A server security monitoring method and system

Abstract

The present invention discloses a server security monitoring method and system, and relates to the technical field of server security monitoring. The server security monitoring method obtains a network performance data set in a monitoring computer system log, and analyzes the network performance data set to obtain a network performance evaluation value; obtains a server anti-intrusion data set in a monitoring computer system log. By analyzing the network performance data and server anti-intrusion data in the computer system log, the server security evaluation is more comprehensive, and potential security risks can be identified. The monitoring frequency can be dynamically adjusted according to the server security level, and the monitoring frequency can be increased during high-risk periods and the monitoring burden can be reduced during low-risk periods, thereby improving the efficiency of resource utilization. The advantages of the traditional server monitoring method are solved, which is inconvenient to fully consider the dynamic changes of the network environment and security threats, lack the ability to conduct in-depth analysis of data, and are difficult to identify and respond to potential complex security risks.

Description

Technical Field

[0001] The present invention relates to the technical field of server security monitoring, and in particular to a server security monitoring method and system. Background Art

[0002] With the rapid development of information technology and the popularization of the Internet, servers, as core components of enterprise and organizational information systems, carry a large amount of business and data. The security of servers directly affects the stability, reliability and data integrity of information systems. Therefore, server security monitoring has become an important part of information security management. Servers play a vital role in modern IT architecture and are mainly used to store, process and transmit data. They can be deployed locally, in data centers or in cloud environments to provide various services such as database management, web hosting, file storage, application support, etc. Servers are of various types and functions, including but not limited to web servers, database servers, application servers, and file servers. With the popularization of server applications, various security threats are also increasing. These threats include not only external attacks (such as hacker intrusions, DDoS attacks, malware propagation, etc.).

[0003] For example, the patent with announcement number: CN111262875B announces a server security monitoring method, device, system and storage medium. Each business server first performs correlation processing on the data it collects to integrate related data together, reduce the amount of data, and make each piece of data contain richer and more comprehensive information, thereby improving the accuracy of subsequent filtering.

[0004] Traditional server monitoring methods are unable to fully consider the dynamic changes in network environment and security threats, lack the ability to conduct in-depth analysis of real-time data, and find it difficult to effectively identify and respond to potential complex security risks. Summary of the invention

[0005] In view of the shortcomings of the prior art, the present invention provides a server security monitoring method and system, which solves the problems that traditional server monitoring methods are inconvenient to fully consider the dynamic changes of network environment and security threats, lack the ability to conduct in-depth analysis of real-time data, and find it difficult to effectively identify and respond to potential complex security risks.

[0006] To achieve the above objectives, the present invention is implemented through the following technical solutions: a server security monitoring method, comprising the following steps: obtaining a network performance data set in a monitoring computer system log, and analyzing the network performance data set to obtain a network performance evaluation value; obtaining a server anti-intrusion data set in a monitoring computer system log, and analyzing the server anti-intrusion data set to obtain a server anti-intrusion evaluation value; based on the obtained network performance evaluation value and server anti-intrusion evaluation value, a comprehensive analysis is performed to obtain a server security comprehensive coefficient; based on the server security comprehensive coefficient, a comparison is performed with a server security comprehensive evaluation threshold stored in a database to obtain a server security level, and the frequency of monitoring the computer system log is dynamically adjusted according to the obtained server security level.

[0007] Furthermore, a network performance data set in the system log of the monitoring computer is obtained, and the network performance data set is analyzed to obtain a network performance evaluation value. The specific analysis process is: obtain a network performance data set, and the network performance data set specifically includes bandwidth utilization, network delay and network communication packet loss rate; perform a comprehensive analysis based on the obtained network performance data set and the network performance parameter data set stored in the database to obtain a network performance evaluation value. The network performance evaluation value is used as a basis for analyzing whether the server is secure. The network performance data set stored in the database includes: parameter bandwidth utilization, parameter network delay and parameter network communication packet loss rate.

[0008] Furthermore, the network performance evaluation value is used as a basis for analyzing whether the server is safe, and the specific analysis process is: comparing the network performance evaluation value with the network performance parameter threshold stored in the database; if the network performance evaluation value is greater than or equal to the network performance parameter threshold stored in the database, the network performance status is dangerous; if the network performance evaluation value is less than the network performance parameter threshold stored in the database, the network performance status is safe.

[0009] Furthermore, the network performance evaluation value is calculated as follows:

[0010]

[0011] Where N is the network performance evaluation value, B is the bandwidth utilization rate, B1 is the specified bandwidth utilization rate stored in the database, D is the network delay, D1 is the specified network delay stored in the database, P is the network communication packet loss rate, P1 is the specified network communication packet loss rate stored in the database, and w B is the weight factor of bandwidth usage stored in the database, w D is the weight factor of network delay stored in the database, w P It is the weight factor of the network communication packet loss rate stored in the database.

