Computer network information security control system

Abstract

The invention discloses a computer network information security control system, which relates to the technical field of network information security, and comprises a central processing unit, and a data receiving module, a storage module, a data processing module, a security detection module and a control execution module which are connected with the central processing unit, the safety detection module comprises an anomaly detection unit, a behavior mode detection unit and a risk assessment unit, the control execution module is used for executing safety control measures according to a detection result of the safety detection module, and the risk assessment unit can be used for comprehensively assessing network data in combination with an anomaly score AS, a matching score MS and other factors, so that the safety of the network data is improved. The network security risk assessment is more sufficient and comprehensive, complex network attack behaviors can be effectively handled, and the control execution module executes security control measures according to the comprehensive assessment result, so that the dependence on manpower is reduced, and the response efficiency is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of network information security, in particular to a computer network information security control system. Background Art

[0002] With the rapid development and popularization of computer networks, network security issues have become increasingly prominent. Network attack methods are constantly being updated. Hackers use loopholes, malware and other means to steal sensitive information and disrupt the normal operation of the system, causing huge economic losses and security risks to enterprises and individuals. At the same time, with the widespread application of technologies such as cloud computing, big data, and the Internet of Things, the network environment has become more complex and changeable, and network security issues have become more difficult to deal with.

[0003] The traditional approach is to add security measures such as antivirus software and firewalls to computers to protect them, which is prone to loopholes, and the information between various security measures is often independent and lacks comprehensive analysis. This may lead to insufficient assessment of complex attack patterns or multi-level threats, making it difficult to effectively respond to complex network attacks, relying more on manual judgment in the decision-making process, and having low response efficiency when facing complex or high-risk events. Summary of the invention

[0004] The purpose of the present invention is to provide a computer network information security control system, which solves the problems raised in the above background technology.

[0005] To achieve the above object, the present invention provides the following technical solutions: A computer network information security control system, comprising a central processing unit and a data receiving module, a storage module, a data processing module, a security detection module and a control execution module connected to the central processing unit;

[0006] The data receiving module is used to collect all network data in the computer network transmission channel, the data processing module is used to process the collected network data, the data processing module includes a filtering unit, an amplification unit and a logarithmic unit, which are used to improve the quality of network data, and the storage module is used to store network data, and the storage module includes a security behavior pattern library;

[0007] The security detection module includes an anomaly detection unit, a behavior pattern detection unit and a risk assessment unit, which are used to perform security detection on the processed network data, wherein the anomaly detection unit is used to assess the anomaly score AS of the network data, the behavior pattern detection unit matches the network data with the security behavior pattern library to obtain a matching score MS, and the risk assessment unit is used to perform a comprehensive assessment on the network data in combination with the anomaly score AS and the matching score MS to obtain a comprehensive risk score RS;

[0008] The control execution module includes an interception unit, an alarm unit and a recording unit. The control execution module is used to execute safety control measures according to the detection results of the safety detection module.

[0009] Optionally, the security behavior pattern library includes user behavior patterns, system behavior patterns, application behavior patterns and security event patterns.

[0010] Optionally, the anomaly detection unit anomaly score evaluation process is as follows:

[0011]

[0012] Where AS is the anomaly score;

[0013] cur flow is the flow rate in the current time window;

[0014] avg flow is the average flow rate in a day;

[0015] std flow is the standard deviation of flow within a day;

[0016] T fac is the time influence coefficient, ranging from 0 to 1;

[0017] D fac is the source-destination influence coefficient, ranging from 0 to 1;

[0018] By calculating the mean and standard deviation of network traffic, we can effectively capture abnormal fluctuations in network traffic and reduce the false alarm rate. We can also consider the volatility, time factors, and source-destination factors of network traffic to assess the degree of traffic anomaly. This can adapt to the periodic changes in network data and improve the sensitivity of anomaly detection.

[0019] Optionally, the behavior pattern detection unit evaluates the matching score MS of the network data, and the specific process is as follows:

[0020]

[0021] Where MS is the matching score;

[0022] n is the total number of known safe behavior patterns;

[0023] Similarity i is the similarity between the current network data and the i-th known security behavior pattern, and the similarity value ranges from 0 to 1;

[0024] W i Similarity i The weight, W iThe initial value is 0.9;

[0025] is the deviation value of the current network data frequency;

[0026] Among them, F curren is the frequency of occurrence of current network data within a day;

[0027] F pattern is the mean of the historical frequencies;

[0028] σ pattern is the standard deviation of the historical frequency;

[0029] By comparing the similarity between the current network data behavior and the known security mode, it is possible to accurately identify whether there is abnormal or malicious behavior, improve the accuracy of detection, and use the known security mode to learn from past security experience and set W i The pertinence of the behavior pattern detection unit can be improved by By calculating the deviation value of the current network data frequency, the matching score MS can be dynamically adjusted according to the occurrence frequency of the current network data, thereby improving the accuracy of the matching score MS.

