Information security protection method for computer network

Abstract

The invention discloses an information security protection method of a computer network, which relates to the technical field of security protection of the computer network, and comprises the following steps: collecting detection data of security configuration information of the computer network by using a data detection and acquisition module, substituting the detection data into a data comprehensive processing module, and inputting and outputting to obtain a basic security assessment value JSA; the method comprises the following steps: determining a dynamic risk assessment value DP and a comprehensive safety adjustment value TZ, comparing the difference between the comprehensive safety adjustment value TZ and an average value of first m comprehensive safety adjustment values TZ extracted from a data detection and acquisition module, and determining an adjusted safety field, including improvement of intrusion prevention capability, optimization of safety facility efficiency and reduction of a current activity threat level. According to the method, the dynamic evaluation and scientific adjustment of the network security condition are realized, the problems and defects in the prior art are solved, and a new thought and method are provided for information security protection of the computer network.

Description

Technical Field

[0001] The present invention relates to the technical field of computer network security protection, and in particular to an information security protection method for a computer network. Background Art

[0002] With the popularization of the Internet and the rapid development of technology, the means of network attacks are constantly being updated. Hackers use system vulnerabilities, malware, and phishing websites to attack network systems, steal sensitive information, destroy data integrity, and even paralyze the entire network. These attacks not only threaten personal privacy and security, but also have a serious impact on the normal operation of enterprises and the information security of the country. In order to cope with complex network security threats and the expanded network application environment, information security protection technology for computer networks is also constantly evolving, and provides strong guarantees for information security protection of computer networks.

[0003] Existing technologies mostly use static security assessment methods, which cannot reflect changes in the network's security status in real time, resulting in untimely responses when facing sudden threats. In addition, many assessment methods only start from a single dimension, ignoring the comprehensive impact of security facility efficiency and threat response time, resulting in incomplete assessment results. In addition, the adjustment of security policies often relies on manual judgment and experience, and lacks a scientific dynamic adjustment mechanism, resulting in delayed adjustments and poor results. In addition, when formulating and adjusting security policies, the latest security audit results are often ignored, and it is impossible to make timely improvements to the problems found in the audit. Summary of the invention

[0004] The purpose of the present invention is to provide a method for protecting information security of a computer network, which solves the problems raised in the above-mentioned background technology.

[0005] To achieve the above object, the present invention provides the following technical solution, and the specific implementation steps are as follows: Utilize the data detection and collection module to collect detection data of computer network security configuration information; Substitute the detection data into the data comprehensive processing module, input and output to obtain the basic safety assessment value JSA, dynamic risk assessment value DP and comprehensive safety adjustment value TZ; Compare the difference between the comprehensive security adjustment value TZ and the average value of the previous m comprehensive security adjustment values ​​TZ extracted from the data detection and acquisition module, and determine the security field for adjustment, including improving intrusion prevention capabilities, optimizing the efficiency of security facilities, and reducing the threat level of current activities; The data comprehensive processing module includes a unit for quantifying the basic network security level, a unit for dynamically evaluating network risks, and a unit for guiding comprehensive adjustment.

[0006] Optionally, the equipment used by the data detection and collection module includes an intrusion prevention system, a firewall, an intrusion detection system, a network performance testing tool, a security audit tool, and a monitoring and log analysis tool; The equipment used by the data comprehensive processing module includes a server and a storage device.

[0007] Optionally, the detection data of the configuration information includes scoring based on the deployment, update and policy effectiveness of the intrusion prevention system; Analyze and determine the operating efficiency of security devices using monitoring and log analysis tools; Detect threat response time WX and average response time PX, and use network performance testing tools to give response efficiency XX; Monitor and detect active threats in the network; Security audit tools conduct regular security audits and record the number and severity of problems found.