[0012] Furthermore, the server anti-intrusion data set in the monitoring computer system log is obtained, and the server anti-intrusion data set is analyzed to obtain a server anti-intrusion evaluation value. The specific analysis process is: obtaining a server anti-intrusion data set, the server anti-intrusion data set specifically includes a success rate for blocking abnormal logins, a data packet loss rate, and a success rate for blocking abnormal connection requests; performing a comprehensive analysis based on the obtained server anti-intrusion data set and a server anti-intrusion parameter data set stored in a database to obtain a server anti-intrusion evaluation value, the server anti-intrusion evaluation value is used as an analysis basis for whether the server is safe, and the server anti-intrusion parameter data set stored in the database includes: a parameter for blocking abnormal login success rate, a parameter for data packet loss rate, and a parameter for blocking abnormal connection request success rate.

[0013] Furthermore, the server anti-intrusion evaluation value is used as a basis for analyzing whether the server is safe. The specific analysis process is: comparing the server anti-intrusion evaluation value with the server anti-intrusion parameter threshold stored in the database; if the server anti-intrusion evaluation value is greater than or equal to the server anti-intrusion parameter threshold stored in the database, the server intrusion status is safe; if the server anti-intrusion evaluation value is less than the server anti-intrusion parameter threshold stored in the database, the server intrusion status is dangerous.

[0014] Furthermore, the server anti-intrusion evaluation value is calculated as follows:

[0015]

[0016] Where: Z is the server anti-intrusion evaluation value, L is the success rate of preventing abnormal login, L1 is the parameterized success rate of preventing abnormal login stored in the database, S is the packet loss rate, S1 is the parameterized packet loss rate stored in the database, V is the success rate of preventing abnormal connection requests, V1 is the parameterized success rate of preventing abnormal connection requests stored in the database, w L is the weight factor for preventing abnormal login success rate stored in the database, w S is the weight factor of the packet loss rate stored in the database, w V It is the weight factor of the success rate of blocking abnormal connection requests stored in the database, and e is a natural constant.

[0017] Furthermore, the server comprehensive safety coefficient is calculated as follows:

[0018]

[0019] In the formula, C is the comprehensive security coefficient of the server, N is the network performance evaluation value, Z is the server anti-intrusion evaluation value, and w N is the weight factor of the network performance evaluation value stored in the database, w ZThe weight factor of the server anti-intrusion evaluation value stored in the database.

[0020] Furthermore, based on the comparison between the server security comprehensive coefficient and the server security comprehensive assessment threshold stored in the database, the server security level is obtained, and the frequency of monitoring the computer system logs is dynamically adjusted according to the obtained server security level. The specific analysis process is: comparing the server security comprehensive coefficient with the server security comprehensive assessment threshold stored in the database; if the server security comprehensive coefficient is less than or equal to the server security comprehensive assessment threshold stored in the database, the server security is high risk, and the frequency of monitoring the computer system logs for the server is increased; if the server security comprehensive coefficient is greater than the server security comprehensive assessment threshold stored in the database, the server security is low risk, and the frequency of monitoring the computer system logs for the server is reduced.

[0021] A server security monitoring system comprises: a network performance monitoring module, a server anti-intrusion module, a comprehensive analysis module and a computer system log frequency adjustment module; the network performance monitoring module is used to obtain a network performance data set in a monitoring computer system log, and analyze the network performance data set to obtain a network performance evaluation value; the server anti-intrusion module is used to obtain a server anti-intrusion data set in a monitoring computer system log, and analyze the server anti-intrusion data set to obtain a server anti-intrusion evaluation value; the comprehensive analysis module is used to obtain a server security comprehensive coefficient based on the obtained network performance evaluation value and server anti-intrusion evaluation value; the computer system log frequency adjustment module is used to compare the server security comprehensive coefficient with the server security comprehensive evaluation threshold stored in a database to obtain a server security level, and dynamically adjust the frequency of monitoring the computer system log according to the obtained server security level.

[0022] The present invention has the following beneficial effects:

[0023] The server security monitoring method and system analyze network performance data and server anti-intrusion data in computer system logs to make server security assessment more comprehensive, identify potential security risks, and dynamically adjust the monitoring frequency according to the server security level. The monitoring frequency can be increased during high-risk periods and the monitoring burden can be reduced during low-risk periods, thereby improving resource utilization efficiency. The method and system solve the problem that traditional server monitoring methods are inconvenient to fully consider the dynamic changes of network environment and security threats, lack the ability to conduct in-depth analysis of real-time data, and have difficulty in effectively identifying and responding to potential complex security risks.

[0024] Of course, any product implementing the present invention does not necessarily need to achieve all of the advantages described above at the same time. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 This is a flow chart of the server security monitoring method of the present invention;

[0026] Figure 2 This is a flow chart of the server security monitoring system of the present invention. DETAILED DESCRIPTION

[0027] The embodiment of the present application uses a server security monitoring method and system to analyze network performance data and server anti-intrusion data in computer system logs, making server security assessment more comprehensive, identifying potential security risks, and dynamically adjusting the monitoring frequency according to the server security level. The monitoring frequency can be increased during high-risk periods and the monitoring burden can be reduced during low-risk periods, thereby improving resource utilization efficiency.

