Network data risk assessment system for computer

Abstract

The invention, which relates to the technical field of data security monitoring, discloses a network data risk assessment system for a computer, comprising a data monitoring platform. The data monitoring platform is in communication connection with a data acquisition module, a data preprocessing module, an anomaly detection module, a threat evaluation module, an automatic alarm module, a response strategy generation module and a report generation module, and all the modules are in electric signal connection. According to the network data risk assessment system for the computer, the functions of anomaly detection, threat assessment, response strategy generation and automatic alarm are integrated, rapid detection and response to network threats are achieved, abnormal mode recognition is conducted through the machine learning technology, potential security threats are found, the recognition accuracy of abnormal behaviors is improved, and in addition, the network data risk assessment system for the computer has the advantages of being high in practicability and easy to popularize. And preset protection measures are automatically triggered, so that quick response is realized when high-risk threats are detected, and the damage of security incidents to the system is reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of data security monitoring, in particular to a network data risk assessment system for computers. Background Art

[0002] With the rapid development of information technology and the popularization of the Internet, computer networks have become an indispensable infrastructure in modern society. However, this also makes cyberspace face increasingly complex threats, such as hacker attacks, data leaks, malware, etc. These threats may not only lead to the loss or leakage of important information, but also affect the normal operation of the enterprise, and even bring significant economic losses and reputation risks. Therefore, risk assessment of network data has become an important measure to ensure network security.

[0003] In the existing technology, the network environment changes rapidly and there is interference from multi-dimensional data, making it difficult to identify and evaluate new security threats in real time, resulting in a delayed response of the system when facing sudden security incidents and an inability to take effective protective measures in time. Therefore, how to improve the efficiency of identifying abnormal patterns in order to quickly respond to protective measures is a problem we need to solve. To this end, a network data risk assessment system for computers is proposed. Summary of the invention

[0004] To achieve the above objectives, the present invention is implemented through the following technical solutions: A network data risk assessment system for a computer, comprising a data monitoring platform, wherein the data monitoring platform is communicatively connected with a data acquisition module, a data preprocessing module, an anomaly detection module, a threat assessment module, an automatic alarm module, a response strategy generation module and a report generation module, wherein the modules are connected by electrical signals; The data acquisition module collects various raw data from various network devices and systems, including flow data, log files, and system status information, to ensure the comprehensiveness and real-time nature of the data and provide basic data support for risk assessment; The data preprocessing module is used to clean, format and normalize the collected raw data, remove noise and redundant information, and extract abnormal features for risk assessment from the preprocessed data to obtain abnormal network traffic feature sets and abnormal system status feature sets, thereby improving data processing efficiency, providing high-quality data sets for subsequent analysis, and converting large amounts of data into key features, so that the model can perform risk assessment more efficiently; The anomaly detection module uses machine learning algorithms combined with abnormal features to identify abnormal patterns in preprocessed data, discover potential security threats, quickly and accurately identify abnormal behaviors in the network, and provide clues for timely response; The threat assessment module is used to conduct in-depth analysis of detected abnormal behaviors, assess their potential threat levels, including threat types and impact scope, determine their potential risk levels to the system, provide accurate threat intelligence for formulating protective measures, and ensure effective allocation of resources; The automatic alarm module continuously monitors the network status and performs real-time monitoring and alarm for abnormal situations; The response strategy generation module is used to automatically generate and recommend corresponding level of protection strategies according to the threat assessment results; The report generation module is used to record all key events and operations during system operation and generate detailed audit logs and risk assessment reports.

[0005] Preferably, in the data acquisition module, the process of collecting raw data includes: Identify the network devices and systems that need to collect data, including servers, routers, firewalls, intrusion detection systems, and applications, and identify the data sources to ensure the comprehensiveness of data collection; Determine the data type, collection frequency, and data storage format and location based on the network devices and systems that need to collect data. The data types include network traffic data, system status information, and log files. Configure data collection methods based on different data types. According to the data collection objectives and methods, deploy data collection agents on various data sources, configure corresponding data collectors, set collection parameters and rules, ensure that the data collectors can run stably and reliably connect with target network devices and systems; The data collector captures the raw data of network traffic data and system status information from the target network devices and systems, converts them into a unified data format, and transmits them to the central data warehouse through the network.

[0006] Preferably, in the data preprocessing module, the process of acquiring the abnormal network traffic feature set and the abnormal system status feature set includes: Perform preprocessing operations on the collected network traffic data, system status information, and raw data of log files, including cleaning, formatting, and normalization steps; Use correlation coefficients in combination with preprocessed network traffic data and system status information data to identify features associated with risk assessment, perform feature extraction, obtain abnormal features for risk assessment, extract associated data of abnormal network traffic and abnormal system status information, and form an abnormal network traffic feature set and an abnormal system status feature set, wherein the abnormal features of network traffic data include sudden increase in traffic, sudden decrease in traffic, abnormal traffic pattern, abnormal data packet size, and frequent connection failures, and the abnormal features of system status information include sudden increase in CPU usage, sudden increase in memory usage, sudden increase in disk usage, abnormal network connection, and system configuration changes; The abnormal features in the abnormal network traffic feature set and the abnormal system status feature set are encoded and processed, and non-numeric data are converted into numerical data to make the data suitable for numerical calculation.

