A computer network information security control system

Abstract

The application discloses a computer network information security control system, and relates to the technical field of network information security, comprising a central processing unit, a data receiving module, a storage module, a data processing module, a security detection module and a control execution module connected with the central processing unit, wherein the storage module comprises a security behavior mode library, the security detection module comprises an abnormality detection unit, a behavior mode detection unit and a risk assessment unit, and the control execution module is used for executing security control measures according to the detection results of the security detection module, can combine abnormality score AS, matching score MS and other factors to comprehensively evaluate network data through the risk assessment unit, so that the evaluation of network security risks is more sufficient and comprehensive, complex network attack behaviors can be effectively responded to, and the control execution module is used for executing security control measures according to the comprehensive evaluation results, reducing the dependence on manual operation and improving the response efficiency.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network information security, and particularly to a computer network information security control system. BACKGROUND

[0002] With the rapid development and popularization of computer networks, network security problems have become increasingly prominent. Network attack methods are constantly being updated, and hackers use vulnerabilities, malware, and other means to steal sensitive information and disrupt the normal operation of systems, causing huge economic losses and security risks to enterprises and individuals. At the same time, with the widespread application of cloud computing, big data, the Internet of Things, and other technologies, the network environment has become more complex and variable, and network security problems are more difficult to deal with.

[0003] The traditional approach is to add antivirus software and firewalls and other security measures to protect computers, which is prone to vulnerabilities, and the information between various security measures is often independent and lacks comprehensive analysis. This can lead to inadequate assessment of complex attack patterns or multi-level threats, making it difficult to effectively respond to complex network attack behavior, and relying more on manual judgment in the decision-making process. In the face of complex or high-risk events, the response efficiency is low. SUMMARY

[0004] The present application aims to provide a computer network information security control system that solves the problems raised in the background art.

[0005] To achieve the above object, the present application provides the following technical solution: a computer network information security control system, comprising a central processor and a data receiving module, a storage module, a data processing module, a security detection module, and a control execution module connected to the central processor;

[0006] The data receiving module is used to collect all network data in the computer network transmission channel, the data processing module is used to process the collected network data, the data processing module comprises a filtering unit, an amplification unit, and a logarithmic unit for improving the quality of network data, and the storage module is used to store network data, and the storage module comprises a security behavior pattern library;

[0007] The security detection module comprises an anomaly detection unit, a behavior pattern detection unit, and a risk assessment unit for security detection of the processed network data, wherein the anomaly detection unit is used to evaluate the anomaly score AS of the network data, the behavior pattern detection unit matches the network data with the security behavior pattern library to obtain the matching score MS, and the risk assessment unit is used to comprehensively evaluate the network data in combination with the anomaly score AS and the matching score MS to obtain the comprehensive risk score RS;

[0008] The control execution module comprises an intercepting unit, an alarming unit and a recording unit, and is configured to execute a security control measure according to the detection result of the security detection module.

[0009] Optionally, the security behavior pattern library comprises a user behavior pattern, a system behavior pattern, an application program behavior pattern and a security event pattern.

[0010] Optionally, the abnormality detection unit abnormality score evaluation process is as follows:

[0011]

[0012] wherein AS is an abnormality score;

[0013] cur flow is the traffic in a current time window;

[0014] avg flow is the average traffic in a day;

[0015] std flow is the standard deviation of the traffic in a day;

[0016] T fac is a time influence coefficient, and the value range is 0 to 1;

[0017] D fac is a source-destination influence coefficient, and the value range is 0 to 1;

[0018] By calculating the average and standard deviation of the network traffic, the abnormal fluctuation of the network traffic can be effectively captured, the false positive rate is reduced, the fluctuation of the network traffic, the time factor and the source-destination factor are considered to evaluate the abnormality degree of the traffic, the periodic change of the network data can be adapted, and the sensitivity of the abnormality detection is improved.

[0019] Optionally, the behavior pattern detection unit evaluates a matching score MS of the network data, and the specific process is as follows:

[0020]

[0021] wherein MS is a matching score;

[0022] n is the total number of known security behavior patterns;

[0023] Similarity i is the similarity between the current network data and the i-th known security behavior pattern, and the value range of the similarity is 0 to 1;

[0024] W i is the weight of Similarity i , and W iThe initial value is 0.9;

[0025] is the deviation value of the current network data frequency;

[0026] Where F curren is the occurrence frequency of the current network data within a day;

[0027] F pattern is the mean value of the historical frequency;

[0028] σ pattern is the standard deviation of the historical frequency;

[0029] By comparing the similarity of the current network data behavior and the known safe mode, it can accurately identify whether there is abnormal or malicious behavior, improve the accuracy of detection, use the known safe mode, can learn from the past safety experience, and set W i The behavior mode detection unit can be improved in pertinence, by The deviation value of the current network data frequency can be calculated, which can dynamically adjust the matching score MS according to the occurrence frequency of the current network data, and improve the accuracy of the matching score MS.