[0008] Optionally, the calculation formula for the quantitative network basic security level unit is as follows: JAQ=[(RF+AS)+XX] 0.5 ; XX=WX / PX; in: JAQ is the basic safety assessment value; RF is the intrusion defense value, which reflects the defense capability of the network; AS is the operating efficiency of safety facilities; WX is the threat response time, which measures the time interval from when the system detects a threat to when it starts taking response measures; PX is the average response time; XX is the response efficiency. XX is used to compare the threat response time WX and the average response time PX to evaluate the efficiency of the network response when facing threats.

[0009] Optionally, specific response descriptions and calculation formulas of the threat response time WX and the average response time PX are as follows: WX=XS-JS; XS is the response time, which reflects the specific time when the system starts to respond to the threat; JS is the detection time, which reflects the specific time when the threat is detected; Assuming that June 5, 2024, 15:20:10 is the detection time JS, and June 5, 2024, 15:20:35 is the response time XS, substitute into the formula as follows; June 5, 2024 15:20:35-June 5, 2024 15:20:10=25, so the threat response time WX is 25; PS=(WX1+WX2+WX3+......WX n ) / n; WX1+WX2+WX3+......WX n It is the sum of all threat response times WX; n is the total number of responses Optionally, the calculation formula for the dynamic assessment network risk unit is as follows: DP=JAQ*[1+(DW / (JAQ / RF 0.5 ))]; in: DP is the dynamic risk assessment value; DW is the current activity threat intensity value, and DW affects the risk level of the dynamic risk assessment value DP; The basic security assessment value JSA is used as a benchmark and multiplied by the expression of the current active threat intensity value DW and the intrusion prevention value RF, so that the impact of the current active threat intensity value DW and the intrusion prevention value RF on the risk assessment is retained by considering the basic security assessment value JSA.

[0010] Optionally, the calculation formula of the guidance comprehensive adjustment unit is as follows: TZ = [DP*(1+log 10 (1+SJ / DP))] / 1+(AS / 100) 0.5 ; in: TZ is the comprehensive safety adjustment value; SJ is the severity value of the last audit, and SJ reflects the immediate status of the last security audit; SJ / DP reflects the current safety status compared with the past and historical average levels; log 10 (1+SJ / DP) is used to amplify the impact of the previous audit severity value SJ on the dynamic risk assessment value DP while avoiding overreaction to a smaller previous audit severity value SJ.

[0011] Optionally, the safety protection adjustment steps based on the guidance comprehensive adjustment unit are as follows: S1. The calculation formula for the average value of the first m comprehensive safety adjustment values ​​TZ extracted from the data detection and acquisition module is as follows: TZ avg =(TZ1+TZ2+TZ3+......TZ n ) / m; m is the total amount of extraction; S2, if TZ>TZ avg, it means that the network faces a greater security risk under the current security policy, and corresponding security adjustments should be made; S3, if TZ <TZ avg , it means that the network has a high security level under the current security policy. The current policy should be maintained and security assessments and audits should be performed regularly. S4. If TZ = TZ avg , it means that the network is in a relatively safe state under the current security policy. We should conduct continuous detection and pay close attention to the security status of the network.

[0012] Optionally, the comprehensive security adjustment value TZ is a relative value used to guide the security policy adjustment. In actual situations, TZ <TZ avg Negative numbers are rare. If negative numbers occur under certain circumstances, the specific feedback adjustment is as follows: During the adjustment process, the accuracy and rationality of the intrusion prevention value RF, security facility operation efficiency AS, threat response time WX and average response time PX should be re-evaluated; Measure and evaluate whether new threat factors and security requirements are introduced. Based on the analysis and evaluation results, formulate corresponding adjustment measures to optimize the calculation results of the comprehensive security adjustment value TZ and the network security status. The adjustment measures include optimizing the configuration and performance of security equipment, strengthening security monitoring and response capabilities, and improving network security strategies and enforcement efforts.

