Computer network engineering safety control system

Abstract

The invention discloses a computer network engineering security control system, which relates to the technical field of network engineering security, and is characterized in that in an external attack surface influence division process, a vulnerability scanning tool is used for carrying out vulnerability scanning on network equipment accessed to the Internet in a set time period; in the internal attack surface influence division process, employee equipment is scanned and detected by using equipment management software, so that the employee equipment is ensured to conform to the security standard set by a company, and the security of the employee equipment is ensured to be consistent with the security standard set by the company by calculating the comprehensive attack surface evaluation coefficient. In combination with the external attack surface influence and the internal attack surface influence, the overall security condition of the specified company can be comprehensively evaluated, and in the network architecture mode evaluation process, whether the network architecture mode corresponding to the network architecture in the specified company meets the network engineering security requirement or not is evaluated. And identification of security vulnerabilities in the existing network architecture is facilitated.

Description

Technical Field

[0001] The present invention relates to the technical field of network engineering safety, and in particular to a computer network engineering safety control system. Background Art

[0002] As the business of enterprises expands and the network boundaries become blurred, the attack surface also expands. The external attack surface of enterprises includes Internet access points, partner connections, etc., and the internal attack surface includes employee devices, internal networks, etc. Traditional network security defense methods are difficult to fully cover these attack surfaces. Therefore, a security control system that can comprehensively analyze and evaluate the attack surface is needed to effectively identify and reduce potential security risks.

[0003] Prior art, such as the invention patent application with announcement number CN109495502A, discloses a method and device for evaluating the security health index of an industrial control network, including: obtaining compliance index parameters of host terminals in a network system, compliance index parameters of network boundaries and communication networks, vulnerability risk index parameters of assets, threat risk index parameters of assets, and business value scoring parameters of assets; calculating the compliance index of network security according to the compliance index parameters of the host terminal and the compliance index parameters of the network boundaries and communication networks; calculating the risk index of network security according to the vulnerability risk index parameters of assets, the threat risk index parameters of assets, and the business value scoring parameters of assets; calculating the network security health index according to the network security compliance index and the network security risk index; and judging the network security level according to a preset network security level interval and the network security health index.

[0004] There are at least the following technical problems with the above scheme: 1. The above scheme lacks a detailed division and impact assessment of the internal and external attack surfaces of the enterprise, which will lead to the inability to comprehensively assess the actual security threats and risks faced by the enterprise. In the industrial control network security health index assessment, it only relies on the compliance index and risk index for comprehensive assessment, but lacks consideration of the specific details of the attack surface analysis, such as the number of vulnerabilities in Internet access points, partner connection risk index, security compliance rate of employee equipment, and average time for repairing internal network vulnerabilities. As a result, the assessment results deviate from the actual situation and cannot accurately reflect the true security status of the enterprise network.

[0005] 2. The above scheme lacks a detailed assessment of the complexity of the network architecture, which will lead to the inability to accurately assess the security risks of the network architecture itself. The complexity of the network architecture directly affects the security performance of the network architecture itself. If there is a lack of detailed scoring and comprehensive assessment of technical complexity, logical complexity and interconnection complexity, it will be impossible to accurately judge whether the network architecture meets the engineering safety requirements. This will lead to the company's lack of scientific basis when optimizing and upgrading, misjudging the security status of the network architecture, and thus failing to effectively improve the overall security level.

[0006] 3. The above scheme lacks detailed calculation and evaluation of the risk index of each threat event, which will lead to the inability to accurately identify high-risk threats. The risk index of threat events directly affects the company's priority and resource allocation of its response measures. If there is a lack of detailed evaluation of the probability of occurrence and scope of impact of threat events, it will lead to the inability to accurately determine which threat events pose the greatest risk to the company, which will in turn lead to a lack of focus on security investment and the inability to effectively prevent and respond to key threats. Summary of the invention

[0007] The purpose of the present invention is to provide a computer network engineering security control system that solves the problems existing in the background technology.

[0008] To solve the above technical problems, the present invention adopts the following technical solution: The present invention provides a computer network engineering security control system, including: an attack surface analysis module, used to divide the attack surface impact corresponding to a specified company into external attack surface impact and internal attack surface impact, and then calculate the corresponding comprehensive attack surface assessment coefficient in the attack surface of the specified company.

