Network security supervision platform based on network security operation

Abstract

The invention discloses a network security supervision platform based on network security operation, which relates to the technical field of network security, and comprises a network operation data acquisition module, an exposed surface depth evaluation module, an exposed surface processing module and a web data warehouse, according to the invention, the exposed surface depths of the specified operation system at the asset operation level, the business operation level and the offline management level are respectively evaluated through the asset operation data, the business operation data and the offline management data of the specified operation system, so that the specified operation system is prevented from being attacked from multiple levels, and the risk evaluation is relatively comprehensive; the network security of a specified operation system is improved; meanwhile, the early warning response signal of the specified operation system is generated, and support is provided for a follow-up security team to judge which layers need to be protected preferentially, so that the follow-up security team is prevented from mistakenly judging which layers need to be protected preferentially, the maintenance efficiency of the specified operation system is improved, and the network risk of the specified operation system is reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a network security monitoring platform based on network security operation. Background Art

[0002] In the digital age, the Internet has become an important part of human social life. All walks of life rely on the Internet for daily operations and communication. However, with the rapid development and popularization of network technology, network security issues have become increasingly prominent and have become the focus of global attention. Therefore, strengthening network security supervision is particularly important and necessary.

[0003] Prior art, such as the invention application patent with announcement number: CN114021154B, discloses a network security risk assessment system, including a server and a client. The server includes a service module, an asset assessment standard module, an asset identification module, an asset value assignment and sorting module, a risk assessment module a, an assessment result display module, an existing security means analysis module and a risk assessment module b. The asset value assignment and sorting module is used to assign values ​​to assets according to their importance and sort them. The risk assessment module a is used to perform risk assessment on assets selected by users. The existing security means analysis module is used to analyze and count the internal security means set on the existing network. The risk assessment module b is used to combine the existing security means to derive the risk level of specific assets. The client includes a login module and a display module. The invention can perform risk assessment on specific assets according to customer needs, greatly reducing the information risk management budget and having a wide range of applications.

[0004] The prior art, such as the network security risk assessment system disclosed in the invention application patent with announcement number CN113225358B, includes a server and client using a C / S architecture, and an agent installed in the target system for assessment. The server includes: an assessment engine service module, a vulnerability library, a historical assessment record, a fusion assessment module, and an identity authentication module. The client includes: a login module, a scanning configuration module, a feedback processing module, and an assessment result library. The agent of the target system for assessment includes: an information collection module, a machine learning module, a machine learning update module, an anomaly detection module, and an asset scanning module. The invention provides a more comprehensive and objective assessment of network security risks.

[0005] Combining the above solutions, it can be found that there is rarely an analysis of the depth of exposure of the network operation system in the existing technology. The depth of exposure of the designated operation system at the asset operation level, business operation level and offline management level is highly correlated with the vulnerability of the designated operation system to attacks. The neglect of this level in the existing technology leads to incomplete risk assessment. The designated operation system is vulnerable to network attacks from the asset operation level, business operation level or offline management level, which reduces the network security of the designated operation system, thereby causing the subsequent security team to judge which levels need priority protection. The error rate increases, reduces the maintenance efficiency of the designated operation system, and increases the network risk of the designated operation system to a certain extent. Summary of the invention

[0006] The purpose of the present invention is to provide a network security monitoring platform based on network security operation, which solves the problems existing in the background technology.

[0007] To solve the above technical problems, the present invention adopts the following technical solutions: The present invention provides a network security supervision platform based on network security operation, including: a network operation data acquisition module, used to obtain network operation data from a designated operation system, wherein the network operation data includes asset operation data, business operation data, and obtains offline management data.

[0008] The exposure depth assessment module is used to assess the exposure depth of a specified operating system at the asset operation level, business operation level and offline management level.

[0009] The exposed surface processing module is used to generate early warning response signals for the specified operating system.

[0010] The beneficial effect of the present invention is that the present invention obtains relevant data of the specified operating system in the network operation data acquisition module, laying a data foundation for the subsequent evaluation of the exposure depth of the specified operating system at the asset operation level, business operation level and offline management level.