[0013] Compared with the prior art, the present invention has the following beneficial effects: 1. The present invention realizes dynamic assessment of network security status through quantitative network basic security level unit and dynamic assessment network risk unit. The quantitative network basic security level unit comprehensively considers three dimensions: intrusion prevention capability, security facility efficiency and threat response time, while the dynamic assessment network risk unit further introduces the current active threat level, making the assessment result more comprehensive and real-time.

[0014] 2. The present invention guides the comprehensive adjustment unit to calculate the comprehensive security adjustment value TZ according to the result value of the dynamic assessment network risk unit and the result of the last security audit, which provides a scientific basis for the adjustment of the security policy. Through the automated adjustment mechanism, security issues can be discovered and resolved in a timely manner, thereby improving the response speed and defense capability.

[0015] 3. The comprehensive security adjustment value TZ output by the present invention can be fed back into the adjustment of the security policy. These adjustments will indirectly affect the input value of the next quantitative network basic security level unit when calculating the basic security assessment value JSA, forming a cyclic optimization mechanism. This mechanism enables the security protection method to continuously adapt to changes in the network threat environment and maintain the best security state.

[0016] 4. The method proposed in the present invention not only takes into account the traditional factors of intrusion prevention capability and security facility efficiency, but also introduces threat response time WX, average response time PX, current active threat level and the last security audit result as new evaluation dimensions, thereby achieving comprehensive coverage and in-depth evaluation of network security. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 A method flow chart of the information security protection method for the computer network; Figure 2 It is a structural schematic diagram of the data comprehensive processing module of the present invention; Figure 3 It is a schematic diagram of the results and measures of the cyclic feedback of the comprehensive safety adjustment value TZ of the present invention; Figure 4 Schematic diagram of rare results and measures of the loop feedback of the comprehensive safety adjustment value TZ of the present invention. DETAILED DESCRIPTION

[0018] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0019] Regarding the information security protection method of this computer network, it is different from the traditional security protection method. The traditional security protection method often relies on static security strategies and fixed security equipment configurations, which are difficult to adapt to the rapidly changing network threat environment. With the continuous evolution and complexity of network attack methods, traditional protection methods have gradually revealed their limitations, including slow response speed, insufficient defense capabilities, and delayed security policy adjustments. This algorithm unit realizes dynamic evaluation and scientific adjustment of network security status, solves the problems and deficiencies of existing technologies, and provides new ideas and methods for information security protection of computer networks.

[0020] For examples, see Figures 1 to 4 This implementation provides a computer network information security protection method, and the specific implementation steps are as follows: Utilize the data detection and collection module to collect detection data of computer network security configuration information; Configuration information detection data includes scores based on the deployment, updating, and policy effectiveness of the intrusion prevention system; Analyze and determine the operating efficiency of security devices using monitoring and log analysis tools; Detect threat response time WX and average response time PX, and use network performance testing tools to give response efficiency XX; Monitor and detect active threats in the network; Security audit tools conduct regular security audits and record the number and severity of problems found; Substitute the detection data into the data comprehensive processing module, input and output to obtain the basic safety assessment value JSA, dynamic risk assessment value DP and comprehensive safety adjustment value TZ; Compare the difference between the comprehensive security adjustment value TZ and the average value of the previous m comprehensive security adjustment values ​​TZ extracted from the data detection and acquisition module, and determine the security areas for adjustment, including improving intrusion prevention capabilities, optimizing the efficiency of security facilities, and reducing the threat level of current activities; The data comprehensive processing module includes a unit for quantifying the basic network security level, a unit for dynamically assessing network risks, and a unit for guiding comprehensive adjustments; The equipment used in the data detection and collection module includes intrusion prevention systems, firewalls, intrusion detection systems, network performance testing tools, security auditing tools, and monitoring and log analysis tools; The equipment used in the data comprehensive processing module includes servers and storage devices.

[0021] This embodiment provides a systematic method to evaluate and adjust the information security protection of a computer network. Through modular and unitized design, the entire process is made clearer and easier to manage. At the same time, by introducing specific equipment and tools, the accuracy and effectiveness of the evaluation and adjustment process are ensured.