[0030] Optionally, the risk assessment unit is used to assess the comprehensive risk score RS, and the specific process is as follows:

[0031]

[0032] Where RS is the comprehensive risk score;

[0033] AS is the abnormal score;

[0034] MS is the matching score;

[0035] M1 is the weight of the abnormal score, and M2 is the weight of the matching score;

[0036] is the system vulnerability value;

[0037] V is the current number of system vulnerabilities;

[0038] V max is the maximum number of system vulnerabilities;

[0039] M3 is the weight of the system vulnerability value;

[0040] Set the threshold T1 and T2 of the comprehensive risk score RS, when RS≤T1, it is low risk, when T1

[0041] The comprehensive risk score RS ensures the comprehensiveness of the evaluation by integrating the abnormal score AS, the matching score MS and the system vulnerability value, and reduces the manual intervention and improves the safety control efficiency by setting the explicit threshold and triggering the corresponding safety measures according to the security level.

[0042] When T1 < RS < T2, it is a medium risk, and W in the matching score MS is i Changes, the specific process is:

[0043]

[0044] According to the data of the comprehensive risk score RS, W in the matching score MS is i The network information security control system can be adjusted in real time according to the specific environment, and the accuracy of network data detection is further improved, and the safety control quality is improved.

[0045] Optionally, the filtering unit is used for filtering the noise and interference in the data by LC circuit filtering means, improving the quality of network data, and the amplification unit uses an operational amplifier device to amplify the data signal, and the logarithmic unit is used for logarithmic processing of the data, facilitating subsequent signal analysis and identification.

[0046] Optionally, the interception unit is used for intercepting and blocking the network data, the alarm unit is used for issuing an alarm to remind the management personnel to process, and the recording unit is used for recording all security events and processing processes to provide a basis for subsequent security audit and analysis.

[0047] Optionally, the storage module includes a body storage and a cloud storage, and the body storage adopts a mechanical hard disk.

[0048] Compared with the prior art, the present application has the following advantages:

[0049] Firstly, the abnormal detection unit in the safety detection module statistically analyzes the network data to obtain the abnormal score AS, and by calculating the average value and the standard deviation of the network flow, the abnormal fluctuation of the network flow can be effectively captured, the abnormal fluctuation of the flow can be effectively captured, the false positive rate is reduced, the statistical analysis can process the normal fluctuation in the flow data, and the abnormal flow can be more accurately identified, then the current network data is matched with the security behavior mode library by the behavior mode detection unit to obtain the matching score MS, by comparing the similarity between the network data and the known security mode, whether there is an abnormality can be accurately judged, the known security mode can be used to learn from the past security experience, and by calculating the deviation value of the current network data frequency, the matching score MS is dynamically adjusted according to the appearance frequency of the current network data, so as to adapt to the changing security threat, thereby improving the accuracy of safety detection.

[0050] Secondly, the application can comprehensively evaluate network data by combining abnormal score AS, matching score MS and system vulnerability value through the risk evaluation unit to obtain comprehensive risk score RS, so that the evaluation of network security risk is more sufficient and comprehensive, and complex network attack behaviors can be effectively responded to, the comprehensive risk score RS is divided into different levels by setting threshold value, and the control execution module is used to execute corresponding security control measures according to different levels of the comprehensive risk score RS, the dependence on manual is reduced, and the response efficiency to security risk events is improved. BRIEF DESCRIPTION OF DRAWINGS

[0051] Fig. 1 The module block diagram of the application is shown in the figure;

[0052] Fig. 2 The security detection module block diagram of the application is shown in the figure. DETAILED DESCRIPTION

[0053] The technical solutions in the embodiments of the application will be clearly and completely described below with reference to the drawings in the embodiments of the application. Obviously, the described embodiments are only part of the embodiments of the application, rather than all the embodiments of the application. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative work fall within the protection scope of the application.

[0054] Embodiment one, please refer to Figs. 1-2 The embodiment provides a computer network information security control system, which comprises a central processor, a data receiving module, a storage module, a data processing module, a security detection module and a control execution module.