[0011] The present invention evaluates the exposure depth of the designated operating system at the asset operation level, business operation level and offline management level respectively through the asset operation data, business operation data and offline management data of the designated operating system in the exposure depth assessment module, thereby making up for the deficiencies in the prior art, preventing the designated operating system from being attacked from multiple levels, and providing a more comprehensive risk assessment, thereby improving the network security of the designated operating system.

[0012] The present invention generates an early warning response signal for a designated operating system in an exposed surface processing module, providing support for subsequent security teams to determine which layers require priority protection, thereby avoiding subsequent security teams from making incorrect judgments about which layers require priority protection, improving the maintenance efficiency of designated operating systems, and reducing network risks of designated operating systems to a certain extent. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0014] Figure 1 It is a schematic diagram of the system structure connection of the present invention. DETAILED DESCRIPTION

[0015] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0016] Reference Figure 1 As shown, the present invention provides a network security supervision platform based on network security operation, including: a network operation data acquisition module, an exposure surface depth assessment module, an exposure surface processing module and a web data warehouse.

[0017] It should be noted that the network operation data acquisition module is connected to the exposure surface depth assessment module, the exposure surface depth assessment module is connected to the exposure surface processing module, and the web data warehouse is connected to the exposure surface depth assessment module and the exposure surface processing module respectively.

[0018] The network operation data acquisition module is used to acquire network operation data from a designated operation system, wherein the network operation data includes asset operation data and business operation data, and to acquire offline management data.

[0019] The present invention obtains relevant data of a designated operating system in a network operation data acquisition module, laying a data foundation for subsequent evaluation of the exposure depth of the designated operating system at the asset operation level, business operation level and offline management level.

[0020] In a specific embodiment of the present invention, the asset operation data includes characteristic parameters of each network asset, characteristic parameters of each data asset and characteristic parameters of each physical asset.

[0021] The characteristic parameters of each network asset include the number of each external network device and the number of vulnerabilities of each internal device.

[0022] It should be noted that the external network devices include but are not limited to servers, websites and cloud services, and the internal devices include but are not limited to computers, printers and network storage devices.

[0023] The characteristic parameters of each data asset include the convenient access value and sharing degree of each key data.

[0024] It should be noted that the key data include but are not limited to customer information and financial data.

[0025] The characteristic parameters of each physical asset include a location security value of the office location, a security value of the access control system, a security value of the monitoring system, and a security value of the anti-theft alarm system.

[0026] The business operation data includes the network status security value and logistics protection security value of each supplier.

[0027] The offline management data includes authority allocation characteristic values, safety training characteristic values ​​and competition form characteristic values.

[0028] In a specific embodiment of the present invention, the convenient access value and sharing degree of each key data are specifically obtained by: obtaining each storage location of each key data from a designated operating system, and obtaining the number of sharing channels corresponding to each storage location from the designated operating system, screening the number of sharing channels of each storage location of each key data of the designated operating system, screening to obtain each high-risk storage location and each low-risk storage location of each key data of the designated operating system, and summarizing to obtain the number of high-risk storage locations of each key data of the designated operating system.

[0029] It should be noted that the screening obtains each high-risk storage location and each low-risk storage location of each key data of the specified operating system, and compares the number of shared channels of each storage location of each key data of the specified operating system with the preset shared channel convergence number. If the number of shared channels of a storage location is greater than the shared channel convergence number, the storage location is recorded as a high-risk storage location, otherwise, it is recorded as a low-risk storage location, and the high-risk storage locations and each low-risk storage location of each key data of the specified operating system are obtained by screening.

[0030] Summarize the total number of storage locations for each key data of the specified running system , specify the total number of storage locations for key data of the running system, the number of high-risk storage locations Import to convenient access value evaluation model Output the convenient access value of each key data ,in is the number of suitable storage locations for the i-th key data stored in the web data warehouse, is the number of each key data, .

[0031] Obtain the protection characteristic value of each transmission of each key data from the specified running system , import it into the sharing evaluation model In the output, the sharing degree of each key data is output. is the number of each transmission, , It is represented as the required protection characteristic value of the i-th key data stored in the web data warehouse.