[0022] In this embodiment, the system quantitatively evaluates and adjusts the security status of the network through the mutual cooperation of three algorithm units, provides strong decision-making support for network administrators, and combines the three operation results of JSA, DP and TZ to form a complete evaluation and adjustment system, which aims to ensure that the network maintains the best security state in a dynamic environment. JAQ is a basic security assessment value, which aims to quantify the basic security level of the network at a certain moment, which helps network administrators to intuitively understand the current security status of the network, including its defense capabilities and response speed. DP is a dynamic risk assessment value. This dynamic adjustment mechanism makes risk assessment more accurate and timely, which helps network administrators to respond quickly when threats occur. TZ is a comprehensive security adjustment value, which not only takes into account the current security status and threat level of the network, but also incorporates the problems found in the security audit, thereby providing comprehensive security adjustment suggestions for network administrators. The calculation results of TZ can also affect the calculations fed back to JSA and DP, so that the three algorithms of this system have a high correlation and entanglement, so that the overall algorithm system can be closer to reality by automatic feedback and optimization according to actual conditions.

[0023] See also Figures 1 to 4 ,The calculation formula for quantifying the basic network security level unit is as follows: JAQ=[(RF+AS)+XX] 0.5 ; XX=WX / PX; in: JAQ is the basic safety assessment value; RF is the intrusion defense value, which reflects the defense capability of the network; AS is the operating efficiency of safety facilities; WX is the threat response time, which measures the time interval from when the system detects a threat to when it starts taking response measures; PX is the average response time; XX is the response efficiency. XX is used to compare the threat response time WX and the average response time PX to evaluate the efficiency of the network response when facing threats. The specific response description and calculation formula of threat response time WX and average response time PX are as follows: WX=XS-JS; XS is the response time, which reflects the specific time when the system starts to respond to the threat; JS is the detection time, which reflects the specific time when the threat is detected; Assuming that June 5, 2024, 15:20:10 is the detection time JS, and June 5, 2024, 15:20:35 is the response time XS, substitute into the formula as follows; June 5, 2024 15:20:35-June 5, 2024 15:20:10=25, so the threat response time WX is 25; PS=(WX1+WX2+WX3+......WX n ) / n; WX1+WX2+WX3+......WX n It is the sum of all threat response times WX; n is the total number of responses.

[0024] In this embodiment: First, in this algorithm unit, the three values ​​of intrusion defense value RF, security facility operation efficiency AS and response efficiency XX are selected to calculate the basic security assessment value JSA because they can fully reflect the basic security level of the network. The intrusion defense value RF represents the defense capability of the network, the security facility operation efficiency AS represents the operation efficiency of the security equipment, and the response efficiency XX reflects the response speed of the network to threats and requests. These four factors are interrelated and together constitute the cornerstone of network security. Among them, the response efficiency XX is calculated by the threat response time WX and the average response time PX. In network security and performance evaluation, the threat response time WX and the average response time PX are two important indicators used to measure the response speed of the network and system to threats and general requests. However, these two indicators usually do not directly involve specific time expressions such as "what time" because they focus more on the measurement of time intervals and delays, and can be expressed through "WX=XS-JS" and "PS=(WX1+WX2+WX3+......WX n ) / n” to calculate specific values; The basic security assessment value JSA passed by this algorithm unit provides a comprehensive quantitative assessment of the basic security level of the network at a certain moment by comprehensively considering the relationship between the intrusion defense value RF, the security facility operation efficiency AS and the response efficiency XX. This assessment helps network administrators quickly understand the overall security status of the network. This multi-dimensional quantitative assessment provides network administrators with a detailed security portrait, helping them understand the security status of the network from multiple perspectives. The evaluation result of the basic security assessment value JSA can be used as the basis for formulating preliminary security strategies. For example, if the basic security assessment value JSA value is low, it means that it is necessary to enhance the intrusion prevention capability and optimize the configuration of security facilities. By regularly calculating the basic security assessment value JSA value, network administrators can track the changing trends of network security status, promptly discover and resolve potential security issues, and thus promote continuous improvement of network security. Specifically, network administrators can predict potential security risks and take preventive measures in advance. This forward-looking management strategy helps reduce the occurrence of security incidents and improve the overall security of the network.

