction instruction so that the wavelength of the waveform generated by the network traffic is inconsistent with the wavelength in the original waveform feature, and the interaction instruction after the interaction protocol is changed is transmitted to the enterprise network end for data request;

[0042] Specifically, the method of restricting and modifying network traffic here is generally to change the specified data packets transmitted per unit time, that is, the maximum number of groups of data packets that can be transmitted per unit time in the original interaction characteristics is the minimum number of groups, but here the association change is made, so the interval characteristics are changed accordingly, because the traffic generated by the network interaction is the relevant amount of the transmitted data packets, and changing its interaction protocol is to change the transmission rules in its transmission process;

[0043] The related instructions of the waveform characteristics can be understood as: similar related instructions to linear frequency modulation or phase coding. The interactive protocol of such waveform characteristics is generally more comprehensive, and the waveform characteristics cannot be changed, such as signal characteristics.

[0044] The interactive instruction is the same as the selected related instruction, but the interactive protocol of the interactive instruction has been tampered with. When the enterprise network receives the interactive instruction, it will match it with the related instructions stored in the instruction database, select the related instruction A, and then identify whether the interactive instruction is abnormal based on the interactive characteristics of the related instruction A. If an abnormality is identified, an interception instruction will be sent to the firewall to intercept the interactive instruction and the generated interactive data. If no abnormality is identified, it means that there is a problem with the network security protection of the enterprise network.

[0045] This part of the process is mainly aimed at the specific evaluation of network security protection. By generating a set of recognized related instructions with network traffic problems, the network security end is tested to determine whether the network security end can normally identify the anomalies of the related instructions.

[0046] The interactive feedback confirmation end identifies whether the enterprise network end sends an interception signal with the interactive instruction to the firewall:

[0047] If there is an interception signal, the enterprise network terminal will be marked as the terminal that meets the initial test standards;

[0048] If there is no interception signal, the enterprise network end will be marked as the end that does not meet the initial test standards, and will be displayed in an associated manner through the display end.

[0049] For the determined initial test standard-compliant end, the subsequent associated time difference confirmation end confirms the instruction recognition processing time difference of this initial test standard-compliant end one by one, determines the associated time difference interval belonging to this initial test standard-compliant end from the past historical data, and checks the determined associated time difference interval with the preset standard value to determine whether the time difference of this initial test standard-compliant end meets the standard (the so-called delay standard is whether the delay of this network end is too long. If it is too long, when encountering uninterrupted network attacks, it will cause the network end to crash, so it is necessary to confirm whether its delay meets the standard);

[0050] The specific methods for verification are as follows:

[0051] Determine from the historical completion data the several groups of abnormal instructions intercepted by the initial test compliance end (after the relevant instructions are intercepted, they will be automatically marked as abnormal instructions), and then identify from the interception data associated with the several groups of abnormal instructions the specific time difference between when the initial test compliance end receives the abnormal instruction and when the interception signal is generated, the time difference = when the interception signal is generated - when the abnormal instruction is received, based on the several groups of time differences corresponding to the several groups of abnormal instructions, determine the minimum value and the maximum value, and determine the associated time difference interval [Smin, Smax] of the initial test compliance end, Smin is the minimum time difference, and Smax is the maximum time difference;

[0052] This associated time difference interval [Smin, Smax] is checked with the preset standard value Bz, where the standard value Bz is the preset duration parameter, which is confirmed from a large number of uninterrupted attack viruses in the past. Bz is the associated uninterrupted attack virus with the shortest interval duration:

[0053] If Smax<Bz, the end that meets the initial test standard is directly marked as a high-security end and displayed directly through the display end, which means that after the associated time difference is confirmed, the maximum delay generated is smaller than the standard value Bz, so there will be no problem when such network parties perform security protection;

[0054] If Smin≤Bz≤Smax, the initial test-compliant end is calibrated as the delay-to-be-tested end, and the subsequent virus empty packet test end is executed for delay test to assess whether the delay-to-be-tested end meets the time difference delay test standard;