[0007] Preferably, in the anomaly detection module, the process of identifying an abnormal pattern includes: Extracting abnormal network traffic data and associated data of abnormal system status information used for risk assessment from the abnormal network traffic feature set and the abnormal system status feature set respectively, wherein the network traffic value, total network traffic and total abnormal network traffic within the observation time range are extracted for the abnormal network traffic data, and a baseline value of the network traffic is determined based on the average value of the normal network traffic; and the system status value, number of configuration changes and average system status value of each system status indicator within the observation time range are extracted for the abnormal system status information, and a baseline value of the system status is determined based on the average value of the normal system status; According to the time series characteristics of network traffic data, the network traffic analysis model is trained by combining the time series analysis algorithm and abnormal network traffic data, and the constructed network traffic analysis model is verified and evaluated, and necessary adjustments are made to improve performance in order to analyze the degree of abnormality of network traffic; Based on the static and dynamic characteristics of the system status information, clustering algorithms are used to identify abnormal system configurations and behaviors. The system status analysis model is trained in combination with the abnormal system status information. The constructed system status analysis model is verified and evaluated, and parameters are adjusted to identify abnormal system configurations and behaviors. Combining the output of the network traffic analysis model with abnormal network traffic data, we get the traffic assessment index to analyze the abnormal degree of network traffic. Combining the output of the system status analysis model with abnormal system status information, we get the status assessment index to measure the health status and abnormal trend of the system.

[0008] Preferably, the calculation expression of the flow evaluation index is: ; in, is the flow evaluation index, For the The network traffic value at a time point, is the baseline value of network traffic, is the number of observed time points, is the total abnormal network traffic during the observation period, is the total network traffic during the observation period, The lower the value, the more normal the network traffic. The higher the value, the greater the abnormality of network traffic; The calculation expression of the state evaluation index is: ; in, is the status assessment index, For the The system status value of each indicator, is the baseline value of the system status, is the number of observed indicators, is the number of configuration changes during the observation period, is the average system state value during the observation period, The lower the value, the healthier the system status. The higher the value, the more abnormal the system status is.

[0009] Preferably, in the threat assessment module, the process of assessing the potential threat level of abnormal behavior includes: Traverse the historical abnormal behavior data in the log file, combine the traffic assessment index and the state assessment index with the historical abnormal behavior data, analyze the correlation between the abnormal behavior and the traffic assessment index and the state assessment index, and perform weighted calculation on the traffic assessment index and the state assessment index to obtain the abnormal threat assessment coefficient; According to the historical abnormal behavior data in the log files and the threat type and impact scope of the abnormal behavior, the potential threat level of the abnormal behavior is evaluated to determine different risk levels, namely, level 1 risk level, level 2 risk level, level 3 risk level and level 4 risk level. The potential threat level of abnormal behavior of the risk level increases from level 1 risk level to level 4 risk level. Match the set risk level with the calculation result of the abnormal threat assessment coefficient, and preset corresponding risk thresholds for different risk levels; Output the calculation results of the abnormal threat assessment coefficient and the matching relationship between different risk levels, obtain the abnormal threat sequence, and clarify the correlation between each risk level and the potential threat degree of abnormal behavior; Input the collected network traffic data and real-time data of system status information, calculate the result of abnormal threat assessment coefficient, combine it with the preset risk threshold, match the corresponding risk level, and evaluate the potential threat level of abnormal behavior.

[0010] Preferably, the calculation expression of the abnormal threat assessment coefficient is: ; in, is the abnormal threat assessment coefficient, For the The flow evaluation index at a time point, is the baseline value of the flow assessment index, For the The weight of each time point, is the number of observed time points, For the The status assessment index of the indicator, is the baseline value of the status assessment index, is the number of observed indicators, and To adjust and The weight coefficient of influence, To adjust the coefficient of the exponential decay rate, low The value of indicates that the network traffic and system status are close to the baseline value, abnormal behavior is not significant, and high Values ​​of represent significant deviations from baseline behavior, indicating a serious threat.

[0011] Preferably, the plurality of risk levels correspond to a plurality of risk thresholds, wherein the risk thresholds include an upper threshold and a lower threshold; The multiple risk levels and the multiple risk thresholds satisfy the following relationship: Level 1 risk ; Low threat potential, requiring minimal attention and resources; Secondary risk level ; Medium threat potential, requiring moderate attention and resources; Level 3 risk ;High potential threat level, requiring significant attention and resources; Four risk levels ; Severe potential threat level requiring an immediate and focused response; in, is the abnormal threat assessment coefficient, is the lower threshold corresponding to the second-level risk level and the upper threshold corresponding to the first-level risk level, is the lower threshold corresponding to the third-level risk level and the upper threshold corresponding to the second-level risk level. is the lower threshold corresponding to the fourth risk level and the upper threshold corresponding to the third risk level. , , .