[0055] The data receiving module is used for collecting all data in a computer network transmission channel, the data processing module is used for processing the collected data, the data processing module comprises a filtering unit, an amplifying unit and a logarithm unit, and is used for improving data quality, the storage module is used for storing data, and the storage module comprises a security behavior pattern library.

[0056] The security behavior pattern library comprises user behavior patterns, system behavior patterns, application program behavior patterns and security event patterns.

[0057] Specifically, the user behavior patterns comprise login behaviors, operation habits and access permissions, the system behavior patterns comprise resource usage, processes and services and network activities, the application program behavior patterns comprise API calls and abnormal behaviors, and the security event patterns comprise malicious software behaviors and vulnerability exploitation behaviors.

[0058] The security behavior mode library can record and analyze various known and potential threat behavior modes, including viruses, hacker attacks, etc. By comparing the collected network data behavior with the recorded modes in the library, the system can accurately identify the threat behavior and take corresponding defense measures. As new threat behaviors continue to appear, the security behavior mode library can be continuously updated and upgraded to ensure that the defense strategy always remains up-to-date and effectively responds to new security risk events

[0059] The security detection module includes an anomaly detection unit, a behavior pattern detection unit, and a risk assessment unit for security detection of the processed data. The anomaly detection unit is used to evaluate the anomaly score AS of the network data. The behavior pattern detection unit matches the current network data with the security behavior mode library to obtain the matching score MS. The risk assessment unit is used to combine the anomaly score AS and the matching score MS for comprehensive evaluation of the network data to obtain the comprehensive risk score RS.

[0060] The control execution module includes an interception unit, an alarm unit, and a recording unit for executing security control measures according to the detection results of the security detection module.

[0061] In this embodiment, the data processing module is set to pre-process the collected network data, improve the quality of the data itself, and improve the accuracy of subsequent processing. The anomaly detection unit in the security detection module performs statistical analysis on the network data to obtain the anomaly score AS, which can effectively capture the abnormal fluctuations of traffic and reduce the false positive rate. Statistical analysis can handle normal fluctuations in traffic data and more accurately identify abnormal traffic. The behavior pattern detection unit matches the current network data with the security behavior mode library to obtain the matching score MS. By comparing the similarity of the network data with known security patterns, it can accurately determine whether there is an anomaly, thereby improving the accuracy of detection. The anomaly detection unit identifies the level of network traffic anomalies, and the behavior pattern detection unit further analyzes the specific behavior of abnormal traffic from two dimensions of traffic and behavior to deeply analyze potential security threats.

[0062] Finally, the risk assessment unit can combine the anomaly score AS, the matching score MS, and other factors to comprehensively evaluate the network data and obtain the comprehensive risk score RS. The results are quantified to clearly understand the risk events, making the assessment of network security risks more comprehensive and effective in responding to complex network attack behaviors. The control execution module is used to execute security control measures according to the detection results of the security detection module, reducing the dependence on manual intervention and improving the response efficiency to security risk events.

[0063] Further, the anomaly detection unit anomaly score evaluation process is as follows:

[0064]

[0065] wherein AS is the anomaly score;

[0066] cur flow is the current traffic within the time window;

[0067] avg flow is the average traffic within the day;

[0068] std flow is the standard deviation of the traffic within the day;

[0069] T fac is the time impact coefficient, ranging from 0 to 1;

[0070] D fac is the source-destination impact coefficient, ranging from 0 to 1.

[0071] Specifically, by calculating the average and standard deviation of network traffic, the abnormal fluctuation of network traffic can be effectively captured, the false positive rate is reduced, and the abnormality of network traffic is evaluated considering the volatility of network traffic, time factors and source-destination factors, while the weight is dynamically adjusted according to the traffic characteristics of peak period, which makes the detection mechanism adapt to the periodic changes of network traffic, such as larger traffic fluctuation in peak period, improves the sensitivity of anomaly detection, and the anomaly detection unit is based on simple statistical calculation, which is easy to integrate with existing network monitoring systems, provides additional traffic anomaly detection capability without complex configuration or large amount of computing resources, and improves the security detection efficiency of network data.

[0072] Further, the behavior pattern detection unit evaluates the matching score MS of the network data, and the specific process is as follows:

[0073]

[0074] wherein MS is the matching score;

[0075] n is the total number of known safe behavior patterns;

[0076] Similarity i is the similarity between the current network data and the i-th known safe behavior pattern, and the similarity ranges from 0 to 1;

[0077] W i is the weight of Similarity i , and W i initial value is 0.9;

[0078] is the deviation value of the frequency of the current network data;

[0079] wherein F curren is the frequency of occurrence of the current network data within a day;

[0080] F pattern is the mean of the historical frequency;

[0081] σ pattern is the standard deviation of the historical frequency;

[0082] Specifically, by comparing the similarity of the current network data behavior and the known safe mode, it can accurately identify whether there is abnormal or malicious behavior, improve the accuracy of detection, and use the known safe mode to learn from past security experience and set W i The behavior mode detection unit can improve the pertinence, highlight important or high-risk behavior modes, and through By calculating the deviation value of the current network data frequency, the matching score MS can be dynamically adjusted according to the frequency of occurrence of the current network data to adapt to the changing security threats and improve the accuracy of the matching score MS.