[0009] The network architecture security assessment module is used to assess whether the network architecture model corresponding to the network architecture within a specified company meets the network engineering security requirements.

[0010] The network architecture optimization module is used to evaluate the optimization process of the corresponding network architecture of the specified company when the network architecture model corresponding to the network architecture within the specified company does not meet the network engineering security requirements.

[0011] The early warning terminal is used to issue early warning prompts when the network architecture model corresponding to the network architecture within the specified company does not meet the network engineering security requirements and the network architecture model used by the specified company needs to be optimized and upgraded.

[0012] The beneficial effects of the present invention are as follows: 1. A computer network engineering security control system provided by the present invention, in the process of external attack surface impact division, uses a vulnerability scanning tool to perform vulnerability scanning on network devices connected to the Internet within a set time period, which is conducive to timely discovery and counting of the number of vulnerabilities in Internet access points, thereby effectively reducing potential security risks caused by failure to timely discover vulnerabilities. In the process of internal attack surface impact division, the device management software is used to scan and detect employee devices, which is conducive to ensuring that employee devices meet the security standards set by the company, improving the security compliance rate of employee devices, and reducing security risks caused by substandard equipment in the internal network.

[0013] 2. The embodiment of the present invention calculates a comprehensive attack surface assessment coefficient, combines external attack surface impact and internal attack surface impact, and is conducive to comprehensively assessing the overall security status of a specified company, providing a scientific basis for subsequent network architecture security assessment and optimization. In the process of network architecture model assessment, by assessing whether the network architecture model corresponding to the network architecture within the specified company meets the network engineering security requirements, it is conducive to identifying security vulnerabilities in the existing network architecture, and timely discovering and warning of potential security risks. Through the security risk assessment coefficient, the comprehensive score of network architecture complexity is combined with the comprehensive attack surface assessment coefficient, which is conducive to quantifying the security risk of the network architecture.

[0014] 3. In the process of optimizing the network architecture model, the embodiment of the present invention evaluates the optimization process of the corresponding network architecture of the specified company, which is conducive to formulating a reasonable optimization and upgrade plan based on the current security risk assessment coefficient to improve the security and stability of the network architecture. By evaluating the threat event risk index, the occurrence probability and impact range assessment values ​​corresponding to each threat event in the network architecture are obtained, which is conducive to identifying high-risk threat events, formulating targeted optimization and upgrade measures, and reducing the overall risk level of the network architecture. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0016] Figure 1 It is a schematic diagram of the system structure connection of the present invention. DETAILED DESCRIPTION

[0017] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0018] See also Figure 1 As shown, the present invention provides a computer network engineering security control system, which includes: an attack surface analysis module, a network architecture security assessment module, a network architecture optimization module, an early warning terminal and a database.

[0019] The attack surface analysis module is connected to the network architecture security assessment module and the database respectively, the network architecture security assessment module is connected to the network architecture optimization module and the database respectively, and the network architecture optimization module is connected to the early warning terminal and the database respectively.

[0020] The attack surface analysis module is used to divide the attack surface impact corresponding to the specified company into external attack surface impact and internal attack surface impact, and then calculate the corresponding comprehensive attack surface assessment coefficient in the attack surface of the specified company.

[0021] In a specific embodiment, the attack surface impact corresponding to the designated company is divided into external attack surface impact and internal attack surface impact. The specific process is as follows: A1. The external attack surface impact includes the number of Internet access point vulnerabilities and the partner connection risk index. The internal attack surface impact includes the employee equipment security compliance rate and the average time to repair internal network vulnerabilities.

[0022] A2. Use vulnerability scanning tools to scan the vulnerabilities of network devices connected to the Internet during a set time period, and then count the number of vulnerabilities scanned during the set time period. By evaluating the security management system, identity authentication method and data transmission process of the designated company's corresponding partners, the security assessment score, connection method security score and data transmission monitoring score of the designated company's corresponding partners are obtained. The security assessment score, connection method security score and data transmission monitoring score are denoted as sf, cn and sc respectively. The partner connection risk index k of the designated company's corresponding external attack surface is obtained by the calculation formula k=sf*ι1+cn*ι2+sc*ι3, where ι1, ι2 and ι3 respectively represent the weight factors corresponding to the set security assessment score, the weight factors corresponding to the connection method security score and the weight factors corresponding to the data transmission monitoring score.