[0012] Preferably, in the automatic alarm module and the response strategy generation module, the process of alarming and generating protection strategies includes: Continuously monitor network status, collect key data such as network traffic, system status information, and log files, and analyze and process the collected data in real time to identify abnormal behaviors and situations; Combine the abnormal behavior assessment results of the threat assessment module with the identified abnormal behaviors and abnormal situations, output the risk level of the abnormal behavior, check whether the abnormal behavior violates the security policy, and identify the potential security threats of the abnormal behavior; Once an abnormality is detected, the alarm mechanism is triggered immediately, and the administrator is sent an alarm message via email, SMS, and instant message. The alarm message includes the abnormality type, occurrence time, impact scope, severity details, and handling suggestions; When the alarm is triggered, the automatic alarm module conducts a risk assessment on the abnormal situation to determine whether it constitutes a high-risk threat. Combined with the threat assessment results, the module selects the corresponding protection measures from the preset protection measures library. For high-risk threats, more stringent measures may be selected, such as blocking the attack source, isolating infected devices, etc. Without manual intervention, the automatic alarm module directly calls the execution system to execute the selected protection measures. By automatically triggering the protection measures, it can achieve immediate protection and effectively curb the spread and damage of the threat. After the protection measures are executed, the automatic alarm module conducts a damage assessment to check whether the system has resumed normal operation and whether there are other potential impacts. The response strategy generation module receives the evaluation results of abnormal behaviors from the threat assessment module and the alarm results of abnormal situations from the automatic alarm module. It conducts in-depth analysis on the received evaluation results and alarm results to clarify the current potential risk level and the corresponding alarm mechanism. Monitor execution results, synchronously record all generated protection strategies and execution results, and retain change logs and incident response records for subsequent audit and analysis; Evaluate the effectiveness of the protection strategy based on the monitoring results, including whether the threat has been effectively contained and whether the system has resumed normal operation, and optimize and adjust the protection strategy based on the evaluation results, including improving the effectiveness of the strategy, reducing the false alarm rate, and increasing the response speed.

[0013] Preferably, in the report generation module, the generation process of the audit log and the risk assessment report includes: Capture all key events during system operation, including login attempts, configuration changes, anomaly detection, alarm triggering, and record all security-related operations. Organize the captured data to extract key information, including user ID, operation type, and result status, and format the data for report generation; Generate detailed audit logs based on captured and collated data. The audit logs include timestamp, event type, operator, and impact scope information. They summarize the results of risk assessment, including detection, assessment, and response to abnormal behavior, and generate risk assessment reports, including risk level, threat type, and impact scope. The generated reports are distributed to designated users and departments through email, message notification or file sharing, and the reports are updated regularly to reflect the latest system operation and security status, and archived in a secure system for future reference.

[0014] The present invention provides a network data risk assessment system for computers. It has the following beneficial effects: 1. This network data risk assessment system for computers achieves rapid detection and response to network threats by integrating anomaly detection, threat assessment, response strategy generation and automatic alarm functions. It uses machine learning technology to identify abnormal patterns, discover potential security threats, and improve the accuracy of identifying abnormal behaviors. In addition, it automatically triggers preset protection measures, so as to respond quickly when high-risk threats are detected and reduce the damage of security incidents to the system.

[0015] 2. This network data risk assessment system for computers realizes real-time monitoring of network status and data flow by integrating efficient monitoring and alarm modules. It can quickly identify potential threats such as abnormal traffic and unauthorized access attempts, and automatically trigger preset protection measures when high-risk threats are detected. The real-time threat detection and response mechanism greatly shortens the time window from threat discovery to response, effectively curbs the spread and damage of security incidents, and significantly improves the overall security and resilience of the network system. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 A module structure diagram of a network data risk assessment system for a computer according to the present invention; Figure 2 A flow chart for identifying abnormal patterns of the present invention; Figure 3 The present invention is a flow chart for evaluating the potential threat level of abnormal behavior. DETAILED DESCRIPTION

[0017] The present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments. The embodiments of the present invention are provided for the purpose of illustration and description, and are not intended to be exhaustive or to limit the present invention to the disclosed forms. Many modifications and variations will be apparent to those of ordinary skill in the art. The embodiments are selected and described in order to better illustrate the principles and practical applications of the present invention, and to enable those of ordinary skill in the art to understand the present invention and thereby design various embodiments with various modifications suitable for specific uses.