[0055] If Bz<Smin, the end that meets the initial test standards will be marked as a high-risk end and displayed directly through the display end. The relevant operators need to check the security behaviors of this network end one by one for the determined high-risk end. If there are no relevant problems with the network security behavior, the computing power of this network end and the CPU occupancy during interception processing will be directly checked. When the corresponding network end has insufficient computing power or too high CPU occupancy, a large delay will also occur. Example

[0056] In the specific implementation process of this embodiment, compared with embodiment 1, this embodiment 1 is mainly aimed at further testing of network security protection evaluation. Embodiment 1 is a complete test of network protection evaluation. Through the complete test of embodiment 1, it can be identified whether the enterprise network security meets the standard. In order to achieve further testing effect, this embodiment further tests the relevant delay of the network security party, and its specific execution end is the virus empty packet test end and the process intervention analysis end;

[0057] The virus empty packet test end generates a set of virus empty packets based on the calibrated delay test party, and controls the virus empty packets to be sent to the enterprise network end, and evaluates whether the delay test of the enterprise network end meets the standard based on the corresponding interception time of the enterprise network end. The specific method of conducting the test is as follows:

[0058] Based on the relevant characteristics of any set of virus data in the past, a group of virus empty packets are randomly generated (such virus empty packets are not recognized by the enterprise network end, so when no comparison results are found after receiving them, they will be directly intercepted), and the virus empty packets are controlled to be sent to the enterprise network end at a certain interval. This time period is Bz or other values, and other values ​​are greater than Bz. When the virus empty packet is sent, its sending time is recorded, and then the time when the enterprise network end generates the interception signal is recorded. Based on the time difference between the sending time and the generation time, the associated time difference Sz corresponding to this virus empty packet is locked. k , where k=1, 2, ..., n, where n represents the total number of times the virus blank packet is sent. Different batches are virus blank packets sent at different times. When k is 1, it means that this virus blank packet is sent for the first time. When k is 2, it means that this virus blank packet is sent for the second time. ..., when k is n, it means that this virus blank packet is sent for the last time.

[0059] According to the relationship of k value from small to large, generate its associated time difference sequence {Sz1, Sz2, ..., Sz n}, using CL = (Sz1-Sz2) + (Sz2-Sz3) + ... (Sz n-1 -Sz n ) Lock the associated evaluation value CL. If CL is less than 0, it means that the delay test party has failed the test. Its delay gradually increases with the increase in the number of virus empty packets. There is no better waiting treatment measure to carry out advance processing to avoid crash. If the delay test party that failed the test still encounters this situation in the future, it is very likely to crash. Therefore, this delay test party is marked as a delay non-standard party, and the abnormal cause analysis is performed based on the process intervention analysis end;

[0060] If CL≥0, it means that the delay test party has been tested successfully, and its delay has not gradually increased with the increase in the number of virus empty packets. The delay test party is marked as the delay standard party and is directly displayed on the display terminal;

[0061] The reason why delay testing is performed here is because of the uncertainty of delay. Since the determined time difference interval is: Smin≤Bz≤Smax, in order to identify the delay reliability of the corresponding network end, the above method can be used to effectively identify whether the delay is reliable, so as to achieve better network security testing results, and the test effect is more comprehensive.

[0062] The process intervention analysis end identifies the CPU utilization associated with each interception processing process of the virus empty packet test end. By specifically identifying the CPU utilization decline process, it is assessed whether the delay failure has an uneven computing power distribution problem, and relevant displays are made in a timely manner to facilitate subsequent network security personnel to conduct specific security debugging.

[0063] The specific evaluation methods are as follows:

[0064] Determine whether the next batch of virus empty packets are received during the corresponding interception processing process period of the virus empty packets (that is, the next batch of virus empty packets arrive before the previous processing process is completed). If so, mark this interception processing process as a pending process. If not, do not mark it.

