Information security detection management system

Abstract

The invention relates to the field of security detection management, in particular to an information security detection management system, which is characterized in that acquired real-time operation data of an operation terminal is matched with frequent behavior characteristics, and a behavior characteristic coincidence value is determined, so that an operation behavior abnormal category of the operation terminal is judged; responding to the judgment result, identifying an abnormal frequent calling port and an abnormal information transmission port, constructing a corresponding time domain curve according to the calling frequency of the abnormal frequent calling port and the information transmission frequency of the abnormal information transmission port, and identifying a security exception time domain segment according to the slope of each time domain curve, and obtaining the port interaction data of the security exception time domain segment to determine the security risk representation value of the information, and judging whether to close the port and stop information transmission, thereby being capable of effectively preventing and controlling the abnormal diffusion of the information in time, and ensuring the security of the information and the information transmission.

Description

Technical Field

[0001] The present invention relates to the field of security detection management, and in particular to an information security detection management system. Background Art

[0002] The openness and interconnectedness of the network make information extremely vulnerable to various attacks during transmission. For example, abnormal attacks may occur during information transmission, such as intrusions into switching transmission ports to steal information. Outsiders may attempt to steal sensitive data such as the company's business secrets and users' personal privacy information, thereby causing huge economic losses and reputation damage to the relevant entities. For example, some large companies have been attacked by hackers due to network security vulnerabilities, resulting in customer information leakage. Not only do they face huge legal compensation, but their brand image has also been severely impacted in the market. Therefore, an efficient and reliable information security detection and management system is needed to ensure the safe transmission, storage and use of information.

[0003] Chinese patent application publication number: CN118133281A, discloses an artificial intelligence-based automatic detection method for software data security, which obtains software data and the number of responses to the software data within a preset time period, obtains abnormal score values ​​of the software data based on the distribution of software data of the same data type and the change in the number of responses to the software data, clusters the software data, and obtains initial clustering clusters; obtains quantile judgment values ​​based on the differences between the initial clustering clusters and the characteristic differences in the abnormal score values ​​between the initial clustering clusters and the preset time period, clusters the initial clustering clusters, and obtains second clustering clusters.

[0004] However, there are still the following problems in the prior art:

[0005] In an intranet environment, there may be human intrusion into the operating terminal, causing the operating terminal to be unsafe. The existing technology lacks analysis of the relevant operating characteristics of the operating terminal at all times, resulting in poor information security of the operating terminal. Summary of the invention

[0006] To this end, the present invention provides an information security detection and management system to overcome the problem in the prior art that in an intranet environment, there may be human intrusion into the operating terminal, resulting in the insecurity of the operating terminal. The prior art lacks analysis of the relevant operating characteristics of the operating terminal at all times, resulting in poor information security of the operating terminal.

[0007] To achieve the above object, the present invention provides an information security detection and management system, which includes:

[0008] A feature acquisition module, used to acquire historical operation data of the operation terminal and identify the normal behavior characteristics of the operation terminal, wherein the normal behavior characteristics include the normal call frequency of each port corresponding to the operation terminal within a predetermined time period and the normal information transmission frequency of each port;

[0009] An activity analysis module, which is connected to the feature acquisition module, and is used to obtain the real-time operation data of the operation terminal and match it with the normal behavior characteristics, determine the behavior characteristic matching value, and determine the abnormal category of the operation behavior of the operation terminal;

[0010] an abnormality identification module, which is connected to the feature acquisition module and the activity analysis module respectively, and is used to identify abnormal frequent call ports and abnormal information transmission ports in response to the determination result of the activity analysis module;

[0011] A time domain identification module, which is connected to the abnormal identification module, is used to construct a corresponding time domain curve according to the calling frequency of the abnormal frequently called port and the information transmission frequency of the abnormal information transmission port, and identify the safety abnormal time domain segment according to the slope of each time domain curve;

[0012] An abnormality determination module, which is connected to the time domain identification module, is used to obtain the port interaction data of the security abnormality time domain segment to determine the security risk characterization value of the information, and determine whether to close the port and stop the information transmission;

[0013] The port interaction data includes the amount of transmitted data and the number of times the information is transferred.