[0023] Use device management software to scan and test the devices of each employee in the designated company to test whether each employee's device complies with the security standards set in the designated company, and then obtain the total number of employee devices in the designated company and the number of employee devices that meet the security standards set in the designated company. Divide the number of employee devices that meet the security standards set in the designated company by the total number of employee devices, and the result is the employee device security compliance rate. According to the number of vulnerabilities scanned by the designated company within the set time period, the total time spent on repairing the number of vulnerabilities within the set time period is obtained from the database. The total time spent is divided by the number of vulnerabilities, and the result is the average time for repairing internal network vulnerabilities.

[0024] It should be noted that vulnerability scanning tools include Nessus and OpenVAS, and network devices include routers, firewalls, etc. The device management software automatically detects the security status of each employee's device, such as the installation status of antivirus software, operating system update status, etc. The specific process of evaluating the security assessment score, connection method security score and data transmission monitoring score of the designated company's corresponding partner is as follows: For example, the company's partners organize a security training lecture every month. The content of the training lecture is network attack types and prevention methods. The partners conduct a vulnerability scan once a week. After the vulnerability is discovered, a repair plan is formulated and implemented within 48 hours. The full score is 100 points. According to the partner's corresponding employee access permission management, training management and vulnerability management, the security permission management is set to 40 points, the security training is set to 30 points, and the vulnerability management is set to 30 points. The scores of security permission management, security training and vulnerability management are averaged, and the result is the security assessment score. The process of obtaining the connection method security score and the data transmission monitoring score is the same as the process of obtaining the security assessment score, which will not be elaborated here.

[0025] It should also be noted that the values ​​of ι1, ι2 and ι3 are all greater than 0 and less than 1. For example, the importance of identity authentication method and data transmission process to preventing data leakage and protecting sensitive information is higher than the importance of security management system, and the security management system affects the implementation and continuous improvement of the overall security strategy. Combined with historical data and expert opinions, the data transmission monitoring score weight factor is set to 0.4. Because data leakage during data transmission will lead to the exposure of sensitive information, leakage of commercial secrets and infringement of customer privacy, the identity authentication method weight factor is set to 0.35, and the security management system weight factor is set to 0.25.

[0026] In a specific embodiment, the calculation obtains the comprehensive attack surface assessment coefficient corresponding to the attack surface of the designated company, and the specific calculation process is as follows: the preset maximum possible number of Internet access point vulnerabilities, the preset partner connection risk index range, and the shortest repair time and the longest repair time for the designated company to repair internal network vulnerabilities before the designated company performs the attack surface analysis corresponding to the network architecture are obtained from the database, and the preset maximum possible number of Internet access point vulnerabilities, the maximum value of the preset partner connection risk index range, and the shortest repair time and the longest repair time for the internal network vulnerability repair are respectively recorded as N max , k max , T max and T min , calculated by the formula:

[0027] The corresponding comprehensive attack surface assessment coefficient FS in the specified company's attack surface is obtained, where N, yg, and T represent the number of Internet access point vulnerabilities, the employee equipment security compliance rate, and the average time to repair internal network vulnerabilities, respectively; μ1, μ2, μ3, and μ4 represent the weight factors corresponding to the set number of Internet access point vulnerabilities, the weight factor corresponding to the partner connection risk index, the weight factor corresponding to the employee equipment security compliance rate, and the weight factor corresponding to the average time to repair internal network vulnerabilities, respectively.

[0028] It should be noted that the values ​​of μ1, μ2, μ3, and μ4 are all greater than 0 and less than 1.

[0029] It should also be noted that, first of all, the contribution of external attack surface impact and internal attack surface impact to network architecture security risk should be clarified. Since Internet access point vulnerabilities are the direct entry point for external attacks, a higher weight factor, such as 0.3, is set. The partner connection risk index reflects the security status of external partners and sets a reasonable weight, such as 0.25. The employee equipment security compliance rate reflects the security awareness and operating specifications of internal employees and sets an appropriate weight, such as 0.2. The average time for repairing internal network vulnerabilities directly affects the efficiency of repairing security incidents and is set to a weight of 0.25, thereby ensuring that the weight factors of external attack surface impact and internal attack surface impact objectively reflect the impact on the overall attack surface assessment.