[0030] Optionally, the risk assessment unit is used to assess the comprehensive risk score RS, and the specific process is as follows:

[0031]

[0032] Where RS is the comprehensive risk score;

[0033] AS is the abnormality score;

[0034] MS is the matching score;

[0035] M1 is the weight of the anomaly score, and M2 is the weight of the matching score;

[0036] is the system vulnerability value;

[0037] V is the current number of vulnerabilities in the system;

[0038] V max is the maximum number of system vulnerabilities;

[0039] M3 is the weight of the system vulnerability value;

[0040] Set the thresholds T1 and T2 of the comprehensive risk score RS. When RS≤T1, it is a low risk; when T1<RS≤T2, it is a medium risk; when RS is greater than T2, it is a high risk. The corresponding security measures are triggered according to the security level.

[0041] The comprehensive risk score RS ensures the comprehensiveness of the assessment by combining the anomaly score AS, matching score MS and system vulnerability value. It also reduces manual intervention and improves security control efficiency by setting clear thresholds and triggering corresponding security measures according to security levels.

[0042] When T1<RS≤T2 is medium risk, the W in the matching score MS i The specific process is as follows:

[0043]

[0044] By matching the W in the score MS according to the data of the comprehensive risk score RS i The impact enables the network information security control system to be adjusted in real time according to the specific environment, further improving the accuracy of network data detection and improving the quality of security control.

[0045] Optionally, the filtering unit is used to remove noise and interference in the data through LC circuit filtering to improve the quality of network data, the amplification unit uses an operational amplifier device to amplify the data signal, and the logarithmic unit is used to perform logarithmic processing on the data to facilitate subsequent signal analysis and identification.

[0046] Optionally, the interception unit is used to intercept and block network data, the alarm unit is used to issue an alarm to remind management personnel to handle it, and the recording unit is used to record all security events and processing processes to provide a basis for subsequent security audits and analysis.

[0047] Optionally, the storage module includes main body storage and cloud storage, and the main body storage adopts a mechanical hard disk.

[0048] Compared with the prior art, the present invention has the following beneficial effects:

[0049] 1. The present invention performs statistical analysis on network data through the anomaly detection unit in the security detection module to obtain an anomaly score AS. By calculating the average value and standard deviation of network traffic, it can effectively capture abnormal fluctuations in network traffic and reduce the false alarm rate. The statistical analysis can process normal fluctuations in traffic data and more accurately identify abnormal traffic. The current network data is then matched with the security behavior pattern library through the behavior pattern detection unit to obtain a matching score MS. By comparing the similarity between the network data and the known security pattern, it can accurately determine whether there is an anomaly. Using the known security pattern, it can draw on past security experience. By calculating the deviation value of the current network data frequency, the matching score MS is dynamically adjusted according to the frequency of occurrence of the current network data to adapt to the ever-changing security threats, thereby improving the accuracy of security detection.

[0050] 2. The present invention can use the risk assessment unit to comprehensively evaluate network data by combining the anomaly score AS, the matching score MS and the system vulnerability value to obtain a comprehensive risk score RS, so that the assessment of network security risks is more comprehensive and can effectively respond to complex network attack behaviors. The comprehensive risk score RS is divided into different levels by setting a threshold, and the control execution module is used to execute corresponding security control measures according to the different levels of the comprehensive risk score RS, thereby reducing dependence on manual labor and improving the response efficiency to security risk events. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 It is a module block diagram of the present invention;

[0052] Figure 2 This is a block diagram of the safety detection module of the present invention. DETAILED DESCRIPTION

[0053] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0054] For example, see Figure 1 to Figure 2 ,This implementation provides a computer network information security control system, including a central processor, a data receiving module, a storage module, a data processing module, a security detection module and a control execution module;

[0055] The data receiving module is used to collect all data in the computer network transmission channel, the data processing module is used to process the collected data, the data processing module includes a filtering unit, an amplification unit and a logarithmic unit, which are used to improve the data quality, and the storage module is used to store data, and the storage module includes a security behavior pattern library;

[0056] The security behavior pattern library includes user behavior patterns, system behavior patterns, application behavior patterns, and security event patterns;

[0057] Specifically, user behavior patterns include login behavior, operating habits, and access rights; system behavior patterns include resource usage, processes and services, and network activities; application behavior patterns include API calls and abnormal behaviors; and security event patterns include malware behaviors and vulnerability exploit behaviors.