[0028] The overall idea of ​​the problem in the embodiment of this application is as follows:

[0029] First, obtain the network performance data set and server anti-intrusion data set in the monitored computer system log, and based on the obtained network performance evaluation value and server anti-intrusion evaluation value, comprehensively analyze and obtain the server security comprehensive coefficient. Then, compare the server security comprehensive coefficient with the server security comprehensive evaluation threshold stored in the database to obtain the server security level. Dynamically adjust the frequency of monitoring the computer system log according to the obtained server security level.

[0030] See also Figure 1 The embodiment of the present invention provides a technical solution: a server security monitoring method, comprising the following steps: obtaining a network performance data set in a monitoring computer system log, and analyzing the network performance data set to obtain a network performance evaluation value; obtaining a server anti-intrusion data set in a monitoring computer system log, and analyzing the server anti-intrusion data set to obtain a server anti-intrusion evaluation value; based on the obtained network performance evaluation value and server anti-intrusion evaluation value, comprehensively analyzing to obtain a server security comprehensive coefficient; based on comparing the server security comprehensive coefficient with a server security comprehensive evaluation threshold stored in a database, obtaining a server security level, and dynamically adjusting the frequency of monitoring the computer system log according to the obtained server security level.

[0031] Specifically, a network performance data set in a monitoring computer system log is obtained, and the network performance data set is analyzed to obtain a network performance evaluation value. The specific analysis process is: obtain a network performance data set, and the network performance data set specifically includes bandwidth utilization, network delay, and network communication packet loss rate; perform a comprehensive analysis based on the obtained network performance data set and the network performance parameter data set stored in the database to obtain a network performance evaluation value. The network performance evaluation value is used as a basis for analyzing whether the server is secure. The network performance data set stored in the database includes: parameter bandwidth utilization, parameter network delay, and parameter network communication packet loss rate.

[0032] In this embodiment, bandwidth utilization refers to the average data transmission rate of a network connection within a certain period of time, usually expressed as a percentage of the total available bandwidth.

[0033] Tools such as SolarWinds, PRTG Network Monitor, NetFlowAnalyzer, etc. can monitor and record the traffic data of network devices in real time. By monitoring bandwidth utilization, network resources can be effectively allocated to ensure that key applications and services have sufficient bandwidth support to avoid resource waste. Monitoring bandwidth utilization can detect problems with excessive network load in advance, so that measures such as increasing bandwidth and adjusting traffic management strategies can be taken to prevent data transmission delays and packet loss. Network latency is the time required for data to travel from the source to the destination, usually calculated in milliseconds. The round-trip time of the data packet is tested by using the Ping tool command. Ping sends an ICMP echo request to the target address and waits for the echo reply. By measuring the round-trip time, the network latency can be evaluated; low latency is the key to ensuring smooth application operation. Changes in network latency are often early warnings of network problems, such as hardware failures, configuration errors, or network congestion. Regular monitoring of network latency helps to quickly diagnose and resolve these problems. The network packet loss rate refers to the proportion of data packets lost during network transmission. It is an important indicator of network quality. Tools such as SolarWinds and PRTG can not only display bandwidth usage, but also monitor network communication packet loss and provide real-time packet loss statistics. Monitoring network communication packet loss rate helps ensure data integrity and transmission efficiency. High network communication packet loss rate will seriously affect network performance. Timely discovery and resolution of packet loss problems are essential to maintaining network health. Packet loss rate is one of the important indicators for evaluating network quality. By analyzing the causes of packet loss, such as network congestion, equipment failure or malicious attacks, appropriate measures can be taken to improve network quality. Compare the network performance data set obtained in real time with the network performance parameter data set stored in the database, and use difference calculation, percentage comparison, etc. to evaluate the difference between the actual network status and the expected standard. A low network performance evaluation value indicates that the network is under great pressure or there are unauthorized data flows, which may be an indication of security risks. According to the evaluation results, make necessary configuration adjustments or optimizations to the network to improve performance and ensure security. Real-time acquisition of network data allows for quick response to potential issues, reducing the scope and duration of failures. Abnormal network performance indicators may indicate security issues, such as DDoS attacks, network intrusions, etc. By analyzing network performance evaluation values, network-related security risks can be identified and managed.

[0034] Specifically, the network performance evaluation value is used as a basis for analyzing whether the server is safe, and the specific analysis process is: comparing the network performance evaluation value with the network performance parameter threshold stored in the database; if the network performance evaluation value is greater than or equal to the network performance parameter threshold stored in the database, the network performance status is dangerous; if the network performance evaluation value is less than the network performance parameter threshold stored in the database, the network performance status is safe.