[0030] The network architecture security assessment module is used to assess whether the network architecture model corresponding to the network architecture within a specified company meets the network engineering security requirements.

[0031] In a specific embodiment, the evaluation specifies whether the network architecture model corresponding to the network architecture within the company meets the network engineering security requirements. The specific evaluation process is as follows: based on the comprehensive attack surface assessment coefficient corresponding to the attack surface of the specified company and the comprehensive score of the network architecture complexity corresponding to the network architecture used by the specified company, the security risk assessment coefficient corresponding to the network architecture used by the specified company is calculated. The security risk assessment coefficient includes values ​​0 and 1. When the security risk assessment coefficient is 0, it indicates that the network architecture model corresponding to the network architecture within the specified company does not meet the network engineering security requirements. When the security risk assessment coefficient is 1, it indicates that the network architecture model corresponding to the network architecture within the specified company meets the network engineering security requirements.

[0032] In a specific embodiment, the security risk assessment coefficient corresponding to the network architecture of a specified company is calculated, and the specific assessment process is as follows: the network architecture complexity corresponding to the network architecture used by the specified company is obtained from a database, the network architecture complexity is divided into technical complexity, logical complexity and interconnection complexity, and a technical complexity score, a logical complexity score and an interconnection complexity score are obtained according to a preset scoring standard, and then a comprehensive network architecture complexity score corresponding to the network architecture used by the specified company is calculated.

[0033] Substitute the network architecture complexity comprehensive score and the comprehensive attack surface assessment coefficient into the security risk assessment expression: The security risk assessment coefficient α corresponding to the specified company's network architecture is obtained, where FS and FD represent the comprehensive attack surface assessment coefficient and the comprehensive score of the network architecture complexity, respectively; λ1 and λ2 represent the weight factors corresponding to the set comprehensive attack surface assessment coefficient and the comprehensive score of the network architecture complexity, respectively; and P represents the security risk assessment coefficient interval.

[0034] It should be noted that the values ​​of λ1 and λ2 are both greater than 0 and less than 1. The setting process of λ1 and λ2 is similar to that of μ1, μ2, and μ 3 The setting process of μ and μ4 is the same and will not be elaborated here.

[0035] It should also be noted that the security risk assessment coefficient interval P is obtained from the database. P is used as the basis for evaluating whether the network architecture model corresponding to the network architecture within the specified company meets the network engineering security requirements. When the value range of P is (20, 30) and the value of (FS*λ1+FD*λ2) is 25, it indicates that the network architecture model corresponding to the network architecture within the specified company meets the network engineering security requirements.

[0036] It should also be noted that, for example, a designated company uses a variety of advanced network technologies in its network architecture, including software-defined networks and virtual private networks. The degree of technological advancement is scored based on industry standards and actual applications. If the software-defined network technology used by the company is at the leading level in the industry and effectively improves the flexibility and manageability of the network, a high score will be given. If the designated company uses a variety of different types of network equipment at the same time, including routers and switches of different brands, the corresponding management difficulty will increase accordingly and the score will decrease. Assuming that according to the preset scoring criteria, the degree of technological advancement accounts for a weight of 0.4, the technological diversity accounts for a weight of 0.3, and the management difficulty accounts for a weight of 0.3, combined with the scoring criteria and expert opinions, the company's technological advancement score is 80 points, the technological diversity score is 70 points, and the management difficulty score is 60 points. Then the technical complexity score = 80×0.4+70×0.3+60×0.3=71 points. The process of obtaining the logical complexity score and the interconnection complexity score is the same as the process of obtaining the technical complexity score, which will not be elaborated here.

[0037] In a specific embodiment, the calculation obtains the network architecture complexity comprehensive score corresponding to the network architecture used by the specified company. The specific calculation process is as follows: Substitute the technical complexity score, the logical complexity score and the interconnection complexity score into the calculation formula The network architecture complexity comprehensive score FD corresponding to the network architecture used by the specified company is obtained, where a, b, and c represent the technical complexity score, logical complexity score, and interconnection complexity score, respectively. They are respectively represented by the set technical complexity scoring weight factor, logical complexity scoring weight factor and interconnection complexity scoring weight factor.