[0032] It should be noted that the protection characteristic value is a numerical value of 0-1, which reflects the effectiveness of the protection measures taken by the specified operating system when transmitting key data. For example, if the protection measures taken are stronger, the protection characteristic value is larger, and if the protection measures taken are poorer, the protection characteristic value is smaller. The protection characteristic value taken is specifically set by professionals.

[0033] It should also be noted that the required protection characteristic value of each key data is specifically determined by the staff of the designated operating system based on the key data. For example, the required protection characteristic value of financial data is greater than the required protection characteristic value of customer information.

[0034] In a specific embodiment of the present invention, the location security value of the office location is obtained by: obtaining characteristic parameters of various meteorological data of the office location of the designated operating system from the meteorological management center. , and import it into the meteorological safety value assessment model Output the weather safety value of the office location , is the number of each meteorological data, , is the suitable characteristic parameter interval of the pth meteorological data of the office location stored in the web data warehouse.

[0035] The threat value of the office location of the designated operating system is obtained from the public management center, and combined with the meteorological safety value of the office location of the designated operating system, the location safety value of the office location of the designated operating system is analyzed and obtained.

[0036] It should be noted that the threat value of the office location is a numerical value of 0-1, which reflects the public security effect of the office location of the designated operating system. For example, if the number of public security cases in the office location of the designated operating system is small, the smaller the threat value of the office location is; if the number of public security cases in the office location of the designated operating system is large, the greater the threat value of the office location is. The threat value of the office location is obtained by homogenizing the number of public security cases in the office location of the designated operating system with the number of public security cases in other locations.

[0037] It should also be noted that the specific analysis method of the location security value of the office location of the designated operating system is: averaging the threat value and meteorological safety value of the office location of the designated operating system to obtain the location security value of the office location of the designated operating system.

[0038] In a specific embodiment of the present invention, the security value of the access control system, the security value of the monitoring system and the security value of the anti-theft alarm system are obtained by: obtaining the duration of each fault of the access control system from the specified operating system , event keyword set , after processing, the security value of the access control system is obtained , where is the total number of failures of the access control system, , , are the allowed number of failures, allowed failure duration, and risk event keyword set of the access control system stored in the web data warehouse. is the number of each fault, .

[0039] The volume V, average frame rate Z, average throughput U and average delay time TI of the monitoring system coverage are obtained from the specified running system, and the safety value of the monitoring system is obtained after processing. , where V', Z', U', and TI' represent the volume of the office location of the specified operating system stored in the web data warehouse, the required frame rate, required throughput, and allowed delay time of the monitoring system, respectively.

[0040] It should be noted that the required frame rate, required throughput and allowed delay duration of the monitoring system are determined by multiplying the volume of the office location where the designated operating system is located by the required frame rate, required throughput and allowed delay duration of the monitoring system corresponding to the unit volume stored in the web data warehouse to obtain the required frame rate, required throughput and allowed delay duration of the monitoring system.

[0041] The false alarm rate WI and detection rate JI of the anti-theft alarm system are obtained from the specified running system, and the safety value of the anti-theft alarm system is obtained after processing. , where WI' and JI' represent the required false alarm rate and required detection rate of the anti-theft alarm system of the specified running system stored in the web data warehouse, respectively.

[0042] It should be noted that in order to ensure the safe and stable operation of the anti-theft alarm system, the anti-theft alarm system is usually tested. For example, in a simulated actual environment, by arranging various scenarios that may cause false alarms, the response of the anti-theft alarm system is obtained to evaluate its false alarm rate and detection rate, and upload them to the designated operating system.

[0043] The false alarm rate specifically refers to the proportion of alarms triggered by non-anti-theft tags.

[0044] The detection rate is specifically obtained by averaging the number of alarms when a unit number of valid tags passes through different positions of the detection area in different directions to obtain the detection rate.