[0035] In this embodiment, first, the system calculates the network performance evaluation value by real-time monitoring of key network performance indicators, including bandwidth utilization, network delay and network communication packet loss rate, and the network performance evaluation value reflects the current overall performance status of the network. The network performance parameter threshold is set in the database. The network performance parameter threshold stored in the database can be determined by collecting a large amount of historical data of network performance, analyzing its distribution characteristics, and calculating the statistical parameters of the historical data, such as the mean, standard deviation, etc., and the value can be set to the mean plus a certain multiple of the standard deviation to determine the threshold. For example, historical data on the bandwidth utilization of its main servers is collected. By analyzing these data, it is found that the mean of bandwidth utilization is 50% and the standard deviation is 5%. In order to set a conservative threshold to warn of potential network congestion or abnormally high load, the threshold is set to the mean plus two times the standard deviation, that is, 60%. In this way, once the real-time monitored bandwidth utilization reaches or exceeds 60%, the system will trigger an alarm, requiring further inspection or intervention. The calculated network performance evaluation value is compared with the network performance parameter threshold stored in the database. If the network performance evaluation value is greater than or equal to the network performance parameter threshold stored in the database, the network is considered to be in a dangerous state; if the network performance evaluation value is less than the network performance parameter threshold stored in the database, the network state is considered safe. By real-time monitoring and evaluating network performance, the system can quickly identify network performance degradation, which is often a precursor to network attacks or other security incidents. By continuously monitoring network performance and adjusting thresholds, its security measures and network configuration can be continuously improved.

[0036] Specifically, the network performance evaluation value is calculated as follows:

[0037]

[0038] Where N is the network performance evaluation value, B is the bandwidth utilization rate, B1 is the specified bandwidth utilization rate stored in the database, D is the network delay, D1 is the specified network delay stored in the database, P is the network communication packet loss rate, P1 is the specified network communication packet loss rate stored in the database, and w B is the weight factor of bandwidth usage stored in the database, w D is the weight factor of network delay stored in the database, w P It is the weight factor of the network communication packet loss rate stored in the database.

[0039] In this implementation scheme, the square term of the bandwidth utilization ratio is used to emphasize the sensitivity of deviation from the parameter value; the greater the deviation of bandwidth utilization, the more significant its contribution to the network performance evaluation value. This reflects the potential impact of bandwidth excess or underutilization on network performance. Generally, an increase in bandwidth utilization will lead to an increase in network latency. When the network approaches the limit of its bandwidth capacity, data packets must queue in the network equipment for transmission, which will increase latency. The square term of the network delay ratio is similar to the treatment of bandwidth utilization. The treatment of latency also highlights its degree of deviation. These two items provide a standardized performance comparison, which enhances the sensitivity of deviation from the baseline through squaring, that is, the larger the performance gap, the heavier the weight of its impact in the network performance evaluation value. B and w D are the weight factors of bandwidth utilization and network delay, respectively. These weight factors determine the influence of the corresponding performance indicators in the total evaluation value. The weight setting is usually based on business priorities and network policies to ensure that key performance indicators receive sufficient attention. Logarithmic processing of network communication packet loss rate. The logarithmic function is used to deal with the situation when the network communication packet loss rate is low but has a high impact on network performance, while avoiding excessive impact on the evaluation value when the packet loss rate is very high. The logarithmic function can reduce its impact on the evaluation value when the packet loss rate is very low, and limit the growth of its impact when the packet loss rate is high. The final network performance evaluation value is obtained by adding the square root of the weighted sum of the squares of bandwidth utilization and network delay to the logarithmic term of the network communication packet loss rate. This calculation method comprehensively considers the different measurement scales and contribution methods of each indicator, aiming to balance and reflect the overall performance status of the network.

[0040] Through the relationship between the historically monitored bandwidth utilization, network delay and network communication packet loss rate and their corresponding network performance evaluation values, a mapping set of bandwidth utilization, network delay and network communication packet loss rate and their corresponding weight factors is established, and the current bandwidth utilization, network delay and network communication packet loss rate are input into the mapping set to obtain the weight factors corresponding to the current bandwidth utilization, network delay and network communication packet loss rate.

[0041] Specifically, the server anti-intrusion data set in the system log of the monitoring computer is obtained, and the server anti-intrusion data set is analyzed to obtain a server anti-intrusion evaluation value. The specific analysis process is: obtaining a server anti-intrusion data set, the server anti-intrusion data set specifically includes a success rate for blocking abnormal logins, a data packet loss rate, and a success rate for blocking abnormal connection requests; performing a comprehensive analysis based on the obtained server anti-intrusion data set and a server anti-intrusion parameter data set stored in a database to obtain a server anti-intrusion evaluation value. The server anti-intrusion evaluation value is used as a basis for analyzing whether the server is safe. The server anti-intrusion parameter data set stored in the database includes: a parameter for blocking abnormal login success rate, a parameter for data packet loss rate, and a parameter for blocking abnormal connection request success rate.