[0038] It should be noted that The values ​​of are greater than 0 and less than 1. The setting process and μ1, μ2, μ 3 The setting process of μ and μ4 is the same and will not be elaborated here.

[0039] The embodiment of the present invention calculates a comprehensive attack surface assessment coefficient, combines external attack surface impact and internal attack surface impact, and is conducive to comprehensively assessing the overall security status of a specified company, providing a scientific basis for subsequent network architecture security assessment and optimization. In the network architecture model assessment process, by assessing whether the network architecture model corresponding to the network architecture within the specified company meets the network engineering security requirements, it is conducive to identifying security vulnerabilities in the existing network architecture, and timely discovering and warning of potential security risks. Through the security risk assessment coefficient, the comprehensive score of network architecture complexity is combined with the comprehensive attack surface assessment coefficient, which is conducive to quantifying the security risk of the network architecture.

[0040] The network architecture optimization module is used to evaluate the optimization process of the corresponding network architecture of the specified company when the network architecture model corresponding to the network architecture within the specified company does not meet the network engineering security requirements.

[0041] In a specific embodiment, the optimization process of evaluating the network architecture corresponding to the designated company is as follows: when the network architecture mode corresponding to the network architecture within the designated company does not meet the network engineering security requirements, the value corresponding to (FS*λ1+FD*λ2) in the security risk level evaluation expression is obtained. When (FS*λ1+FD*λ2) is greater than the upper limit boundary value corresponding to the security risk assessment coefficient interval P, it indicates that the network architecture mode used by the designated company needs to be optimized and downgraded. When (FS*λ1+FD*λ2) is less than the lower limit boundary value corresponding to the security risk assessment coefficient interval P, it indicates that the network architecture mode used by the designated company needs to be optimized and upgraded. When the network architecture mode used by the designated company needs to be optimized and upgraded, the risk index corresponding to each threat event in the network architecture is evaluated, and then an optimization and upgrade plan is formulated to achieve the purpose of optimizing and upgrading the network architecture.

[0042] It should be noted that when the network architecture model used by a designated company needs to be optimized and downgraded, for example, after a security risk assessment, a company finds that the company has too many VPN channels and there are security risks. By closing some channels through optimization and downgrading measures, the network architecture is simplified and potential security risks are reduced.

[0043] In a specific embodiment, the risk index corresponding to each threat event in the network architecture is evaluated. The specific process is as follows: the occurrence probability and the impact assessment value corresponding to each threat event in the network architecture used by the specified company are obtained, and the calculation formula FP i =R i *I i , and obtain the risk index FP corresponding to each threat event in the evaluation network architecture i, i is the number corresponding to each threat event, i = 1, 2, ..., n, n is the total number of threat events, n is a positive integer, where R i ,I i They respectively represent the probability of occurrence and the impact range assessment value after the occurrence of the i-th threat event in the network architecture used by the specified company.

[0044] It should be noted that the attack surface refers to the sum of the entrances or paths that are exploited in the system, including public ports, software defects that may be damaged, and manipulated configuration items. Threat events refer to specific malicious behaviors or events. Malicious behaviors or events will use certain weaknesses in the attack surface to attack or damage. The attack surface is a potential attack channel, and the threat event is an actual attack or threat. The threat event occurs through the attack surface.

[0045] In a specific embodiment, the occurrence probability and the impact range evaluation value after the occurrence corresponding to each threat event in the network architecture used by the specified company are obtained, and the specific acquisition process is as follows: the occurrence probability of each historical threat event corresponding to the specified company when using the same network architecture and the impact range evaluation value after the occurrence of each historical threat event are obtained from the database, and the occurrence probability of each historical threat event and the impact range evaluation value after the occurrence of each historical threat event are used as the occurrence probability and the impact range evaluation value corresponding to each threat event in the network architecture used by the specified company.