[0045] It should also be noted that the required false alarm rate and required detection rate of the anti-theft alarm system of the designated operating system are specifically uploaded by the staff of the designated operating system. For example, in order to improve the anti-theft alarm performance of the designated operating system, the required false alarm rate is lowered and the required detection rate is increased.

[0046] In a specific embodiment of the present invention, the network status security value and logistics protection security value of each supplier are obtained by: obtaining the review and confirmation value of each supplier from the designated operation system , and crawled the security incident reports of each supplier from the public network security emergency response center, and extracted the keyword set of each security incident of each supplier and number of associated devices , after processing, the network status security value of each supplier is obtained , is the number of each supplier, , is the number of each security incident, .

[0047] It should be noted that the review and authorization value of each supplier is specifically a value of 0 or 1, which reflects whether the designated operating system conducts a security review of the supplier. If a security review is conducted on the supplier, the review and authorization value is 1, otherwise, the review and authorization value is 0.

[0048] It should be noted that the specific calculation formula of the network status security value of each supplier is as follows: , where E', They are respectively the set of network risk event keywords stored in the web data warehouse and the total number of devices of the hth supplier.

[0049] Obtain the historical logistics delivery data of each supplier from the designated operation system, where the historical logistics delivery data includes the cargo tracking characteristic values ​​of each logistics delivery. , safe packaging characteristic value and the proportion of goods mispaid , after processing, the logistics protection safety value of each supplier is obtained , The number of each logistics delivery. .

[0050] The specific calculation formula of the logistics protection safety value is: .

[0051] It should be noted that when the designated operating system establishes a cooperative relationship with a supplier, the supplier is usually required to provide capital verification data, which includes historical logistics delivery data and is uploaded by the supplier to the designated operating system.

[0052] It should also be noted that the cargo tracking characteristic value is specifically a value of 0 or 1, which reflects whether the supplier adopts a cargo tracking system during the logistics delivery process. If a cargo tracking system is adopted, the cargo tracking characteristic value is 1, otherwise, the cargo tracking characteristic value is 0. The safe packaging characteristic value is specifically a value of 0 or 1, which reflects whether the supplier safely packages the goods during the logistics delivery process. If the goods are safely packaged, the safe packaging characteristic value is 1, otherwise, the cargo tracking characteristic value is 0. The cargo mispayment ratio includes the total number of tampered, lost or stolen goods divided by the total number of goods.

[0053] It should be noted again that if the supplier adopts a cargo tracking system or safely packages the goods during the logistics delivery process, it means that the supplier has better protective measures during the logistics delivery process, avoiding the risks of business interruption and information leakage for the enterprise to which the designated operating system belongs, thereby reducing the exposure of the enterprise to which the designated operating system belongs. Therefore, it is necessary to analyze the cargo tracking characteristic values ​​and safe packaging characteristic values ​​of the supplier during the logistics delivery process.

[0054] In a specific embodiment of the present invention, the authority allocation characteristic value, security training characteristic value and competition form characteristic value are specifically obtained by obtaining the assigned authority level corresponding to each employee of each functional level from the designated operating system, and combining the initial assigned authority level corresponding to each functional level stored in the web data warehouse to determine the authority allocation characteristic value of the designated operating system.

[0055] It should be noted that the specific determination method for determining the authority allocation characteristic value of the specified operating system is: comparing the allocated authority level of each employee of each functional level of the specified operating system with the initial allocated authority level; if the allocated authority level of an employee is consistent with the initial allocated authority level, the authority allocation characteristic value of the employee is recorded as H; otherwise, it is recorded as H', where H>H'; the authority allocation characteristic value of each employee of each functional level is obtained, and the average is processed to obtain the authority allocation characteristic value of the specified operating system.

[0056] It should be noted that during the work process of the designated operating system, it is usually necessary to set permission levels for employees to ensure the safety of employees when using the designated operating system. In actual use, in order to facilitate work, other permission levels are often opened to employees. If they are not closed, it will affect the safety of employees using the designated operating system and increase the risk of leakage. Therefore, it is necessary to compare and analyze the assigned permission levels of each employee at each functional level of the designated operation.