[0058] Setting up a security behavior pattern library can record and analyze various known and potential threat behavior patterns, including viruses, hacker attacks, etc. By comparing the collected network data behavior with the patterns recorded in the library, the system can accurately identify threat behaviors and take corresponding defense measures. As new threat behaviors continue to emerge, the security behavior pattern library can be continuously updated and upgraded to ensure that the defense strategy is always kept up to date and effectively respond to new security risk events.

[0059] The security detection module includes an anomaly detection unit, a behavior pattern detection unit and a risk assessment unit, which are used to perform security detection on the processed data, wherein the anomaly detection unit is used to evaluate the anomaly score AS of the network data, the behavior pattern detection unit matches the current network data with the security behavior pattern library to obtain the matching score MS, and the risk assessment unit is used to perform a comprehensive assessment of the network data in combination with the anomaly score AS and the matching score MS to obtain the comprehensive risk score RS;

[0060] The control execution module includes an interception unit, an alarm unit and a recording unit. The control execution module is used to execute security control measures according to the detection results of the security detection module.

[0061] In this embodiment, by setting up a data processing module, the collected network data can be pre-processed to improve the quality of the data itself and the accuracy of subsequent processing. The anomaly detection unit in the security detection module performs statistical analysis on the network data to obtain an anomaly score AS, which can effectively capture abnormal fluctuations in traffic and reduce the false alarm rate. The statistical analysis can handle normal fluctuations in traffic data and more accurately identify abnormal traffic. The current network data is then matched with the security behavior pattern library through the behavior pattern detection unit to obtain a matching score MS. By comparing the similarity between the network data and the known security patterns, it can be accurately determined whether there is an anomaly, thereby improving the accuracy of detection. The anomaly detection unit identifies anomalies at the network traffic level, and the behavior pattern detection unit further analyzes the specific behavior in the abnormal traffic, and deeply analyzes potential security threats from the two dimensions of traffic and behavior.

[0062] Finally, the risk assessment unit can combine the anomaly score AS, matching score MS and other factors to conduct a comprehensive assessment of the network data to obtain a comprehensive risk score RS, and quantify the results, so that risk events can be clearly understood, making the assessment of network security risks more comprehensive and effective in responding to complex network attack behaviors. The control execution module is used to execute security control measures according to the detection results of the security detection module, reduce dependence on manual labor, and improve the response efficiency to security risk events.

[0063] Furthermore, the anomaly detection unit anomaly score evaluation process is as follows:

[0064]

[0065] Where AS is the anomaly score;

[0066] cur flow is the flow rate in the current time window;

[0067] avg flow is the average flow rate in a day;

[0068] std flow is the standard deviation of flow within a day;

[0069] T fac is the time influence coefficient, ranging from 0 to 1;

[0070] D fac is the source-destination influence coefficient, ranging from 0 to 1.

[0071] Specifically, by calculating the mean and standard deviation of network traffic, it is possible to effectively capture abnormal fluctuations in network traffic and reduce the false alarm rate. It also takes into account the volatility of network traffic, time factors, and source-destination factors to evaluate the degree of abnormality in network traffic. At the same time, it dynamically adjusts the weights according to the traffic characteristics during peak hours. This enables the detection mechanism to adapt to periodic changes in network traffic, such as large fluctuations in traffic during peak hours, thereby increasing the sensitivity of anomaly detection. The anomaly detection unit is based on simple statistical calculations, which is easy to integrate with existing network monitoring systems, providing additional traffic anomaly detection capabilities without the need for complex configuration or a large amount of computing resources, thereby improving the efficiency of network data security detection.

[0072] Furthermore, the behavior pattern detection unit evaluates the matching score MS of the network data. The specific process is as follows:

[0073]

[0074] Where MS is the matching score;

[0075] n is the total number of known safe behavior patterns;

[0076] Similarity i is the similarity between the current network data and the i-th known security behavior pattern, and the similarity value ranges from 0 to 1;

[0077] W i Similarity i The weight, W i The initial value is 0.9;

[0078] is the deviation value of the current network data frequency;

[0079] where F curren is the frequency of occurrence of current network data within a day;

[0080] F pattern is the mean of the historical frequencies;

[0081] σ pattern is the standard deviation of the historical frequency;

[0082] Specifically, by comparing the similarity between the current network data behavior and the known security mode, it is possible to accurately identify whether there is abnormal or malicious behavior, improve the accuracy of detection, and use the known security mode to learn from past security experience and set W i It can improve the pertinence of the behavior pattern detection unit and highlight important or high-risk behavior patterns. By calculating the deviation value of the current network data frequency, the matching score MS can be dynamically adjusted according to the occurrence frequency of the current network data to adapt to the ever-changing security threats and improve the accuracy of the matching score MS.