[0065] Identify the CPU utilization correlation curve related to the process to be processed (when there are related processes, they will occupy the related CPU, thus directly generating the corresponding utilization correlation curve), and based on the entry time of the next batch of virus empty packets, lock the same time in the CPU utilization correlation curve, and use the time period between the same time and the subsequent adjacent time as the selected time period, and select part of the curve segment from the CPU utilization correlation curve based on the selected time period;

[0066] For each different CPU utilization correlation curve, the corresponding partial curve segment is selected;

[0067] Identify and confirm whether the selected groups of partial curve segments have consistent change trends (the so-called change trend is the value change between points, which can also be understood as the slope). If they are consistent, it means that the computing power distribution of this party that does not meet the delay standard is uniform, and there is no problem of uneven computing power distribution. Then, a computing power distribution uniformity signal belonging to this party that does not meet the delay standard is generated and displayed through the display terminal for external relevant personnel to view;

[0068] If they are not consistent, it means that the computing power distribution of the party that does not meet the delay standard is uneven, and there is a problem of uneven computing power distribution. Then a computing power uneven distribution signal belonging to the party that does not meet the delay standard is generated and displayed on the display end. Subsequently, relevant network personnel directly conduct a computing power distribution test on the party that does not meet the delay standard based on this computing power uneven distribution signal, and make related modifications, which can further speed up the processing of network problems. It can not only achieve the overall effect of network security assessment, but also achieve specific identification of network problems and signal display, which is convenient for the corresponding network personnel to handle and solve problems in time.

[0069] Some of the data in the above formulas are dimensionless and numerically calculated. Meanwhile, the contents not described in detail in this specification belong to the prior art known to those skilled in the art.

[0070] The above embodiments are only used to illustrate the technical method of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical method of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical method of the present invention.

Claims

1. An enterprise security risk assessment system based on big data, characterized in that: include: The instruction database is a pre-stored instruction library on the enterprise network side, which stores a large number of different recognized related instructions, and each different related instruction has a preset interaction feature, and its interaction feature includes an interval feature or a waveform feature; The abnormal instruction generating end randomly selects a group of related instructions from the instruction database, and based on the interactive characteristics of the related instructions, performs protocol changes on the network interactive traffic of the related instructions during the interactive process, generates a group of interactive instructions, and transmits the generated interactive instructions to the enterprise network end; The interactive feedback confirmation end identifies whether the enterprise network end sends an interception signal with the interactive instruction to the firewall, and determines the initial test qualified end based on the identification result; The associated time difference confirmation end confirms the processing time differences of the initial test standard-compliant end one by one, determines the associated time difference interval belonging to this initial test standard-compliant end from the past historical data, and checks the determined associated time difference interval with the preset standard value to determine whether the time difference of this initial test standard-compliant end meets the standard; The virus empty packet test end generates a group of virus empty packets based on the calibrated delay test party, and controls the virus empty packets to be sent to the enterprise network end, and evaluates whether the delay test of the enterprise network end meets the standard based on the corresponding interception time of the enterprise network end; At the process intervention analysis end, based on each interception processing process at the virus empty packet test end, the CPU utilization associated with each processing process is identified. By specifically identifying the process of CPU utilization decline, it is assessed whether there is an uneven distribution of computing power for the party whose delay does not meet the standard.

2. According to the enterprise security risk assessment system based on big data in claim 1, it is characterized in that: The interval feature is a specified numerical interval, the waveform feature is a regular waveform of a specified wavelength, and the relevant instructions and preset interaction features are all prepared in advance by network personnel based on the associated features of the corresponding instructions.

3. According to the enterprise security risk assessment system based on big data in claim 2, it is characterized in that: The specific method of generating the interaction instruction at the abnormal instruction generating end is as follows: A group of related instructions are randomly selected from the instruction data, and then a group of interactive instructions with the same request as the related instructions are generated, and the interactive features of the related instructions A are confirmed; If the interaction feature is an interval feature, the network traffic is restricted in the interaction protocol of this interaction instruction so that the value interval generated by the network traffic exceeds the interval associated with the original interval feature, and the interaction instruction after the interaction protocol is changed is transmitted to the enterprise network end for data request; If the interaction feature is a waveform feature, network traffic restriction is performed within the interaction protocol of this interaction instruction so that the wavelength of the waveform generated by this network traffic is inconsistent with the wavelength in the original waveform feature, and the interaction instruction after the interaction protocol is changed is transmitted to the enterprise network end for data request.