[0018] The first embodiment, as Figure 1 , Figure 2 As shown, the present invention provides a technical solution: a network data risk assessment system for a computer, comprising a data monitoring platform, the data monitoring platform is communicatively connected with a data acquisition module, a data preprocessing module, an anomaly detection module, a threat assessment module, an automatic alarm module, a response strategy generation module and a report generation module, wherein the modules are connected by electrical signals; The data collection module collects various raw data from various network devices and systems, including traffic data, log files, and system status information, to ensure the comprehensiveness and real-time nature of the data, and to provide basic data support for risk assessment. It also clarifies the network devices and systems for which data needs to be collected, including servers, routers, firewalls, intrusion detection systems, and applications. It also clarifies the data source to ensure the comprehensiveness of data collection. According to the network devices and systems for which data needs to be collected, it determines the data type, collection frequency, and the storage format and location of the data. The data types include network traffic data, system status information, and log files. It also configures data collection methods based on different data types. For the collection of network traffic data, it uses network packet capture tools (such as Wireshark and tcpdump) to capture network traffic data, and uses network monitoring devices (such as traffic analyzers and intrusion detection systems) to obtain network traffic information in real time. It uses network traffic mirroring technology to copy a copy of the network traffic to the data collection system for analysis. For the collection of system status information, it uses system monitoring tools (such as Zabbix and Prometheus) to obtain system performance indicators (such as CPU usage, memory usage, disk I / O, etc.) in real time, and calls system services (such as Windows Management Instrumentation, WMI; Linux's Systemd, etc.) to obtain system status information, write scripts to regularly query system commands or configuration files, obtain system configuration and status data, deploy data collection agents on various data sources according to data collection goals and methods, configure corresponding data collectors, set collection parameters and rules, ensure that data collectors can run stably and reliably connect with target network devices and systems, and capture network traffic data and raw data of system status information from target network devices and systems, convert them into a unified data format, and transmit them to the central data warehouse through the network; The data preprocessing module is used to clean, format, and normalize the collected raw data, remove noise and redundant information, and extract abnormal features for risk assessment from the preprocessed data to obtain abnormal network traffic feature sets and abnormal system status feature sets, improve data processing efficiency, and provide high-quality data sets for subsequent analysis. It converts large amounts of data into key features to facilitate more efficient risk assessment by the model. The collected network traffic data, system status information, and raw data of log files are preprocessed. The preprocessing operation includes the steps of cleaning, formatting, and normalization. Data cleaning identifies and processes missing values, abnormal values, duplicate records, etc. to ensure the integrity and accuracy of the data. Accuracy, data formatting converts data into a unified format, such as date and time format, numerical format, etc., standardizes data for easy processing and analysis, data normalization scales data to a specific range, such as 0 to 1, or makes data have the same dimension, eliminates the impact of different magnitudes and dimensions, and improves the convergence speed and accuracy of the algorithm, uses correlation coefficients to combine pre-processed network traffic data and system status information data, identifies features associated with risk assessment, and performs feature extraction to obtain abnormal features for risk assessment, extracts associated data of abnormal network traffic and abnormal system status information, and forms abnormal network traffic feature sets and abnormal system status feature sets, where the abnormal features of network traffic data include flow Traffic surges, traffic decreases, abnormal traffic patterns, abnormal packet sizes, and frequent connection failures. Traffic surges are sharp increases in network traffic in a short period of time, which may indicate a DDoS attack or other types of traffic anomalies. Traffic decreases are sudden decreases in network traffic, which may indicate network connection problems or service interruptions. Abnormal traffic patterns are abnormal increases in traffic during off-peak hours, or traffic patterns that do not match normal patterns. Abnormal packet sizes are packet sizes that are much larger or smaller than normal, which may indicate attacks or abnormal transmissions. Frequent connection failures are a large number of failed connection attempts in a short period of time, which may indicate scanning or attacks. Abnormal characteristics of system status information include sudden increases in CPU usage, sudden increases in memory usage, and disk usage. Sudden increase, abnormal network connection and system configuration change. Sudden increase in CPU usage means a sudden and significant increase in CPU usage, which may indicate malware or system resources being occupied. Sudden increase in memory usage means a sudden and significant increase in memory usage, which may indicate memory leakage or malware activity. Sudden increase in disk usage means a sudden and significant increase in disk usage, which may indicate data leakage or malware activity. Abnormal network connection means a large number of connections established by the system with unusual IP addresses or ports. System configuration change means unauthorized