[0042] In this implementation scheme, the success rate of blocking abnormal logins reflects the proportion of abnormal login attempts that the system successfully identifies and blocks. First, all login attempts are obtained, including source IP, timestamp, user name, status (success / failure), etc. Failed login attempts are specially marked for subsequent analysis. Abnormal login thresholds are set, such as: multiple failed attempts by the same IP in a short period of time (such as three failed attempts), suspicious IPs based on geographical or behavioral characteristics, etc., and external blacklist services are integrated to automatically block known malicious IP addresses. The number of all abnormal login attempts is divided by the number of successfully blocked abnormal logins and then multiplied by 100% to obtain the success rate of blocking abnormal logins. Packet loss rate, this indicator measures the proportion of data packets lost in network transmission, reflecting the stability, reliability and overall performance of the network. Use traffic monitoring tools (such as Wireshark, Nagios, PRTG, etc.) to capture and analyze real-time network traffic, analyze network behavior during peak hours and under high load conditions, find potential bottlenecks and causes of data loss, track the number of data packets sent and received in a specific time period, and count the number of lost data packets. The total number of sent data packets is divided by the number of lost data packets and then multiplied by 100% to obtain the packet loss rate. The success rate of blocking abnormal connection requests indicates the proportion of abnormal connection requests successfully blocked by the system, which directly affects the security and stability of the network. By monitoring and analyzing all connection attempts recorded by the firewall and intrusion detection system, including rejected and allowed connections, abnormal requests are defined, such as: connections from unknown IPs, multiple attempts to connect to different ports, abnormally high connection rates, etc., and then machine learning or rule engines are used to analyze the connection pattern to identify potential attack behaviors or abnormal activities. The number of all abnormal connection requests is divided by the number of successfully blocked abnormal connection requests, and then multiplied by 100% to obtain the success rate of blocking abnormal connection requests. Real-time monitoring is implemented through these indicators to facilitate timely detection and interception of abnormal behaviors and ensure the security of the server. The server anti-intrusion data set is compared with the server anti-intrusion data set stored in the database. The server anti-intrusion evaluation value will be used to judge the security status of the server. A high evaluation value may indicate high risk or intrusion activities, while a low evaluation value indicates that the server is in a safe state. By monitoring and analyzing anti-intrusion data, security risks can be discovered early, preventive measures can be taken, and the risk of being attacked can be reduced.

[0043] Specifically, the server anti-intrusion evaluation value is used as the basis for analyzing whether the server is safe, and the specific analysis process is: comparing the server anti-intrusion evaluation value with the server anti-intrusion parameter threshold stored in the database; if the server anti-intrusion evaluation value is greater than or equal to the server anti-intrusion parameter threshold stored in the database, the server intrusion status is safe; if the server anti-intrusion evaluation value is less than the server anti-intrusion parameter threshold stored in the database, the server intrusion status is dangerous.

[0044] In this embodiment, the abnormal login success rate, packet loss rate and abnormal connection request success rate are collected, and the server anti-intrusion evaluation value is calculated based on the collected data, and the calculated server anti-intrusion evaluation value is compared with the parameter threshold stored in the database. The setting of the server anti-intrusion parameter threshold is usually based on the statistical analysis of historical security data, by collecting a large amount of historical server security event data, login attempt times, port scanning activities and abnormal connection request success rate. Then, the threshold is set by calculating the statistical parameters of these data, such as the mean and standard deviation. For example, the threshold can be set to the historical mean of a certain indicator plus two times the standard deviation. Such a setting takes into account abnormal activities outside the normal fluctuation range, and provides a threshold that is both empirically based and conservative, which is used to identify potential intrusions or abnormal behavior. If the server anti-intrusion evaluation value is greater than or equal to the server anti-intrusion parameter threshold stored in the database, it is considered that the server may be relatively safe. If the server anti-intrusion evaluation value is less than the server anti-intrusion parameter threshold stored in the database, it is considered that the server is in a possible invasion or high-risk state. By monitoring server security events in real time and comparing them with parameter thresholds, potential security threats can be identified in a timely manner. Security thresholds can be adjusted according to the ever-changing network environment and threat landscape. This dynamic adjustment helps maintain the effectiveness of security measures and adapt to changes in the external environment and internal policies. Flexible adjustment of thresholds and evaluation criteria can help organizations better manage their security risks and ensure that security measures always match the latest threats.

[0045] Specifically, the server anti-intrusion evaluation value is calculated as follows:

[0046]

[0047] Where: Z is the server anti-intrusion evaluation value, L is the success rate of preventing abnormal login, L1 is the parameterized success rate of preventing abnormal login stored in the database, S is the packet loss rate, S1 is the parameterized packet loss rate stored in the database, V is the success rate of preventing abnormal connection requests, V1 is the parameterized success rate of preventing abnormal connection requests stored in the database, w L is the weight factor for preventing abnormal login success rate stored in the database, w S is the weight factor of the packet loss rate stored in the database, w V It is the weight factor of the success rate of blocking abnormal connection requests stored in the database, and e is a natural constant.