[0057] The type and time point of each security training are obtained from the specified operating system. If the type of a security training is network security, then the security training is recorded as network security training. Each network security training is screened and the time point of each network security training is obtained. The frequency of network security training for the specified operating system is calculated and divided by the frequency of appropriate network security training stored in the web data warehouse to obtain the security training characteristic value of the specified operating system.

[0058] Obtain each competing enterprise from the designated operating system, and crawl the number of risk behaviors of each competing enterprise from the public network security emergency response center, summarize the total number of risk behaviors of the competing enterprises in the designated operating system, and divide it by the total number of allowed risk behaviors of the designated operating system stored in the web data warehouse to obtain the ratio of the number of risk behaviors of the competing enterprises in the designated operating system to the number of allowed risk behaviors, and invert it to obtain the competition morphology characteristic value of the designated operating system.

[0059] It should be noted that the total number of risky behaviors allowed in the designated operating system is specifically uploaded by the staff of the designated operating system. For example, in order to avoid attacks on the designated operating system by competing enterprises, the total number of risky behaviors allowed in the designated operating system is reduced.

[0060] The exposure depth assessment module is used to assess the exposure depth of a specified operating system at the asset operation level, business operation level and offline management level.

[0061] The present invention evaluates the exposure depth of the designated operating system at the asset operation level, business operation level and offline management level respectively through the asset operation data, business operation data and offline management data of the designated operating system in the exposure depth assessment module, thereby making up for the deficiencies in the prior art, preventing the designated operating system from being attacked from multiple levels, and providing a more comprehensive risk assessment, thereby improving the network security of the designated operating system.

[0062] In a specific embodiment of the present invention, the exposure depth of the designated operating system at the asset operation level, the business operation level and the offline management level is evaluated by a specific evaluation method: based on the characteristic parameters of each network asset, each data asset and each physical asset in the asset operation data of the designated operating system, the exposure depth model of the asset operation level is processed to output the exposure depth of the designated operating system at the asset operation level. .

[0063] Based on the network status security value and logistics protection security value of each supplier in the business operation data of the specified operation system, the exposure depth model at the business operation level Processing, output the exposure depth of the specified operating system at the business operation level .

[0064] Based on the characteristic value of authority allocation in offline management data of specified operating system , Safety training characteristic value and competitive morphological eigenvalues , the depth model of exposure to management layers below the warp line Processing, output the exposure depth of the specified operating system at the asset operation level .

[0065] In a specific embodiment of the present invention, the asset operation level exposure surface depth model is specifically: , where , , They are respectively represented as the characteristic parameters of the rth network asset, the vth data asset, and the xth physical asset. , , They are respectively represented as the security feature parameter interval of the rth network asset, the security feature parameter interval of the vth data asset, and the security feature parameter interval of the xth physical asset stored in the web data warehouse. is the ID of each network asset, , is the ID of each data asset, , is the number of each physical asset, .

[0066] The exposed surface processing module is used to generate an early warning response signal for a designated operating system.

[0067] The present invention generates an early warning response signal for a designated operating system in an exposed surface processing module, providing support for subsequent security teams to determine which layers require priority protection, thereby avoiding subsequent security teams from making incorrect judgments about which layers require priority protection, improving the maintenance efficiency of designated operating systems, and reducing network risks of designated operating systems to a certain extent.

[0068] In a specific embodiment of the present invention, the generation of the early warning response signal of the designated operating system is specifically generated by: based on the exposure depth of the designated operating system at the asset operation level, business operation level and offline management level, if , then an early warning response signal is generated for the specified operating system at the asset operation level.

[0069] like , then an early warning response signal is generated for the specified operating system at the business operation level.

[0070] like , then an early warning response signal is generated for the offline management level of the specified operating system.

[0071] Said , , They are respectively represented by the exposure depth convergence value of the specified operating system stored in the web data warehouse at the asset operation level, the exposure depth convergence value at the business operation level, and the exposure depth convergence value at the offline management level.

[0072] The early warning response signal of the specified operating system is obtained by summarizing.