[0046] It should be noted that the impact scope assessment value is a comprehensive measure of the potential impact on the company after a threat event occurs. The units of the impact scope assessment value are not unified. The units include but are not limited to the number of users, the amount of economic loss, and the service interruption time. For example, the impact scope assessment value of a server paralysis caused by a virus attack is in "hours", which means that the server paralysis time is 24 hours, while the impact scope assessment value of a data leakage incident is in "number of users", which means that the number of affected users is 500.

[0047] In a specific embodiment, the optimization and upgrading plan is formulated, and the specific process is as follows: In a specific embodiment, the risk index corresponding to each threat event in the network architecture is compared with each risk index interval stored in the database, and each risk index interval corresponds to each risk level. The risk level includes high-risk security domain, medium-risk security domain and low-risk security domain. If the risk index corresponding to a threat event belongs to a certain risk index interval, it indicates that the risk level of the corresponding security domain when the threat event occurs is the risk level corresponding to the risk index interval. In this way, the risk level of the corresponding security domain when each threat event occurs is analyzed, and the optimization and upgrading measures corresponding to each risk level are used, so as to complete the division of the risk level corresponding to each security domain, and then realize the optimization and upgrading of the network architecture.

[0048] It should be noted that the optimization and upgrade measures include but are not limited to strengthening basic security configurations in low-risk security domains, implementing medium-intensity security protection in medium-risk security domains, and adopting advanced security measures in high-risk security domains, such as adding access control lists, deploying intrusion detection systems, real-time monitoring and automatic response systems.

[0049] In the process of optimizing the network architecture model, the embodiment of the present invention evaluates the optimization process of the corresponding network architecture of the specified company, which is conducive to formulating a reasonable optimization and upgrade plan according to the current security risk assessment coefficient, improving the security and stability of the network architecture, and obtaining the occurrence probability and impact range assessment values ​​corresponding to each threat event in the network architecture through the evaluation of the threat event risk index, which is conducive to identifying high-risk threat events, formulating targeted optimization and upgrade measures, and reducing the overall risk level of the network architecture.

[0050] The early warning terminal is used to issue early warning prompts when the network architecture model corresponding to the network architecture within the specified company does not meet the network engineering security requirements and the network architecture model used by the specified company needs to be optimized and upgraded.

[0051] The database is used to store the total time spent on repairing the number of vulnerabilities within a set time period, and also stores the preset maximum possible number of Internet access point vulnerabilities, the preset partner connection risk index range, and the shortest and longest repair times for internal network vulnerability repairs of the designated company before performing attack surface analysis corresponding to the network architecture. It also stores the network architecture complexity corresponding to the network architecture used by the designated company, the probability of occurrence of each historical threat event corresponding to the designated company when using the same network architecture and the impact range assessment value after each historical threat event occurs, and also stores each risk index interval.

[0052] A computer network engineering security control system provided by the present invention, in the process of external attack surface impact division, uses a vulnerability scanning tool to perform vulnerability scanning on network devices connected to the Internet within a set time period, which is conducive to timely discovery and counting of the number of vulnerabilities in Internet access points, thereby effectively reducing potential security risks caused by failure to timely discover vulnerabilities. In the process of internal attack surface impact division, uses device management software to scan and detect employee devices, which is conducive to ensuring that employee devices meet the security standards set by the company, improving the security compliance rate of employee devices, and reducing security risks caused by non-compliant equipment in the internal network.

[0053] The above contents are merely examples and explanations of the concept of the present invention. Those skilled in the art may make various modifications or additions to the specific embodiments described or replace them in a similar manner. As long as they do not deviate from the concept of the invention or exceed the scope defined in this specification, they shall all fall within the protection scope of the present invention.

Claims

1. A computer network engineering security control system, characterized in that: include: The attack surface analysis module is used to divide the attack surface impact corresponding to the specified company into external attack surface impact and internal attack surface impact, and then calculate the corresponding comprehensive attack surface assessment coefficient in the attack surface of the specified company; The network architecture security assessment module is used to assess whether the network architecture model corresponding to the network architecture within a specified company meets the network engineering security requirements; The network architecture optimization module is used to evaluate the optimization process of the network architecture of the specified company when the network architecture mode corresponding to the network architecture of the specified company does not meet the network engineering security requirements; The early warning terminal is used to issue early warning prompts when the network architecture model corresponding to the network architecture within the specified company does not meet the network engineering security requirements and the network architecture model used by the specified company needs to be optimized and upgraded.