[0048] In this embodiment, and They represent the ratio of the observed abnormal login blocking success rate and packet loss rate to the parameter values ​​stored in the database. These ratios help quantify the deviation of actual activities from the parameterized activities. The weighted squares of these two ratios are used to process and The main purpose is to increase the influence of those types of events that are considered to have a greater impact on system security, ensuring that security events with higher weights occupy a more prominent position in the total evaluation value. The use of logarithmic functions is to reconcile the weighted ratio results. Logarithmic processing helps to mitigate the impact of extreme values, provide a smooth and continuous growth curve, and avoid drastic fluctuations in the evaluation value due to a single abnormal data point. The evaluation of the success rate of blocking abnormal connection requests uses square root processing, which is intended to balance the impact of this serious security threat. The square root processing ensures that even in the case of a large number of success rates of blocking abnormal connection requests, its contribution to the overall evaluation value will not be overly amplified, thereby maintaining the overall balance of the evaluation. By normalizing the success rate of blocking abnormal logins, packet loss rates, and success rates of blocking abnormal connection requests, the evaluation results between different servers are comparable, regardless of the size and load of the server. This normalization is particularly important for cross-server comparisons in large network environments. The formula combines the success rate of blocking abnormal logins, packet loss rates, and success rates of blocking abnormal connection requests, and through the mathematical processing of logarithms and square roots, it provides a comprehensive security view that helps to understand the security status of the server globally. By adjusting the weight factors, the influence of the success rate of blocking abnormal logins, the packet loss rate, and the success rate of blocking abnormal connection requests in the server anti-intrusion evaluation value can be adjusted according to different security policies and risk assessments. The application of logarithms and square roots reduces the possibility of drastic fluctuations in the evaluation value due to a single extreme event, and improves the stability and accuracy of the evaluation.

[0049] Based on the relationship between the historically monitored success rate of preventing abnormal logins, data packet loss rate and success rate of preventing abnormal connection requests and their corresponding network performance evaluation values, a mapping set of the success rate of preventing abnormal logins, data packet loss rate and success rate of preventing abnormal connection requests and their corresponding weight factors is established, and the current success rate of preventing abnormal logins, data packet loss rate and success rate of preventing abnormal connection requests are input into the mapping set to obtain the weight factors corresponding to the current success rate of preventing abnormal logins, data packet loss rate and success rate of preventing abnormal connection requests.

[0050] Specifically, the server comprehensive security coefficient is calculated as follows:

[0051]

[0052] In the formula, C is the comprehensive security coefficient of the server, N is the network performance evaluation value, Z is the server anti-intrusion evaluation value, and w Nis the weight factor of the network performance evaluation value stored in the database, w Z The weight factor of the server anti-intrusion evaluation value stored in the database.

[0053] In this implementation scheme, the server security comprehensive coefficient reflects the comprehensive security of the server in terms of network performance and anti-intrusion capabilities. The higher the value, the better the comprehensive security of the server. The network performance evaluation value indicates the performance of the server in processing network requests or responses. The server anti-intrusion evaluation value indicates the server's ability to resist intrusions and attacks. Network performance is directly related to the response speed and processing power of the server. If the network performance is poor, the server may be unable to respond to requests in a timely manner, resulting in excessive resource consumption or crash. If the server has defects in anti-intrusion capabilities, it may cause attackers to exploit network performance weaknesses, thereby exacerbating the attack effect. This reflects the interactive relationship between the two in network security. The weight factor of the network performance evaluation value reflects the importance of network performance in the comprehensive security factor, and the weight factor of the server anti-intrusion evaluation value indicates the importance of anti-intrusion capabilities in the comprehensive security factor.

[0054] This term combines the effects of the two evaluation metrics by weighting them, and the square root increases the numerical complexity in a positive way. The square root makes the combination of the two less extreme and enhances the smoothness of the natural logarithm function, especially in When the value is small, it grows relatively slowly, avoiding excessive fluctuations, while gradually raising the final result when the value is large. This formula combines the two dimensions of network performance and anti-intrusion capabilities, and can fully reflect the security of the server. It does not only rely on a single indicator. Through the use of logarithms and square roots, the formula is designed to be smoother, avoiding excessive fluctuations in security assessments caused by small changes, and contributing to the stability of decision-making.

[0055] Through the relationship between the historically monitored network performance evaluation values ​​and server anti-intrusion evaluation values, a mapping set of network performance evaluation values, server anti-intrusion evaluation values ​​and their corresponding weight factors is established, and the current network performance evaluation values ​​and server anti-intrusion evaluation values ​​are input into the mapping set to obtain the weight factors corresponding to the current network performance evaluation values ​​and server anti-intrusion evaluation values.