[0083] Furthermore, the risk assessment unit is used to assess the comprehensive risk score RS, and the specific process is as follows:

[0084]

[0085] Where RS is the comprehensive risk score;

[0086] AS is the abnormality score;

[0087] MS is the matching score;

[0088] M1 is the weight of the anomaly score, and M2 is the weight of the matching score;

[0089] is the system vulnerability value;

[0090] V is the current number of vulnerabilities in the system;

[0091] V max is the maximum number of system vulnerabilities;

[0092] M3 is the weight of the system vulnerability value;

[0093] The thresholds T1 and T2 of the comprehensive risk score RS are determined according to the system preset. When RS≤T1, it is a low risk; when T1<RS≤T2, it is a medium risk; when RS is greater than T2, it is a high risk. The corresponding security measures are triggered according to the security level;

[0094] Normal monitoring and recording of computers without intervention at low risk, recording current behavior patterns and traffic data; automatically generating medium-level alarms at medium risk, using control execution modules to remind staff and increase monitoring intensity; automatically generating high-level alarms at high risk, and conducting emergency responses, implementing preset security policies, including isolating suspicious users, blocking abnormal traffic, etc., initiating security investigation procedures, and conducting comprehensive reviews and repairs of the system;

[0095] Specifically, the comprehensive risk score RS is calculated by weighting the comprehensive risk score RS by comprehensively considering the anomaly score AS, matching score MS and system vulnerability value, and quantifying the risk score of each factor. This improves the accuracy of the result, improves the objectivity of the assessment, ensures the comprehensiveness of the assessment, and can provide comprehensive security protection in various situations. It can effectively respond to complex network attack behaviors, and through clear threshold setting and triggering corresponding security measures according to the security level, it reduces manual intervention and enables resources and attention to be focused on high-risk events, thereby more effectively allocating resources and formulating response strategies, thereby improving security control efficiency.

[0096] When T1<RS≤T2 is medium risk, the W in the matching score MS i The specific process is as follows:

[0097]

[0098] Specifically, by matching the W in the matching score MS according to the data of the comprehensive risk score RS i The impact enables the network information security control system to be adjusted in real time according to the specific environment, further improving the accuracy of network data detection and improving the quality of security control.

[0099] Furthermore, the filtering unit is used to remove noise and interference in the data through LC circuit filtering to improve the quality of network data. The amplification unit uses an operational amplifier device to amplify the data signal. The logarithmic unit is used to perform logarithmic processing on the data to facilitate subsequent signal analysis and identification.

[0100] Specifically, the filtering unit can remove noise and interference in the network data, improve the quality of the network data, and enable the network data to more accurately reflect the network status and reduce false alarms and missed alarms. The amplification unit amplifies the signal to ensure that the signal will not be distorted due to attenuation during transmission, which enhances the adaptability and reliability of the signal and enables the computer system to work stably in various network environments. The logarithmic unit performs logarithmic processing on the signal to simplify subsequent signal analysis and identification work. The logarithmic transformation can compress the dynamic range of the signal to a range that is more suitable for processing, while retaining the important characteristics of the signal, saving subsequent processing time, and improving the quality of the data itself and the accuracy and efficiency of subsequent processing by processing the network data.

[0101] Embodiment 2: Based on the above embodiment, the storage module includes main body storage and cloud storage, and the main body storage adopts a mechanical hard disk.

[0102] Specifically, mechanical hard drives can usually provide a large storage capacity and are suitable for storing large amounts of files and data. In addition, as a local storage device, mechanical hard drives can access data without a network connection, reducing the risk of data unavailability due to network failures. Mechanical hard drives have good stability and can effectively protect collected network data. Cloud storage provides data backup and recovery functions, effectively preventing local data loss or damage. The combination of mechanical hard drives and cloud storage can fully utilize the advantages of both, achieve complementarity in capacity and cost, data security, flexibility and scalability, collaborative work and data sharing, and meet user needs.