[0025] See also Figures 1 to 4 ,The calculation formula for dynamically evaluating network risk units is as follows: DP=JAQ*[1+(DW / (JAQ / RF 0.5 ))]; in: DP is the dynamic risk assessment value; DW is the current activity threat intensity value, and DW affects the risk level of the dynamic risk assessment value DP; The basic security assessment value JSA is used as a benchmark and multiplied by the expression of the current active threat intensity value DW and the intrusion prevention value RF, so that the impact of the current active threat intensity value DW and the intrusion prevention value RF on the risk assessment is retained by considering the basic security assessment value JSA.

[0026] In this embodiment, firstly, in the dynamic network risk assessment unit, the current activity threat intensity value DW is not directly subjected to a simple mathematical operation with the basic security assessment value JSA and the intrusion defense value RF, but is used as an adjustment factor to affect the calculation of the dynamic risk assessment value DP through a specific mathematical expression. Specifically, this expression takes into account the weight and influence of the current activity threat intensity value DW relative to the basic security assessment value JSA and the intrusion defense value RF; However, to simplify the understanding, we imagine this process as a weighted adjustment process. When the current active threat intensity value DW is high, it means that the current threat level faced by the network is high. Even if the basic security assessment value JSA and the intrusion defense value RF are also high, the network still faces a greater risk due to the severity of the threat. Therefore, when calculating the dynamic risk assessment value DP, the high value of the current active threat intensity value DW will "aggravate" the risk assessment, resulting in a relatively high value of the dynamic risk assessment value DP. On the contrary, when the current active threat intensity value DW is low, it means that the current threat level faced by the network is low. Even if the values ​​of the basic security assessment value JSA and the intrusion defense value RF are relatively low, the risk of the network is relatively low, because the severity of the threat is not enough to pose a major threat to the network at this time. Therefore, the low value of the current active threat intensity value DW will "reduce" the assessment of the risk, resulting in a relatively low value of the dynamic risk assessment value DP. The dynamic risk assessment value DP output by this algorithm unit introduces the current active threat intensity value DW as an assessment factor based on the basic security assessment value JSA, so that network administrators can quickly understand the current threat level and immediately initiate the corresponding emergency response mechanism. This instant response capability is crucial for dealing with sudden security incidents and helps reduce the scope and time of the impact of security incidents on the network; This algorithm unit associates the current active threat intensity value DW with the basic security assessment value JSA and the intrusion defense value RF. The dynamic risk assessment value DP can balance the network's defense capability with the current threat level. Even in a high-threat environment, high intrusion prevention capabilities can partially offset the impact of the threat and maintain the security and stability of the network. The evaluation results of the dynamic risk assessment value DP of this algorithm unit help network administrators to reasonably allocate security resources according to the current threat level, including increasing the capabilities of security monitoring and response teams to cope with high-threat environments. In particular, by identifying key threats and weak links, administrators can allocate security resources more accurately to ensure that key businesses and sensitive data are fully protected.

[0027] See also Figures 1 to 4 , the calculation formula for guiding the comprehensive adjustment unit is as follows: TZ = [DP*(1+log 10(1+SJ / DP))] / 1+(AS / 100) 0.5 ; in: TZ is the comprehensive safety adjustment value; SJ is the severity value of the last audit, and SJ reflects the immediate status of the last security audit; SJ / DP reflects the current safety status compared with the past and historical average levels; log 10 (1+SJ / DP) is used to amplify the impact of the previous audit severity value SJ on the dynamic risk assessment value DP while avoiding overreaction to a smaller previous audit severity value SJ.