[0083] Further, the risk assessment unit is used to assess the comprehensive risk score RS, and the specific process is as follows:

[0084]

[0085] wherein RS is the comprehensive risk score;

[0086] AS is the anomaly score;

[0087] MS is the matching score;

[0088] M1 is the weight of the anomaly score, and M2 is the weight of the matching score;

[0089] is the system vulnerability value;

[0090] V is the current number of system vulnerabilities;

[0091] V max is the maximum number of system vulnerabilities;

[0092] M3 is the weight of the system vulnerability value;

[0093] According to the system preset, the threshold values T1 and T2 of the comprehensive risk score RS are determined, when RS≤T1 is low risk, when T1

[0094] Normal monitoring and recording of the computer at low risk, no intervention, record the current behavior pattern and traffic data, at medium risk, automatically generate a medium level of alarm, use the control execution module to remind the staff, improve the monitoring intensity, at high risk, automatically generate a high level of alarm, and emergency response, implement the preset security policy, including isolating suspicious users, blocking abnormal traffic, etc., start the security investigation program, and comprehensively review and repair the system;

[0095] Specifically, the comprehensive risk score RS is calculated by combining the abnormal score AS, the matching score MS and the system vulnerability value, and quantifying the risk score of each factor, and the comprehensive risk score RS is calculated by weighting, which improves the accuracy of the result and improves the objectivity of the evaluation, ensures the comprehensiveness of the evaluation, can provide comprehensive security protection in various situations, can effectively deal with complex network attack behaviors, and through the setting of clear threshold and triggering of corresponding security measures according to the security level, reduces the manual intervention, and enables resources and attention to be concentrated on high-risk events, thereby more effectively allocating resources and formulating response strategies, and improving the security control efficiency.

[0096] When T1 < RS < T2, it is medium risk, and W i Changes occur, the specific process is:

[0097]

[0098] Specifically, by adjusting W i Cause an impact, so that the network information security control system can be adjusted in real time according to the specific environment, further improving the accuracy of network data detection, and improving the quality of security control.

[0099] Further, the filter unit is used for filtering the noise and interference in the data by means of LC circuit filtering, improving the quality of network data, and the amplification unit is used for amplifying the data signal by using an operational amplifier device, and the logarithmic unit is used for logarithmic processing of the data, facilitating subsequent signal analysis and identification.

[0100] Specifically, the filter unit can remove noise and interference in the network data, improve the quality of the network data, make the network data more accurately reflect the network state, reduce false positives and false negatives, the amplification unit amplifies the signal to ensure that the signal will not be distorted due to attenuation during transmission, which enhances the adaptability and reliability of the signal, so that the computer system can work stably in various network environments, the logarithmic unit processes the signal by logarithm to simplify the subsequent signal analysis and recognition work, through logarithmic transformation, the dynamic range of the signal can be compressed to a more suitable range for processing, while retaining the important characteristics of the signal, saving subsequent processing time, by processing the network data, improving the quality of the data itself, improving the accuracy and efficiency of subsequent processing.

[0101] In the embodiment two, on the basis of the above-mentioned embodiment, the storage module includes a mechanical hard disk and a cloud storage.

[0102] Specifically, the mechanical hard disk can usually provide larger storage capacity, suitable for storing a large amount of files and data, and the mechanical hard disk as a local storage device can access data without network connection, reducing the risk of data unavailability due to network failure, the mechanical hard disk has good stability, can effectively protect the collected network data, and the cloud storage provides data backup and recovery function, effectively preventing local data loss or damage, the combination of mechanical hard disk and cloud storage can make full use of the advantages of both, realize the complementation of capacity and cost, data security, flexibility and scalability, collaborative work and data sharing, etc., meet the user's use demand.

[0103] Although the embodiments of the present application have been shown and described, it can be understood by those skilled in the art that various changes, modifications, replacements and variations can be made to the embodiments without departing from the principles and spirits of the present application, the scope of the present application is defined by the appended claims and their equivalents.