changes in system configuration files. Abnormal features in abnormal network traffic feature set and abnormal system status feature set are encoded and processed to convert non-numeric data into numerical data, so that the data is suitable for numerical calculation. The anomaly detection module uses machine learning algorithms combined with anomaly features to identify anomaly patterns on preprocessed data, discover potential security threats, quickly and accurately identify abnormal behaviors in the network, and provide clues for timely response. It extracts abnormal network traffic data and associated data of abnormal system status information used for risk assessment from the abnormal network traffic feature set and the abnormal system status feature set, respectively. For abnormal network traffic data, the network traffic value, total network traffic, and total abnormal network traffic within the observation time range are extracted, and the baseline value of the network traffic is determined based on the average value of normal network traffic. For abnormal system status information, the system status value, number of configuration changes, and average system status value of each system status indicator within the observation time range are extracted, and the baseline value of the system status is determined based on the average value of the normal system status. Based on the time series characteristics of the volume data, the network traffic analysis model is trained in combination with the time series analysis algorithm and abnormal network traffic data, and the constructed network traffic analysis model is verified and evaluated, and necessary adjustments are made to improve performance, so as to analyze the degree of abnormality of network traffic, and the clustering algorithm is used to identify abnormal system configuration and behavior according to the static and dynamic characteristics of the system status information, and the system status analysis model is trained in combination with the abnormal system status information, and the constructed system status analysis model is verified and evaluated, and parameter adjustments are made to identify abnormal system configuration and behavior, and the traffic evaluation index is obtained by combining the output of the network traffic analysis model and the abnormal network traffic data, and the degree of abnormality of network traffic is analyzed, and the status evaluation index is obtained by combining the output of the system status analysis model and the abnormal system status information, so as to measure the health status and abnormal trend of the system; Furthermore, the calculation expression of the flow evaluation index is: ; in, is the flow evaluation index, For the The network traffic value at a time point, is the baseline value of network traffic, is the number of observed time points, is the total abnormal network traffic during the observation period, is the total network traffic during the observation period, The lower the value, the more normal the network traffic. The higher the value, the greater the abnormality of the network traffic. Calculate the square of the difference between the network traffic at each time point and the baseline network traffic, sum them up and divide by the number of time points. , get the average value of the sum of squares of network traffic deviations, using the exponential function The average of the sum of squares of adjusted network traffic deviations, where Indicates the proportion of abnormal network traffic to total network traffic. The value comprehensively considers the network traffic deviation and the abnormal network traffic ratio; The calculation expression of the condition assessment index is: ; in, is the status assessment index, For the The system status value of each indicator, is the baseline value of the system status, is the number of observed indicators, is the number of configuration changes during the observation period, is the average system state value during the observation period, The lower the value, the healthier the system status. The higher the value, the greater the abnormal trend of the system status. Calculate the square of the difference between each system status indicator and the baseline status, sum them up and divide by the number of indicators. , get the average of the sum of squares of the state deviations, using the radical The average of the sum of squared adjusted state deviations, where Indicates the number of configuration changes. Represents the average system state value, and the final The value takes into account the impact of state deviation and configuration changes Threat assessment module, which is used to conduct in-depth analysis of detected abnormal behaviors, evaluate their potential threat level, including threat type and impact scope, determine their potential risk level to the system, provide accurate threat intelligence for formulating protection measures, and ensure effective allocation of resources; The automatic alarm module continuously monitors the network status, conducts real-time monitoring and alarms for abnormal situations, and automatically triggers preset protection measures when high-risk threats are detected, such as blocking the attack source and isolating infected devices, etc., to achieve immediate protection, reduce the damage of security incidents to the system, enhance the transparency and controllability of the system, and facilitate administrators to carry out emergency handling and subsequent analysis; The response strategy generation module is used to automatically generate and recommend corresponding levels of protection strategies based on threat assessment results, including blocking rules and alarm settings, to improve the pertinence and effectiveness of protection measures, reduce human intervention, and speed up response; The report generation module is used to record all key events and operations during system operation, generate detailed audit logs and risk assessment reports, provide a basis for post-analysis, help optimize system configuration and improve protection measures, and meet compliance requirements.