2. A computer network engineering security control system according to claim 1, characterized in that: The attack surface impact corresponding to the specified company is divided into external attack surface impact and internal attack surface impact. The specific process is as follows: A1. External attack surface impact includes the number of Internet access point vulnerabilities and partner connection risk index, and internal attack surface impact includes employee device security compliance rate and average time to repair internal network vulnerabilities; A2. Use vulnerability scanning tools to scan the vulnerabilities of Internet-connected network devices in a set time period, and then count the number of vulnerabilities scanned in the set time period. By evaluating the security management system, identity authentication method and data transmission process of the designated company's corresponding partners, the security assessment score, connection method security score and data transmission monitoring score of the designated company's corresponding partners are obtained. The security assessment score, connection method security score and data transmission monitoring score are respectively denoted as sf, cn and sc. The partner connection risk index k of the designated company's corresponding external attack surface is obtained by calculating the formula k=sf*ι1+cn*ι2+sc*ι3, where ι1, ι2 and ι3 respectively represent the weight factors corresponding to the set security assessment score, the weight factors corresponding to the connection method security score and the weight factors corresponding to the data transmission monitoring score; Use device management software to scan and test the devices of each employee in the designated company to test whether each employee's device complies with the security standards set in the designated company, and then obtain the total number of employee devices in the designated company and the number of employee devices that meet the security standards set in the designated company. Divide the number of employee devices that meet the security standards set in the designated company by the total number of employee devices, and the result is the employee device security compliance rate. According to the number of vulnerabilities scanned by the designated company within the set time period, the total time spent on repairing the number of vulnerabilities within the set time period is obtained from the database. The total time spent is divided by the number of vulnerabilities, and the result is the average time for repairing internal network vulnerabilities.

3. A computer network engineering security control system according to claim 2, characterized in that: The calculation obtains the comprehensive attack surface assessment coefficient corresponding to the attack surface of the specified company. The specific calculation process is as follows: The preset maximum possible number of Internet access point vulnerabilities, the preset partner connection risk index range, and the shortest repair time and the longest repair time for the designated company to repair internal network vulnerabilities before the designated company performs the attack surface analysis of the network architecture are obtained from the database, and the preset maximum possible number of Internet access point vulnerabilities, the maximum value of the preset partner connection risk index range, and the shortest repair time and the longest repair time for the internal network vulnerability repair are respectively recorded as N max , k max , T max and T min , calculated by the formula: The corresponding comprehensive attack surface assessment coefficient FS in the specified company's attack surface is obtained, where N, yg, and T represent the number of Internet access point vulnerabilities, the employee equipment security compliance rate, and the average time to repair internal network vulnerabilities, respectively; μ1, μ2, μ3, and μ4 represent the weight factors corresponding to the set number of Internet access point vulnerabilities, the weight factor corresponding to the partner connection risk index, the weight factor corresponding to the employee equipment security compliance rate, and the weight factor corresponding to the average time to repair internal network vulnerabilities, respectively.

4. A computer network engineering security control system according to claim 3, characterized in that: The evaluation specifies whether the network architecture model corresponding to the company's internal network architecture meets the network engineering security requirements. The specific evaluation process is as follows: According to the comprehensive attack surface assessment coefficient corresponding to the attack surface of the specified company and the comprehensive score of the network architecture complexity corresponding to the network architecture used by the specified company, the security risk assessment coefficient corresponding to the network architecture used by the specified company is calculated. The security risk assessment coefficient contains the values ​​0 and 1. When the security risk assessment coefficient is 0, it means that the network architecture mode corresponding to the network architecture within the specified company does not meet the network engineering security requirements. When the security risk assessment coefficient is 1, it means that the network architecture mode corresponding to the network architecture within the specified company meets the network engineering security requirements.