[0073] The above contents are merely examples and explanations of the concept of the present invention. Those skilled in the art may make various modifications or additions to the specific embodiments described or replace them in a similar manner. As long as they do not deviate from the concept of the invention or exceed the scope defined by the present invention, they shall all fall within the protection scope of the present invention.

Claims

1. A network security supervision platform based on network security operation, characterized in that: include: A network operation data acquisition module is used to acquire network operation data from a specified operation system, wherein the network operation data includes asset operation data, business operation data, and offline management data; The exposure depth assessment module is used to assess the exposure depth of a specified operating system at the asset operation level, business operation level and offline management level; The exposed surface processing module is used to generate early warning response signals for the specified operating system.

2. A network security monitoring platform based on network security operation according to claim 1, characterized in that: The asset operation data includes characteristic parameters of each network asset, characteristic parameters of each data asset and characteristic parameters of each physical asset; The characteristic parameters of each network asset include the number of each external network device and the number of vulnerabilities of each internal device; The characteristic parameters of each data asset include the convenient access value and sharing degree of each key data; The characteristic parameters of each physical asset include the location security value of the office location, the security value of the access control system, the security value of the monitoring system and the security value of the anti-theft alarm system; The business operation data includes the network status security value and logistics protection security value of each supplier; The offline management data includes authority allocation characteristic values, safety training characteristic values ​​and competition form characteristic values.

3. A network security supervision platform based on network security operation according to claim 2, characterized in that: The convenient access value and sharing degree of each key data are specifically obtained as follows: Obtain each storage location of each key data from the designated operating system, and obtain the number of shared channels corresponding to each storage location from the designated operating system, filter the number of shared channels of each storage location of each key data of the designated operating system, filter out each high-risk storage location and each low-risk storage location of each key data of the designated operating system, and summarize to obtain the number of high-risk storage locations of each key data of the designated operating system; Summarize the total number of storage locations for each key data of the specified running system , specify the total number of storage locations for key data of the running system, the number of high-risk storage locations Import to convenient access value evaluation model Output the convenient access value of each key data ,in is the number of suitable storage locations for the i-th key data stored in the web data warehouse, is the number of each key data, ; Obtain the protection characteristic value of each transmission of each key data from the specified running system , import it into the sharing evaluation model In the output, the sharing degree of each key data is output. is the number of each transmission, , It is represented as the required protection characteristic value of the i-th key data stored in the web data warehouse.

4. A network security supervision platform based on network security operation according to claim 2, characterized in that: The location security value of the office location is specifically obtained by: Obtain the characteristic parameters of each meteorological data of the office location where the specified operation system is located from the meteorological management center , and import it into the meteorological safety value assessment model Output the weather safety value of the office location , is the number of each meteorological data, , is the suitable characteristic parameter interval of the pth meteorological data of the office location stored in the web data warehouse; The threat value of the office location of the designated operating system is obtained from the public management center, and combined with the meteorological safety value of the office location of the designated operating system, the location safety value of the office location of the designated operating system is analyzed and obtained.

5. A network security monitoring platform based on network security operation according to claim 2, characterized in that: The specific method for obtaining the security value of the access control system, the security value of the monitoring system and the security value of the anti-theft alarm system is as follows: Get the duration of each fault of the access control system from the specified operating system , event keyword set , after processing, the security value of the access control system is obtained , where is the total number of failures of the access control system, , , are the allowed number of failures, allowed failure duration, and risk event keyword set of the access control system stored in the web data warehouse. is the number of each fault, ; The volume V, average frame rate Z, average throughput U and average delay time TI of the monitoring system coverage are obtained from the specified running system, and the safety value of the monitoring system is obtained after processing. , where V', Z', U', and TI' represent the volume of the office location of the specified operating system stored in the web data warehouse, the required frame rate, required throughput, and allowed delay time of the monitoring system, respectively; The false alarm rate WI and detection rate JI of the anti-theft alarm system are obtained from the specified running system, and the safety value of the anti-theft alarm system is obtained after processing. , where WI' and JI' represent the required false alarm rate and required detection rate of the anti-theft alarm system of the specified running system stored in the web data warehouse, respectively.