[0056] Specifically, the server security level is obtained based on the comparison between the server security comprehensive coefficient and the server security comprehensive assessment threshold stored in the database, and the frequency of monitoring the computer system logs is dynamically adjusted according to the obtained server security level. The specific analysis process is: compare the server security comprehensive coefficient with the server security comprehensive assessment threshold stored in the database; if the server security comprehensive coefficient is less than or equal to the server security comprehensive assessment threshold stored in the database, the server security is high risk, and the frequency of monitoring the computer system logs for the server is increased; if the server security comprehensive coefficient is greater than the server security comprehensive assessment threshold stored in the database, the server security is low risk, and the frequency of monitoring the computer system logs for the server is reduced.

[0057] In this implementation scheme, the server security comprehensive coefficient is compared with the server security comprehensive assessment threshold stored in the database. The server security comprehensive assessment threshold can be obtained by statistically analyzing historical security event data. By mining and analyzing past security vulnerabilities, attack patterns and their impact, combined with the asset value and business importance of the system, a dynamic threshold based on real-time risk assessment is derived to ensure that it can accurately reflect the security needs in the current environment. If the server security comprehensive coefficient is less than or equal to the server security comprehensive assessment threshold stored in the database, there is a high risk. At this time, the system will increase the monitoring frequency of the server in order to promptly discover potential security issues. If the server security comprehensive coefficient is greater than the server security comprehensive evaluation threshold stored in the database, the server security comprehensive does not have a high risk. At this time, the system will reduce the monitoring frequency of the server to optimize resource usage. By comparing the security comprehensive coefficient with the evaluation threshold in real time, the monitoring frequency can be dynamically adjusted to ensure sufficient monitoring efforts in high-risk situations, thereby improving the response speed to potential threats. Reducing the monitoring frequency in low-risk situations can effectively save system resources (such as computing power and storage space), avoid unnecessary waste of resources, and improve the efficiency of the overall system. By increasing monitoring of high-risk servers, security incidents can be discovered and handled in a timely manner, reducing the risk of security vulnerabilities being exploited, thereby enhancing overall network security. This mechanism can flexibly adjust the monitoring strategy according to the actual security status of the server, adapt to the ever-changing network environment and security threats, and enhance the system's adaptability and defense capabilities.

[0058] See also Figure 2A server security monitoring system comprises: a network performance monitoring module, a server anti-intrusion module, a comprehensive analysis module and a computer system log frequency adjustment module; the network performance monitoring module is used to obtain a network performance data set in a monitoring computer system log, and analyze the network performance data set to obtain a network performance evaluation value; the server anti-intrusion module is used to obtain a server anti-intrusion data set in a monitoring computer system log, and analyze the server anti-intrusion data set to obtain a server anti-intrusion evaluation value; the comprehensive analysis module is used to obtain a server security comprehensive coefficient based on the obtained network performance evaluation value and server anti-intrusion evaluation value; the computer system log frequency adjustment module is used to compare the server security comprehensive coefficient with the server security comprehensive evaluation threshold stored in a database to obtain a server security level, and dynamically adjust the frequency of monitoring the computer system log according to the obtained server security level.

[0059] In summary, this application has at least the following effects:

[0060] By analyzing the network performance data and server anti-intrusion data in the computer system log, the server security assessment is more comprehensive and can identify potential security risks. The monitoring frequency can be dynamically adjusted according to the server security level. The monitoring frequency can be increased during high-risk periods and the monitoring burden can be reduced during low-risk periods, thereby improving resource utilization efficiency. This solves the problem that traditional server monitoring methods are inconvenient to fully consider the dynamic changes in the network environment and security threats, lack the ability to conduct in-depth analysis of real-time data, and find it difficult to effectively identify and respond to potential complex security risks.

[0061] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0062] The present invention is described with reference to flowcharts and / or block diagrams of systems, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0063] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0064] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0065] Although the preferred embodiments of the present invention have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0066] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A server security monitoring method, characterized in that: The following steps are involved: Obtain the network performance data set in the monitoring computer system log, and analyze the network performance data set to obtain the network performance evaluation value; the network performance evaluation value is calculated using the formula: Where N is the network performance evaluation value, B is the bandwidth utilization rate, B1 is the specified bandwidth utilization rate stored in the database, D is the network delay, D1 is the specified network delay stored in the database, P is the network communication packet loss rate, P1 is the specified network communication packet loss rate stored in the database, and w B is the weight factor of bandwidth usage stored in the database, w D is the weight factor of network delay stored in the database, w P is the weight factor of the network communication packet loss rate stored in the database; Obtaining a server anti-intrusion data set from a monitoring computer system log, and analyzing the server anti-intrusion data set to obtain a server anti-intrusion evaluation value; The server anti-intrusion evaluation value is calculated as follows: Where: Z is the server anti-intrusion evaluation value, L is the success rate of preventing abnormal login, L1 is the parameterized success rate of preventing abnormal login stored in the database, S is the packet loss rate, S1 is the parameterized packet loss rate stored in the database, V is the success rate of preventing abnormal connection requests, V1 is the parameterized success rate of preventing abnormal connection requests stored in the database, w L is the weight factor for preventing abnormal login success rate stored in the database, w S is the weight factor of the packet loss rate stored in the database, w V is the weight factor of the success rate of blocking abnormal connection requests stored in the database, and e is a natural constant; Based on the obtained network performance evaluation value and server anti-intrusion evaluation value, a comprehensive analysis is performed to obtain the server security comprehensive coefficient; The server security comprehensive coefficient is calculated as follows: In the formula, C is the comprehensive security coefficient of the server, N is the network performance evaluation value, Z is the server anti-intrusion evaluation value, and w N is the weight factor of the network performance evaluation value stored in the database, w Z A weight factor for the server anti-intrusion evaluation value stored in the database; The server security level is obtained by comparing the server comprehensive security coefficient with the server comprehensive security assessment threshold stored in the database, and the frequency of monitoring computer system logs is dynamically adjusted according to the obtained server security level.