[0019] The second embodiment is based on the first embodiment. Figure 3 As shown, in the threat assessment module, the process of assessing the potential threat level of abnormal behavior includes: Traverse the historical abnormal behavior data in the log file, combine the traffic assessment index and the state assessment index with the historical abnormal behavior data, analyze the correlation between the abnormal behavior and the traffic assessment index and the state assessment index, and perform weighted calculation on the traffic assessment index and the state assessment index to obtain the abnormal threat assessment coefficient. According to the historical abnormal behavior data in the log file and the threat type and impact range of the abnormal behavior, evaluate the potential threat degree of the abnormal behavior to determine different risk levels, namely, the first risk level, the second risk level, the third risk level and the fourth risk level, wherein the potential threat degree of the abnormal behavior of the risk level increases step by step from the first risk level to the fourth risk level, match the set risk level with the calculation result of the abnormal threat assessment coefficient, preset corresponding risk thresholds for different risk levels, output the calculation result of the abnormal threat assessment coefficient and the matching relationship between different risk levels, obtain the abnormal threat sequence, clarify the correlation between each risk level and the potential threat degree of the abnormal behavior, input the collected network traffic data and real-time data of the system status information, calculate the result of the abnormal threat assessment coefficient, combine with the preset risk threshold, match the corresponding risk level, so as to evaluate the potential threat degree of the abnormal behavior; Furthermore, the calculation expression of the abnormal threat assessment coefficient is: ; in, is the abnormal threat assessment coefficient, For the The flow evaluation index at a time point, is the baseline value of the flow assessment index, For the The weight of each time point, is the number of observed time points, For the The status assessment index of the indicator, is the baseline value of the status assessment index, is the number of observed indicators, and To adjust and The weight coefficient of influence, To adjust the coefficient of the exponential decay rate, low The value of indicates that the network traffic and system status are close to the baseline value, abnormal behavior is not significant, and high The value of indicates a significant deviation from the baseline behavior, indicating a serious threat. For the traffic assessment part, the value of is calculated for each time point. The difference from the baseline value is weighted by the square and sum of the differences to emphasize deviations from the baseline, using a logarithmic function The calculation result of the sum of squared differences is transformed so that the sensitivity to the threat level can be maintained even in the case of multiple deviations from the baseline, and the weight Used to adjust the importance of flow assessment in the total assessment coefficient. For the state assessment part, calculate the The difference from the baseline value is squared and the exponential function is used Transforms the result of calculating the sum of squared differences, where The influence of the degree of control deviation on the final index is The form emphasizes larger deviations, that is, larger deviations lead to The increase in weight Used to adjust the importance of state assessment in the total assessment coefficient; Furthermore, the multiple risk levels correspond to multiple risk thresholds, wherein the risk threshold includes an upper threshold and a lower threshold; Multiple risk levels and multiple risk thresholds satisfy the following relationship: Level 1 risk ; Low threat potential, requiring minimal attention and resources; Secondary risk level ; Medium threat potential, requiring moderate attention and resources; Level 3 risk ;High potential threat level, requiring significant attention and resources; Four risk levels ; Severe potential threat level requiring an immediate and focused response; in, is the abnormal threat assessment coefficient, is the lower threshold corresponding to the second-level risk level and the upper threshold corresponding to the first-level risk level, is the lower threshold corresponding to the third-level risk level and the upper threshold corresponding to the second-level risk level. is the lower threshold corresponding to the fourth risk level and the upper threshold corresponding to the third risk level. , , ; In the automatic alarm module and response strategy generation module, the process of alarming and generating protection strategies includes: Continuously monitor the network status, collect key data of network traffic, system status information, and log files, and analyze and process the collected data in real time, identify abnormal behaviors and abnormal situations, combine the abnormal behavior assessment results of the threat assessment module with the identified abnormal behaviors and abnormal situations, output the risk level of abnormal behaviors, check whether abnormal behaviors violate security policies, and identify potential security threats of abnormal behaviors. Once an abnormal situation is detected, the alarm mechanism is immediately triggered, and alarm information is sent to the administrator through email, SMS, and instant messaging. The alarm information includes the abnormal type, occurrence time, impact range, severity details, and processing suggestions. At the same time as the alarm is triggered, the automatic alarm module conducts a risk assessment of the abnormal situation to determine whether it constitutes a high-risk threat. Combined with the threat assessment results, the corresponding protection measures are selected from the preset protection measures library. For high-risk threats, more stringent measures may be selected, such as blocking the attack source, isolating infected devices, etc., without manual Intervention: The automatic alarm module directly calls the execution system to execute the selected protection measures. By automatically triggering the protection measures, it realizes immediate protection and effectively curbs the spread and damage of threats. After the protection measures are executed, the automatic alarm module conducts damage assessment to check whether the system has resumed normal operation and whether there are other potential impacts. The response strategy generation module receives the assessment results of abnormal behavior from the threat assessment module and the alarm results of abnormal situations from the automatic alarm module. It conducts in-depth analysis of the received assessment results and alarm results to clarify the current potential risk level and the corresponding alarm mechanism, monitors the execution results, and synchronously records all generated protection strategies and execution results. It retains change logs and event response records for subsequent audits and analysis. It evaluates the implementation effect of the protection strategy based on the monitoring results, including whether the threat is effectively contained and whether the system has resumed normal operation. It also optimizes and adjusts the protection strategy based on the evaluation results, including improving the effectiveness of the strategy, reducing the false alarm rate, and increasing the response speed. In the report generation module, the generation process of audit logs and risk assessment reports includes: Capture all key events during system operation, including login attempts, configuration changes, anomaly detection, and alarm triggering, and record all security-related operations. Organize the captured data and extract key information, including user ID, operation type, and result status. Format the data to facilitate report generation. Generate detailed audit logs based on the captured and organized data. The audit logs include timestamp, event type, operator, and impact scope information. Summarize the results of risk assessment, including detection, assessment, and response to abnormal behavior, and generate risk assessment reports, including risk level, threat type, and impact scope. Distribute the generated reports to designated users and departments via email, message notification, or file sharing, and update the reports regularly to reflect the latest system operation and security status. Archive the reports in a secure system for future reference.