[0028] In this embodiment, the algorithm unit first combines the dynamic risk assessment value DP and the last audit severity value SJ to provide a scientific basis for the adjustment of the security policy. By calculating the comprehensive security adjustment value TZ, the network administrator can clearly know the direction and intensity of the adjustment required; Guide the comprehensive adjustment unit log 10 The calculation part of (1+SJ / DP) is used to amplify the impact of the last audit severity value SJ on the comprehensive security adjustment value TZ, but avoids overreaction to the small last audit severity value SJ, which helps prevent unnecessary over-adjustment when the RA value is small; AS / 100 is used to adjust the comprehensive security adjustment value TZ according to the efficiency of security facilities. This adjustment mechanism enables the comprehensive security adjustment value TZ to adapt to the security requirements in different network environments, ensuring that the adjustment of security policies is more accurate and effective; The comprehensive security adjustment value TZ of this algorithm unit provides comprehensive security adjustment suggestions for network administrators, points out the direction and intensity of adjustment, and provides specific adjustment strategies and measures. These strategies and measures are targeted and operational, and can help network administrators quickly implement security adjustment plans and improve the effect and efficiency of security adjustment. The cyclic impact mechanism of this algorithm unit enables the security status of the network to be continuously improved. By continuously monitoring, evaluating and adjusting security policies, network administrators can gradually optimize the network's security protection system and improve the overall security and stability of the network.

[0029] See also Figures 1 to 4 , the safety protection adjustment steps based on the guidance comprehensive adjustment unit are as follows: S1. The calculation formula for the average value of the first m comprehensive safety adjustment values ​​TZ extracted from the data detection and acquisition module is as follows: TZ avg =(TZ1+TZ2+TZ3+......TZn ) / m; m is the total amount of extraction; S2, if TZ>TZ avg , it means that the network faces a greater security risk under the current security policy, and corresponding security adjustments should be made; S3, if TZ <TZ avg , it means that the network has a high security level under the current security policy. The current policy should be maintained and security assessments and audits should be performed regularly. S4. If TZ = TZ avg , it means that the network is in a relatively safe state under the current security policy. We should conduct continuous detection and pay close attention to the security status of the network.

[0030] In this embodiment, the algorithm unit is based on the average value TZ of the previous m comprehensive safety adjustment values ​​TZ avg By comparing with the comprehensive security adjustment value TZ, we can get the risk situation of the current security strategy and the corresponding measures. The average value of the previous m times can be used as a reference standard comparison value, and combined with the recent adjustment of computer network information security, it has accurate and targeted reference value. The calculation result of the comprehensive security adjustment value TZ indirectly affects the evaluation result of the next basic security assessment value JSA by guiding the adjustment of the security policy. This closed-loop feedback mechanism makes network security management a continuous process, which helps network administrators to continuously optimize and improve security policies. As time goes by, the cyclical impact of the comprehensive security adjustment value TZ on the basic security assessment value JSA will gradually accumulate and produce significant effects. By continuously adjusting and optimizing security policies, the security status of the network will gradually improve and enhance, forming a virtuous cycle. The circular impact of the guidance comprehensive adjustment unit on the quantitative network basic security level unit will promote the improvement of the overall network security level. Through scientific evaluation, precise adjustment and continuous improvement, network administrators can build an efficient, reliable and secure network protection system to provide strong guarantee for the safe and stable operation of the network; In summary, in the specific implementation process, the quantified network basic security level unit, the dynamic network risk assessment unit and the guidance comprehensive adjustment unit and their cyclical impact together constitute a complete computer network information security protection system, providing a strong guarantee for the safe and stable operation of the network.