6. A network security monitoring platform based on network security operation according to claim 2, characterized in that: The specific method for obtaining the network status security value and logistics protection security value of each supplier is as follows: Obtain the audit and confirmation values ​​of each supplier from the designated operating system , and crawl to obtain the security incident reports of each supplier, and extract the keyword set of each security incident of each supplier and number of associated devices , after processing, the network status security value of each supplier is obtained , is the number of each supplier, , is the number of each security incident, ; Obtain the historical logistics delivery data of each supplier from the designated operation system, where the historical logistics delivery data includes the cargo tracking characteristic values ​​of each logistics delivery. , safe packaging characteristic value and the proportion of goods mispaid , after processing, the logistics protection safety value of each supplier is obtained , The number of each logistics delivery. .

7. A network security monitoring platform based on network security operation according to claim 2, characterized in that: The specific method for obtaining the authority allocation characteristic value, the security training characteristic value and the competition form characteristic value is as follows: Obtain the assigned authority level corresponding to each employee of each functional level from the designated operation system, and determine the authority allocation characteristic value of the designated operation system in combination with the initial assigned authority level corresponding to each functional level stored in the web data warehouse; The type and time point of each security training are obtained from the specified operating system. If the type of a security training is network security, the security training is recorded as network security training. Each network security training is screened and the time point of each network security training is obtained. The frequency of network security training of the specified operating system is calculated and divided by the frequency of appropriate network security training stored in the web data warehouse to obtain the security training characteristic value of the specified operating system. Obtain each competing enterprise from the designated operating system, crawl and obtain the number of risky behaviors of each competing enterprise, summarize the total number of risky behaviors of the competing enterprises in the designated operating system, and divide it by the total number of allowed risky behaviors of the designated operating system stored in the web data warehouse to obtain the ratio of the number of risky behaviors of the competing enterprises in the designated operating system to the number of allowed risky behaviors, invert it, and obtain the competition morphology characteristic value of the designated operating system.

8. A network security monitoring platform based on network security operation according to claim 2, characterized in that: The assessment specifies the depth of exposure of the operating system at the asset operation level, business operation level and offline management level. The specific assessment method is as follows: Based on the characteristic parameters of each network asset, each data asset and each physical asset in the asset operation data of the specified operation system, the exposure depth model of the asset operation layer is used to output the exposure depth of the specified operation system at the asset operation layer. ; Based on the network status security value and logistics protection security value of each supplier in the business operation data of the specified operation system, the exposure depth model at the business operation level is processed to output the exposure depth of the specified operation system at the business operation level. ; Based on the authority allocation feature value, security training feature value and competition form feature value in the offline management data of the specified operating system, the exposure depth model at the offline management level is processed to output the exposure depth of the specified operating system at the asset operation level. .

9. A network security monitoring platform based on network security operation according to claim 8, characterized in that: The asset operation level exposure depth model is specifically: , where , , They are respectively represented as the characteristic parameters of the rth network asset, the vth data asset, and the xth physical asset. , , They are respectively represented as the security feature parameter interval of the rth network asset, the security feature parameter interval of the vth data asset, and the security feature parameter interval of the xth physical asset stored in the web data warehouse. is the ID of each network asset, , is the ID of each data asset, , is the number of each physical asset, .

10. A network security monitoring platform based on network security operation according to claim 8, characterized in that: The specific generation method of the early warning response signal of the specified operating system is as follows: Based on the exposure depth of the specified operating system at the asset operation level, business operation level and offline management level, if , then an early warning response signal of the designated operating system at the asset operation level is generated; like , then an early warning response signal is generated for the designated operating system at the business operation level; like , then an early warning response signal is generated at the offline management level of the designated operating system; Said , , They are respectively represented by the exposure depth convergence value of the specified operating system at the asset operation level, the exposure depth convergence value at the business operation level, and the exposure depth convergence value at the offline management level stored in the web data warehouse; The early warning response signal of the specified operating system is obtained by summarizing.

Images