Claims

1. A computer network information security control system, characterized in that, include: The data receiving module is used to collect network data within the computer network transmission channel; A data processing module is used to process network data. The data processing module includes a filtering unit, an amplification unit, and a logarithmic unit. A storage module for storing network data, the storage module including a security behavior pattern library; The security detection module is used to perform security detection on the processed network data. The security detection module includes an anomaly detection unit, a behavior pattern detection unit, and a risk assessment unit. The anomaly detection unit is used to evaluate the anomaly score AS of the network data. The behavior pattern detection unit matches the network data with a security behavior pattern library to obtain a matching score MS. The risk assessment unit is used to combine the anomaly score AS and the matching score MS to perform a comprehensive evaluation of the network data to obtain a comprehensive risk score RS. The control execution module is used to execute security control measures based on the detection results of the security detection module. The control execution module includes an interception unit, an alarm unit, and a recording unit. The anomaly scoring evaluation formula for the anomaly detection unit is as follows: ； Where AS represents the anomaly score; cur flow The flow rate within the current time window; avg flow The average daily flow rate; std flow The standard deviation of daily flow rate; T fac This is the time influence coefficient, with a value ranging from 0 to 1; D fac The source-destination impact coefficient ranges from 0 to 1. The average and standard deviation of network traffic are calculated to capture abnormal fluctuations in network traffic, reduce false alarm rates, and assess the degree of traffic anomalies by considering the volatility, time factors, and source-destination factors of network traffic, adapting to the periodic changes in network data and improving the sensitivity of anomaly detection. The behavior pattern detection unit evaluates the matching score MS of the network data using the following formula: ； MS represents the match score; n is the total number of known safe behavior patterns; Similarity i The similarity between the current network data and the i-th known security behavior pattern is denoted by 0, and the similarity value ranges from 0 to 1. W i For Similarity i The weight, W i The initial value is 0.9; This represents the deviation value of the current network data frequency; Where F curren This represents the frequency of current network data occurrences within a day. F pattern This is the average of historical frequencies; σ pattern The standard deviation of historical frequencies; Compare current network data behavior with known security patterns to identify any abnormal or malicious behavior. Utilize known security patterns to learn from past security experiences and set up W. i Improve the targeting of behavior pattern detection units; Calculate the deviation value of the current network data frequency, and dynamically adjust the matching score MS according to the occurrence frequency of the current network data to improve the accuracy of the matching score MS; The risk assessment unit is used to assess the comprehensive risk score RS, and the specific formula is as follows: ； RS represents the overall risk score; AS indicates an abnormal score; MS stands for match score; M1 is the weight of the outlier score, and M2 is the weight of the match score; This is a system vulnerability value; V represents the current number of vulnerabilities in the system; V max This represents the maximum number of vulnerabilities in the system. M3 represents the weight of the system vulnerability value; Set thresholds T1 and T2 for the comprehensive risk score RS; When RS≤T1, it is considered low risk; when T1<RS≤T2, it is considered medium risk; when RS>T2, it is considered high risk. Corresponding safety measures are triggered based on the safety level. The Comprehensive Risk Score (RS) ensures comprehensiveness of the assessment by combining the Anomaly Score (AS), Matching Score (MS), and System Vulnerability Value. It also reduces manual intervention and improves security control efficiency by setting clear thresholds and triggering corresponding security measures based on the security level. When T1 < RS ≤ T2, it is considered medium risk; the W value in the matching score MS is also considered medium risk. i The specific formula for the change is: ； Based on the data from the comprehensive risk score RS, the W in the matching score MS is analyzed. i This impacts the network information security control device, causing it to adjust in real time according to the specific environment, thereby improving the accuracy of network data detection and the quality of security control.

2. The computer network information security control system according to claim 1, characterized in that: The security behavior pattern library includes user behavior patterns, system behavior patterns, application behavior patterns, and security event patterns.

3. The computer network information security control system according to claim 2, characterized in that: The filtering unit is used to remove noise and interference from the data through LC circuit filtering, thereby improving the quality of network data. The amplification unit uses an operational amplifier to amplify the data signal; The logarithmic unit is used to perform logarithmic processing on the data, which facilitates subsequent signal analysis and recognition.

4. The computer network information security control system according to claim 1, characterized in that: The interception unit is used to intercept and block network data; The alarm unit is used to issue an alarm to remind management personnel to take action; The recording unit is used to record security events and handling processes, providing a basis for subsequent security audits and analyses.

5. The computer network information security control system according to claim 1, characterized in that: The storage module includes physical storage and cloud storage, and the physical storage uses a mechanical hard drive.

Images