[0031] See also Figures 1 to 4 The comprehensive security adjustment value TZ is a relative value used to guide the adjustment of security policies. In actual situations, TZ <TZ avg Negative numbers are rare. If negative numbers occur under certain circumstances, the specific feedback adjustment is as follows: During the adjustment process, the accuracy and rationality of the intrusion prevention value RF, security facility operation efficiency AS, threat response time WX and average response time PX should be re-evaluated; Measure and evaluate whether new threat factors and security requirements are introduced. Based on the analysis and evaluation results, formulate corresponding adjustment measures to optimize the calculation results of the comprehensive security adjustment value TZ and the network security status. The adjustment measures include optimizing the configuration and performance of security equipment, strengthening security monitoring and response capabilities, and improving network security strategies and enforcement efforts.

[0032] In this embodiment, the comprehensive security adjustment value TZ is an important indicator for guiding the adjustment of security policies. If a negative number appears, it will mislead the administrator to take inappropriate security measures, such as mistakenly reducing the investment in security resources and relaxing vigilance against potential threats. The negative result of the comprehensive security adjustment value TZ directly points to problems with the calculation model and parameter settings, which requires the administrator to re-examine and verify the rationality and accuracy of the entire security assessment system. When allocating resources based on the comprehensive security adjustment value TZ, a negative number will cause security resources to be incorrectly reduced and reallocated, thereby affecting the overall layout and effect of network security.

[0033] By adjusting and optimizing the calculation model and parameter settings, the accuracy and reliability of the comprehensive security adjustment value TZ results can be ensured, thereby improving the credibility of the entire security assessment system. After correcting the comprehensive security adjustment value TZ results, the allocation of security resources can be guided more scientifically to ensure that key businesses and sensitive data are fully protected while avoiding waste of resources. Targeted adjustments can be made to the problems revealed by the negative comprehensive security adjustment value TZ, including strengthening security monitoring, improving response speed, optimizing security policies, etc., which can significantly improve the network's security defense capabilities. During the adjustment process, administrators need to deeply analyze the causes and impacts of negative comprehensive security adjustment values ​​TZ, which will help them better understand the network's security status and risk points, thereby improving the efficiency and accuracy of emergency response. In addition, the emergence of negative comprehensive security adjustment values ​​TZ and its subsequent adjustment process is a process of continuous learning and improvement. Through this process, administrators can accumulate experience, improve systems, and optimize processes, thereby promoting continuous improvement and enhancement of network security.

[0034] To sum up, although a negative comprehensive security adjustment value TZ is an unfavorable situation, it can be transformed into an opportunity to promote improvements and enhancements in network security through timely adjustments and optimizations.

[0035] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations can be made to the embodiments without departing from the principles and spirit of the present invention, and the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A method for protecting information security of a computer network, characterized in that: The specific implementation steps are as follows: Step 1: Using the data detection and collection module, collect the detection data of computer network security configuration information; Step 2: Substitute the detection data into the data comprehensive processing module, input and output to obtain the basic safety assessment value JSA, dynamic risk assessment value DP and comprehensive safety adjustment value TZ; Step 3: compare the difference between the comprehensive security adjustment value TZ and the average value of the previous m comprehensive security adjustment values ​​TZ extracted from the data detection and acquisition module, and determine the security areas for adjustment, including improving the intrusion prevention capability, optimizing the efficiency of security facilities, and reducing the current activity threat level; The data comprehensive processing module includes a unit for quantifying the basic network security level, a unit for dynamically evaluating network risks and a unit for guiding comprehensive adjustment.

2. A computer network information security protection method according to claim 1, characterized in that: The equipment used in the data detection and collection module includes intrusion prevention systems, firewalls, intrusion detection systems, network performance testing tools, security auditing tools, and monitoring and log analysis tools; The equipment used by the data comprehensive processing module includes a server and a storage device.

3. The information security protection method of a computer network according to claim 2, characterized in that: The detection data of the configuration information includes scoring based on the deployment, update and policy effectiveness of the intrusion prevention system; Analyze and determine the operating efficiency of security devices using monitoring and log analysis tools; Detect threat response time WX and average response time PX, and use network performance testing tools to give response efficiency XX; Monitor and detect active threats in the network; Security audit tools conduct regular security audits and record the number and severity of problems found.