[0103] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A computer network information security control system, characterized in that: include: A data receiving module is used to collect network data in a computer network transmission channel; A data processing module, used for processing network data, the data processing module comprises a filtering unit, an amplifying unit and a logarithmic unit; A storage module, used for storing network data, wherein the storage module includes a security behavior pattern library; A security detection module is used to perform security detection on the processed network data. The security detection module includes an anomaly detection unit, a behavior pattern detection unit and a risk assessment unit. The anomaly detection unit is used to assess the anomaly score AS of the network data. The behavior pattern detection unit matches the network data with the security behavior pattern library to obtain a matching score MS. The risk assessment unit is used to perform a comprehensive assessment on the network data in combination with the anomaly score AS and the matching score MS to obtain a comprehensive risk score RS. The control execution module is used to execute security control measures according to the detection results of the security detection module. The control execution module includes an interception unit, an alarm unit and a recording unit.

2. The computer network information security control system according to claim 1, characterized in that: The security behavior pattern library includes user behavior patterns, system behavior patterns, application behavior patterns and security event patterns.

3. The computer network information security control system according to claim 2 is characterized in that: The anomaly detection unit anomaly score evaluation formula is as follows: Where AS is the abnormality score; cur flow is the flow rate in the current time window; avg flow is the average flow rate in a day; std flow is the standard deviation of flow rate within a day; T fac is the time influence coefficient, ranging from 0 to 1; D fac is the source-destination influence coefficient, ranging from 0 to 1; Calculate the mean and standard deviation of network traffic to capture abnormal fluctuations in network traffic and reduce the false alarm rate. Consider the volatility, time factors, and source-destination factors of network traffic to assess the degree of traffic anomaly, adapt to the periodic changes of network data, and improve the sensitivity of anomaly detection.

4. The computer network information security control system according to claim 3 is characterized in that: The behavior pattern detection unit evaluates the matching score MS of the network data. The specific formula is as follows: Where MS is the matching score; n is the total number of known safe behavior patterns; Similarity i is the similarity between the current network data and the i-th known security behavior pattern, and the similarity value ranges from 0 to 1; W i Similarity i The weight, W i The initial value is 0.9; is the deviation value of the current network data frequency; where F curren The frequency of occurrence of current network data within a day; F pattern is the mean of the historical frequencies; σ pattern is the standard deviation of the historical frequency; Compare the similarity between the current network data behavior and the known security mode, identify whether there is abnormal or malicious behavior, use the known security mode to learn from past security experience, and set W i Improve the pertinence of the behavior pattern detection unit; The deviation value of the current network data frequency is calculated to dynamically adjust the matching score MS according to the occurrence frequency of the current network data, thereby improving the accuracy of the matching score MS.

5. The computer network information security control system according to claim 4, characterized in that: The risk assessment unit is used to assess the comprehensive risk score RS, and the specific formula is as follows: Where RS is the comprehensive risk score; AS is the abnormality score; MS is the matching score; M1 is the weight of the anomaly score, and M2 is the weight of the matching score; is the system vulnerability value; V is the current number of vulnerabilities in the system; V max is the maximum number of system vulnerabilities; M3 is the weight of the system vulnerability value; Set thresholds T1 and T2 of the comprehensive risk score RS; When RS≤T1, it is a low risk; when T1<RS≤T2, it is a medium risk; when RS is greater than T2, it is a high risk, and corresponding security measures are triggered according to the security level; The comprehensive risk score RS ensures the comprehensiveness of the assessment by combining the anomaly score AS, matching score MS and system vulnerability value. It also reduces manual intervention and improves security control efficiency by setting clear thresholds and triggering corresponding security measures according to security levels. When T1<RS≤T2 is medium risk, the W in the matching score MS i Change, the specific change formula is: According to the data of comprehensive risk score RS, the W in matching score MS i This will affect the network information security control system and make real-time adjustments based on the specific environment, thereby improving the accuracy of network data detection and the quality of security control.

6. The computer network information security control system according to any one of claims 1 to 5, characterized in that: The filtering unit is used to remove noise and interference in the data through LC circuit filtering to improve the quality of network data; The amplification unit amplifies the data signal using an operational amplifier device; The logarithmic unit is used to perform logarithmic processing on the data to facilitate subsequent signal analysis and identification.

7. The computer network information security control system according to any one of claims 1 to 5, characterized in that: The interception unit is used to intercept and block network data; The alarm unit is used to sound an alarm to remind management personnel to handle the situation; The recording unit is used to record security events and processing processes, providing a basis for subsequent security audits and analyses.

8. The computer network information security control system according to any one of claims 1 to 5, characterized in that: The storage module includes main storage and cloud storage, and the main storage adopts a mechanical hard disk.

Images