4. According to the enterprise security risk assessment system based on big data in claim 1, it is characterized in that: The specific method for the interactive feedback confirmation end to determine the initial test qualified end is: If there is an interception signal, the enterprise network terminal will be marked as the terminal that meets the initial test standards; If there is no interception signal, the enterprise network end will be marked as the end that does not meet the initial test standards, and will be displayed in an associated manner through the display end.

5. According to the enterprise security risk assessment system based on big data in claim 1, it is characterized in that: The specific method of the associated time difference confirmation terminal to determine whether the time difference of the initial test standard-compliant terminal meets the standard is: Determine the several groups of abnormal instructions intercepted by the initial test standard-reaching end from the historical completion data, and then identify the specific time difference between when the initial test standard-reaching end receives the abnormal instruction and when the interception signal is generated from the interception data associated with the several groups of abnormal instructions, and determine the minimum value and the maximum value based on the several groups of time differences corresponding to the several groups of abnormal instructions, and determine the associated time difference interval [Smin, Smax] of the initial test standard-reaching end; This associated time difference interval [Smin, Smax] is checked against the preset standard value Bz, which is the preset duration parameter: If Smax<Bz, the terminal that meets the initial test standards is directly marked as a high-security terminal and displayed directly through the display terminal; If Smin≤Bz≤Smax, the initial test-compliant end is calibrated as the delay test party, and the subsequent virus empty packet test end is executed for delay test to assess whether the delay test of the delay test party meets the standard; If Bz<Smin, the end that meets the initial test standards will be marked as a high-risk end and displayed directly through the display end.

6. The enterprise security risk assessment system based on big data according to claim 5 is characterized in that: The virus empty packet test end evaluates whether the delay test of the delay party meets the standard in the specific manner as follows: Based on the relevant characteristics of any set of virus data in the past, a set of virus empty packets is randomly generated, and the virus empty packets are controlled to be sent to the enterprise network end at a certain interval. This time period is Bz or other values, and other values ​​are greater than Bz. When the virus empty packet is sent, its sending time is recorded, and then the time when the enterprise network end generates the interception signal is recorded. Based on the time difference between the sending time and the generation time, the associated time difference Sz corresponding to this virus empty packet is locked. k , where k = 1, 2, ..., n, where n represents the total number of times the virus empty packets are sent; According to the relationship of k value from small to large, generate its associated time difference sequence {Sz1, Sz2, ..., Sz n }, using CL = (Sz1-Sz2) + (Sz2-Sz3) + ... (Sz n-1 -Sz n )Lock the associated evaluation value CL. If CL is less than 0, the delay party to be tested is marked as the party that fails to meet the delay standard, and the abnormal cause analysis is performed based on the process intervention analysis end; If CL≥0, the party to be tested will be marked as the party that meets the delay standard and will be displayed directly on the display terminal.

7. The enterprise security risk assessment system based on big data according to claim 6 is characterized in that: The specific method for the process intervention analysis end to assess whether the party whose delay does not meet the standard has uneven computing power distribution is: Determine whether the next batch of virus-free packets is received during the corresponding interception processing process period of the virus-free packets: if so, mark such interception processing process as a process to be processed; if not, do not perform any marking; Identify the CPU utilization correlation curve related to the process to be processed, and based on the entry time of the next batch of virus empty packets, lock the same time on the CPU utilization correlation curve, and use the period between the same time and the subsequent adjacent time as the selected period, and select part of the curve segment from the CPU utilization correlation curve based on the selected period; For each different CPU utilization correlation curve, the corresponding partial curve segment is selected; Identify and confirm whether the selected groups of partial curve segments have consistent change trends. If they are consistent, it means that the computing power distribution of this party that does not meet the delay standard is uniform, and directly generate a computing power distribution uniformity signal belonging to this party that does not meet the delay standard, and display it through the display terminal; If they are not consistent, it means that the computing power distribution of the party that does not meet the delay standard is uneven, and a computing power uneven distribution signal belonging to the party that does not meet the delay standard is directly generated and displayed through the display terminal.

Images