4. The information security protection method of a computer network according to claim 3, characterized in that: The calculation formula for the quantitative network basic security level unit is as follows: JAQ=[(RF+AS)+XX] 0.5 ; XX=WX / PX; in: JAQ is the basic safety assessment value; RF is the intrusion defense value, which reflects the defense capability of the network; AS is the operating efficiency of safety facilities; WX is the threat response time, which measures the time interval from when the system detects a threat to when it starts taking response measures; PX is the average response time; XX is the response efficiency. XX is used to compare the threat response time WX and the average response time PX to evaluate the efficiency of the network response when facing threats.

5. The information security protection method of a computer network according to claim 4, characterized in that: The specific response description and calculation formula of the threat response time WX and the average response time PX are as follows: WX=XS-JS; XS is the response time, which reflects the specific time when the system starts to respond to the threat; JS is the detection time, which reflects the specific time when the threat is detected; PS=(WX1+WX2+WX3+......WX n ) / n; WX1+WX2+WX3+......WX n It is the sum of all threat response times WX; n is the total number of responses.

6. The information security protection method of a computer network according to claim 5, characterized in that: The calculation formula for the dynamic assessment network risk unit is as follows: DP=JAQ*[1+(DW / (JAQ / RF 0.5 ))]; in: DP is the dynamic risk assessment value; DW is the current activity threat intensity value, and DW affects the risk level of the dynamic risk assessment value DP; The basic security assessment value JSA is used as a benchmark and multiplied by the expression of the current active threat intensity value DW and the intrusion prevention value RF, so that the impact of the current active threat intensity value DW and the intrusion prevention value RF on the risk assessment is retained by considering the basic security assessment value JSA.

7. The information security protection method of a computer network according to claim 6, characterized in that: The calculation formula of the guiding comprehensive adjustment unit is as follows: TZ=[DP*(1+log 10 (1+SJ / DP))] / 1+(AS / 100) 0.5 ; in: TZ is the comprehensive safety adjustment value; SJ is the severity value of the last audit, and SJ reflects the immediate status of the last security audit; SJ / DP reflects the current safety status compared with the past and historical average levels; log 10 (1+SJ / DP) is used to amplify the impact of the previous audit severity value SJ on the dynamic risk assessment value DP while avoiding overreaction to a smaller previous audit severity value SJ.

8. The information security protection method of a computer network according to claim 7, characterized in that: The safety protection adjustment steps based on the guidance comprehensive adjustment unit are as follows: S1. The calculation formula for the average value of the first m comprehensive safety adjustment values ​​TZ extracted from the data detection and acquisition module is as follows: TZ avg =(TZ1+TZ2+TZ3+......TZ n ) / m; m is the total amount of extraction; S2, if TZ>TZ avg , it means that the network faces a greater security risk under the current security policy, and corresponding security adjustments should be made; S3, if TZ <TZ avg , it means that the network has a high security level under the current security policy. The current policy should be maintained and security assessments and audits should be performed regularly. S4. If TZ = TZ avg , it means that the network is in a relatively safe state under the current security policy. We should conduct continuous detection and pay close attention to the security status of the network.

9. The information security protection method of a computer network according to claim 8, characterized in that: The comprehensive security adjustment value TZ is a relative value used to guide the adjustment of security policies. In actual situations, TZ <TZ avg Negative numbers are rare. If negative numbers occur under certain circumstances, the specific feedback adjustment is as follows: During the adjustment process, the accuracy and rationality of the intrusion prevention value RF, security facility operation efficiency AS, threat response time WX and average response time PX should be re-evaluated; Measure and evaluate whether new threat factors and security requirements are introduced. Based on the analysis and evaluation results, formulate corresponding adjustment measures to optimize the calculation results of the comprehensive security adjustment value TZ and the network security status. The adjustment measures include optimizing the configuration and performance of security equipment, strengthening security monitoring and response capabilities, and improving network security strategies and enforcement efforts.

Images