[0020] Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field and related fields without creative work should fall within the scope of protection of the present invention. The structures, devices and operating methods not specifically described and explained in the present invention are implemented according to the conventional means in the field unless otherwise specified and limited.

Claims

1. A network data risk assessment system for a computer, comprising a data monitoring platform, characterized in that: The data monitoring platform is communicatively connected with a data acquisition module, a data preprocessing module, an anomaly detection module, a threat assessment module, an automatic alarm module, a response strategy generation module and a report generation module, wherein the modules are electrically connected with each other; The data acquisition module collects various raw data from various network devices and systems, including flow data, log files, and system status information; The data preprocessing module is used to preprocess the collected raw data and extract abnormal features for risk assessment from the preprocessed data to obtain an abnormal network traffic feature set and an abnormal system status feature set; The anomaly detection module uses a machine learning algorithm combined with abnormal features to identify abnormal patterns in preprocessed data and discover potential security threats; The threat assessment module is used to conduct in-depth analysis of the detected abnormal behavior, assess its potential threat level, including threat type and impact scope, and determine its potential risk level to the system; The automatic alarm module continuously monitors the network status and performs real-time monitoring and alarm for abnormal situations; The response strategy generation module is used to automatically generate and recommend corresponding level of protection strategies according to the threat assessment results; The report generation module is used to record all key events and operations during system operation and generate audit logs and risk assessment reports.

2. A network data risk assessment system for computers according to claim 1, characterized in that: In the data acquisition module, the process of collecting raw data includes: Identify the network devices and systems that need to collect data, including servers, routers, firewalls, intrusion detection systems, and applications; Determine the data type, collection frequency, and data storage format and location based on the network devices and systems that need to collect data. The data types include network traffic data, system status information, and log files. Configure data collection methods based on different data types. According to the data collection objectives and methods, deploy data collection agents on various data sources, configure corresponding data collectors, set collection parameters and rules, and connect with target network devices and systems; The data collector captures the raw data of network traffic data and system status information from the target network devices and systems, converts them into a unified data format, and transmits them to the central data warehouse through the network.

3. A network data risk assessment system for computers according to claim 2, characterized in that: In the data preprocessing module, the process of acquiring the abnormal network traffic feature set and the abnormal system status feature set includes: Perform preprocessing operations on the collected network traffic data, system status information, and raw data of log files, including cleaning, formatting, and normalization steps; Use correlation coefficients in combination with preprocessed network traffic data and system status information data to identify features associated with risk assessment, perform feature extraction, obtain abnormal features for risk assessment, extract associated data of abnormal network traffic and abnormal system status information, and form an abnormal network traffic feature set and an abnormal system status feature set, wherein the abnormal features of network traffic data include sudden increase in traffic, sudden decrease in traffic, abnormal traffic pattern, abnormal data packet size, and frequent connection failures, and the abnormal features of system status information include sudden increase in CPU usage, sudden increase in memory usage, sudden increase in disk usage, abnormal network connection, and system configuration changes; The abnormal features in the abnormal network traffic feature set and the abnormal system status feature set are encoded and processed to convert non-numeric data into numerical data.

4. A network data risk assessment system for computers according to claim 3, characterized in that: In the anomaly detection module, the process of identifying anomaly patterns includes: Extracting abnormal network traffic data and associated data of abnormal system status information used for risk assessment from the abnormal network traffic feature set and the abnormal system status feature set respectively, wherein the network traffic value, total network traffic and total abnormal network traffic within the observation time range are extracted for the abnormal network traffic data, and a baseline value of the network traffic is determined based on the average value of the normal network traffic; and the system status value, number of configuration changes and average system status value of each system status indicator within the observation time range are extracted for the abnormal system status information, and a baseline value of the system status is determined based on the average value of the normal system status; According to the time series characteristics of network traffic data, the network traffic analysis model is trained by combining the time series analysis algorithm and abnormal network traffic data to analyze the abnormal degree of network traffic; Based on the static and dynamic characteristics of system status information, clustering algorithms are used to identify abnormal system configurations and behaviors. The system status analysis model is trained in combination with abnormal system status information to identify abnormal system configurations and behaviors. Combining the output of the network traffic analysis model with abnormal network traffic data, we get the traffic assessment index to analyze the abnormal degree of network traffic. Combining the output of the system status analysis model with abnormal system status information, we get the status assessment index to measure the health status and abnormal trend of the system.

5. A network data risk assessment system for computers according to claim 4, characterized in that: The calculation expression of the flow evaluation index is: ； in, is the flow evaluation index, For the The network traffic value at a time point, is the baseline value of network traffic, is the number of observed time points, is the total abnormal network traffic during the observation period, is the total network traffic during the observation period, The lower the value, the more normal the network traffic. The higher the value, the greater the abnormality of network traffic; The calculation expression of the state evaluation index is: ； in, is the status assessment index, For the The system status value of each indicator, is the baseline value of the system status, is the number of observed indicators, is the number of configuration changes during the observation period, is the average system state value during the observation period, The lower the value, the healthier the system status. The higher the value, the more abnormal the system status is.