2. A server security monitoring method according to claim 1, characterized in that: Obtain the network performance data set in the monitoring computer system log, and analyze the network performance data set to obtain the network performance evaluation value. The specific analysis process is as follows: Obtain a network performance data set, the network performance data set specifically including bandwidth usage, network delay, and network communication packet loss rate; Based on a comprehensive analysis of the acquired network performance data set and the network performance parameter data set stored in the database, a network performance evaluation value is obtained. The network performance evaluation value is used as the basis for analyzing whether the server is secure. The network performance data set stored in the database includes: parameter bandwidth utilization, parameter network delay and parameter network communication packet loss rate.

3. A server security monitoring method according to claim 2, characterized in that: The network performance evaluation value is used as the basis for analyzing whether the server is safe. The specific analysis process is as follows: Compare the network performance evaluation value with the network performance parameter threshold stored in the database; If the network performance evaluation value is greater than or equal to the network performance parameter threshold stored in the database, the network performance status is dangerous; If the network performance evaluation value is less than the network performance parameter threshold stored in the database, the network performance is safe.

4. A server security monitoring method according to claim 1, characterized in that: The server anti-intrusion data set in the monitoring computer system log is obtained, and the server anti-intrusion data set is analyzed to obtain the server anti-intrusion evaluation value. The specific analysis process is as follows: Obtaining a server anti-intrusion data set, the server anti-intrusion data set specifically includes a success rate of blocking abnormal logins, a packet loss rate, and a success rate of blocking abnormal connection requests; Based on a comprehensive analysis of the acquired server anti-intrusion data set and the server anti-intrusion parameter data set stored in the database, a server anti-intrusion evaluation value is obtained. The server anti-intrusion evaluation value serves as the basis for analyzing whether the server is safe. The server anti-intrusion parameter data set stored in the database includes: the parameter blocking abnormal login success rate, the parameter data packet loss rate and the parameter blocking abnormal connection request success rate.

5. A server security monitoring method according to claim 4, characterized in that: The server anti-intrusion evaluation value is used as the basis for analyzing whether the server is safe. The specific analysis process is as follows: Compare the server anti-intrusion evaluation value with the server anti-intrusion parameter threshold stored in the database; If the server anti-intrusion assessment value is greater than or equal to the server anti-intrusion parameter threshold stored in the database, the server intrusion status is safe; If the server anti-intrusion evaluation value is less than the server anti-intrusion parameter threshold stored in the database, the server intrusion status is dangerous.

6. A server security monitoring method according to claim 1, characterized in that: The server security level is obtained by comparing the server security comprehensive coefficient with the server security comprehensive assessment threshold stored in the database. The frequency of monitoring computer system logs is dynamically adjusted according to the obtained server security level. The specific analysis process is as follows: Compare the server security comprehensive coefficient with the server security comprehensive assessment threshold stored in the database; if the server security comprehensive coefficient is less than or equal to the server security comprehensive assessment threshold stored in the database, the server security is at high risk, and the frequency of monitoring the computer system log of the server is increased; If the server security comprehensive coefficient is greater than the server security comprehensive assessment threshold stored in the database, the server security is low risk, and the frequency of monitoring the computer system log of the server is reduced.

7. A server security monitoring system, applied to a server security monitoring system according to any one of claims 1 to 6, characterized in that: include: Network performance monitoring module, server anti-intrusion module, comprehensive analysis module and computer system log frequency adjustment module; The network performance monitoring module is used to obtain a network performance data set in a monitoring computer system log, and analyze the network performance data set to obtain a network performance evaluation value; The server anti-intrusion module is used to obtain a server anti-intrusion data set in a monitoring computer system log, and analyze the server anti-intrusion data set to obtain a server anti-intrusion evaluation value; The comprehensive analysis module is used to obtain a comprehensive server security coefficient through comprehensive analysis based on the obtained network performance evaluation value and server anti-intrusion evaluation value; The computer system log frequency adjustment module is used to compare the server security comprehensive coefficient with the server security comprehensive assessment threshold stored in the database to obtain the server security level, and dynamically adjust the frequency of monitoring the computer system log according to the obtained server security level.

Images