5. A computer network engineering security control system according to claim 4, characterized in that: The calculation specifies the security risk assessment coefficient corresponding to the company's network architecture. The specific assessment process is as follows: Obtaining the network architecture complexity corresponding to the network architecture used by the specified company from the database, dividing the network architecture complexity into technical complexity, logical complexity and interconnection complexity, and obtaining the technical complexity score, logical complexity score and interconnection complexity score according to the preset scoring criteria, and then calculating the comprehensive network architecture complexity score corresponding to the network architecture used by the specified company; Substitute the network architecture complexity comprehensive score and the comprehensive attack surface assessment coefficient into the security risk assessment expression: The security risk assessment coefficient α corresponding to the specified company's network architecture is obtained, where FS and FD represent the comprehensive attack surface assessment coefficient and the comprehensive score of the network architecture complexity, respectively; λ1 and λ2 represent the weight factors corresponding to the set comprehensive attack surface assessment coefficient and the comprehensive score of the network architecture complexity, respectively; and P represents the security risk assessment coefficient interval.

6. A computer network engineering security control system according to claim 5, characterized in that: The calculation obtains the comprehensive score of network architecture complexity corresponding to the network architecture used by the specified company. The specific calculation process is as follows: Substitute the technical complexity score, logical complexity score, and interconnection complexity score into the calculation formula The network architecture complexity comprehensive score FD corresponding to the network architecture used by the specified company is obtained, where a, b, and c represent the technical complexity score, logical complexity score, and interconnection complexity score, respectively. They are respectively represented by the set technical complexity scoring weight factor, logical complexity scoring weight factor and interconnection complexity scoring weight factor.

7. A computer network engineering security control system according to claim 6, characterized in that: The evaluation specifies the optimization process of the company's corresponding network architecture. The specific evaluation process is as follows: When the network architecture mode corresponding to the network architecture within the specified company does not meet the network engineering security requirements, obtain the value corresponding to (FS*λ1+FD*λ2) in the security risk level assessment expression. When (FS*λ1+FD*λ2) is greater than the upper boundary value corresponding to the security risk assessment coefficient interval P, it indicates that the network architecture mode used by the specified company needs to be optimized and downgraded. When (FS*λ1+FD*λ2) is less than the lower boundary value corresponding to the security risk assessment coefficient interval P, it indicates that the network architecture mode used by the specified company needs to be optimized and upgraded. When the network architecture mode used by the specified company needs to be optimized and upgraded, the risk index corresponding to each threat event in the network architecture is evaluated, and then an optimization and upgrade plan is formulated to achieve the purpose of optimizing and upgrading the network architecture.

8. A computer network engineering security control system according to claim 7, characterized in that: The specific process of evaluating the risk index corresponding to each threat event in the network architecture is as follows: Obtain the occurrence probability and impact assessment value of each threat event in the network architecture used by the specified company, and calculate the probability of occurrence and impact assessment value after occurrence by the formula FP i =R i *I i , and obtain the risk index FP corresponding to each threat event in the evaluation network architecture i , i is the number corresponding to each threat event, i = 1, 2, ..., n, n is the total number of threat events, n is a positive integer, where R i ,I i They respectively represent the probability of occurrence and the impact range assessment value after the occurrence of the i-th threat event in the network architecture used by the specified company.

9. A computer network engineering security control system according to claim 8, characterized in that: The specific acquisition process of obtaining the occurrence probability and impact range assessment value of each threat event in the network architecture used by the specified company is as follows: The occurrence probability of each historical threat event and the impact range assessment value after each historical threat event corresponding to the specified company when using the same network architecture are obtained from the database, and the occurrence probability of each historical threat event and the impact range assessment value after each historical threat event are used as the occurrence probability and impact range assessment value corresponding to each threat event in the network architecture used by the specified company.

10. A computer network engineering security control system according to claim 9, characterized in that: The specific process of formulating the optimization and upgrading plan is as follows: The risk index corresponding to each threat event in the network architecture is compared with the risk index intervals stored in the database. Each risk index interval corresponds to a risk level, which includes high-risk security domain, medium-risk security domain and low-risk security domain. If the risk index corresponding to a threat event belongs to a certain risk index interval, it means that the risk level of the corresponding security domain when the threat event occurs is the risk level corresponding to the risk index interval. In this way, the risk level of the corresponding security domain when each threat event occurs and the optimization and upgrading measures corresponding to each risk level are analyzed, thereby completing the division of the risk level corresponding to each security domain, and then realizing the optimization and upgrading of the network architecture.

Images