6. A network data risk assessment system for computers according to claim 5, characterized in that: In the threat assessment module, the process of assessing the potential threat level of abnormal behavior includes: Traverse the historical abnormal behavior data in the log file, combine the traffic assessment index and the state assessment index with the historical abnormal behavior data, analyze the correlation between the abnormal behavior and the traffic assessment index and the state assessment index, and perform weighted calculation on the traffic assessment index and the state assessment index to obtain the abnormal threat assessment coefficient; According to the historical abnormal behavior data in the log files and the threat type and impact scope of the abnormal behavior, the potential threat level of the abnormal behavior is evaluated to determine different risk levels, namely, level 1 risk level, level 2 risk level, level 3 risk level and level 4 risk level. The potential threat level of abnormal behavior of the risk level increases from level 1 risk level to level 4 risk level. Match the set risk level with the calculation result of the abnormal threat assessment coefficient, and preset corresponding risk thresholds for different risk levels; Output the calculation results of the abnormal threat assessment coefficient and the matching relationship between different risk levels, obtain the abnormal threat sequence, and clarify the correlation between each risk level and the potential threat degree of abnormal behavior; Input the collected network traffic data and real-time data of system status information, calculate the result of abnormal threat assessment coefficient, combine it with the preset risk threshold, match the corresponding risk level, and evaluate the potential threat level of abnormal behavior.

7. A network data risk assessment system for computers according to claim 6, characterized in that: The calculation expression of the abnormal threat assessment coefficient is: ； in, is the abnormal threat assessment coefficient, For the The flow evaluation index at a time point, is the baseline value of the flow assessment index, For the The weight of each time point, is the number of observed time points, For the The status assessment index of the indicator, is the baseline value of the status assessment index, is the number of observed indicators, and To adjust and The weight coefficient of influence, A factor that adjusts the exponential decay rate.

8. A network data risk assessment system for computers according to claim 7, characterized in that: The plurality of risk levels correspond to the plurality of risk thresholds, wherein the risk thresholds include an upper threshold and a lower threshold; The multiple risk levels and the multiple risk thresholds satisfy the following relationship: Level 1 risk ; Secondary risk level ; Level 3 risk ; Four risk levels ; in, is the abnormal threat assessment coefficient, is the lower threshold corresponding to the second-level risk level and the upper threshold corresponding to the first-level risk level, is the lower threshold corresponding to the third-level risk level and the upper threshold corresponding to the second-level risk level. It is the lower threshold corresponding to the fourth risk level and the upper threshold corresponding to the third risk level.

9. A network data risk assessment system for computers according to claim 8, characterized in that: In the automatic alarm module and the response strategy generation module, the process of alarming and generating protection strategies includes: Continuously monitor network status, collect key data such as network traffic, system status information, and log files, and analyze and process the collected data in real time to identify abnormal behaviors and situations; Combine the abnormal behavior assessment results of the threat assessment module with the identified abnormal behaviors and abnormal situations, output the risk level of the abnormal behavior, check whether the abnormal behavior violates the security policy, and identify the potential security threats of the abnormal behavior; Once an abnormal situation is detected, the alarm mechanism is triggered immediately, and alarm information is sent to the administrator via email, SMS, and instant messaging. When the alarm is triggered, the automatic alarm module conducts a risk assessment on the abnormal situation to determine whether it constitutes a high-risk threat. Based on the threat assessment results, the module selects the corresponding protection measures from the preset protection measures library. The automatic alarm module directly calls the execution system to execute the selected protection measures. By automatically triggering the protection measures, immediate protection is achieved. After the protection measures are executed, the automatic alarm module conducts a damage assessment to check whether the system has resumed normal operation and whether there are other potential impacts. The response strategy generation module receives the evaluation results of abnormal behaviors from the threat assessment module and the alarm results of abnormal situations from the automatic alarm module. It conducts in-depth analysis on the received evaluation results and alarm results to clarify the current potential risk level and the corresponding alarm mechanism. Monitor execution results, synchronously record all generated protection strategies and execution results, and keep change logs and incident response records; Evaluate the effectiveness of the protection strategy based on the monitoring results, including whether the threat has been effectively contained and whether the system has resumed normal operation, and optimize and adjust the protection strategy based on the evaluation results.

10. A network data risk assessment system for computers according to claim 9, characterized in that: In the report generation module, the generation process of the audit log and risk assessment report includes: Capture all key events during system operation, including login attempts, configuration changes, anomaly detection, and alarm triggering, and record all security-related operations. Organize the captured data and extract key information, including user ID, operation type, and result status. Generate detailed audit logs based on captured and collated data. The audit logs include timestamps, event types, operators, and impact scope information, summarize risk assessment results, and generate risk assessment reports; The generated reports are distributed to designated users and departments through email, message notification or file sharing, and the reports are updated regularly to reflect the latest system operation and security status, and the reports are archived in a secure system.

Images