[0014] Furthermore, the process of the activity analysis module for obtaining the real-time operation data of the operation terminal and matching it with the regular behavior characteristics includes:

[0015] To obtain real-time operation data and regular behavior characteristics of the operation terminal;

[0016] for calculating a first difference ratio between the real-time calling frequency of each port and the regular calling frequency of the port;

[0017] The second difference ratio of the information transmission frequency corresponding to the real-time information transmission frequency of each port and the normal information transmission frequency of the port is calculated.

[0018] Furthermore, the process of determining the behavior feature matching value by the activity analysis module includes:

[0019] The first difference ratio and the second difference ratio are weightedly summed to determine a behavior feature matching value.

[0020] Furthermore, the activity analysis module is used to determine the abnormal category of the operation behavior of the operation terminal, including:

[0021] If the behavior feature match value is not within the behavior feature match threshold range, it is determined that the operation behavior of the operation terminal belongs to the abnormal category.

[0022] Furthermore, the abnormality identification module is used to perform abnormality identification analysis on the operation terminal in response to the determination result of the active analysis module, including:

[0023] If the operation behavior of the operation terminal belongs to the abnormal category, the abnormal frequent call port and the abnormal information transmission port are identified, and the time domain identification module and the abnormal determination module are synchronously called.

[0024] Furthermore, the process of the abnormal identification module for identifying abnormally frequently called ports and abnormal information transmission ports includes:

[0025] If the calling frequency of any port is greater than or equal to the abnormal calling frequency threshold, the port is identified as an abnormally frequently called port;

[0026] If the information transmission frequency of any port is greater than or equal to the information transmission frequency abnormal threshold, the port is identified as an abnormal information transmission port.

[0027] Furthermore, the time domain identification module is used to identify the safety abnormal time domain segment according to the slope of each time domain curve, including:

[0028] If the slope of any time domain segment of any time domain curve is greater than or equal to a preset slope threshold, the time domain segment is identified as a safety abnormality time domain segment.

[0029] Furthermore, the process of the abnormality determination module obtaining the port interaction data of the security abnormality time domain segment to determine the security risk characterization value of the information includes:

[0030] Using the ratio of the amount of transmitted data to the threshold value of the amount of transmitted data as the first risk feature;

[0031] The ratio of the number of information circulations to the circulation number threshold is used as the second risk feature;

[0032] The sum of the first risk feature and the second risk feature is determined as the security risk characterization value of the port.

[0033] Furthermore, the abnormality determination module is used to determine whether to close the port and stop the information transmission, including:

[0034] If the security risk characterization value is greater than or equal to the security risk characterization threshold, it is determined to close the port and stop information transmission.

[0035] Furthermore, it also includes a safety warning module, which is connected to the abnormality determination module and is used to issue a warning prompt signal according to the determination result of the abnormality determination module.

[0036] Compared with the prior art, the present invention matches the acquired real-time operation data of the operation terminal with the normal behavior characteristics to determine the behavior characteristic matching value to determine the abnormal category of the operation behavior of the operation terminal; responds to the determination result, identifies the abnormally frequently called port and the abnormal information transmission port, constructs the corresponding time domain curve according to the calling frequency of the abnormally frequently called port and the information transmission frequency of the abnormal information transmission port, identifies the security abnormal time domain segment according to the slope of each time domain curve, obtains the port interaction data of the security abnormal time domain segment to determine the security risk characterization value of the information, and determines whether to close the port and intercept information transmission. The present invention matches real-time operation with normal behavior, accurately determines whether the operation behavior of the operation terminal is abnormal and the abnormal category, accurately identifies and locates the abnormal port, extracts the representative abnormal port data features to visualize and quantify the security risk degree of the operation terminal, timely and effectively prevents and controls the abnormal spread of information, and ensures the security of information and information transmission.

[0037] In particular, the present invention matches the real-time operation data of the operation terminal with the normal behavior characteristics, and identifies the call frequency and information transmission frequency of each port within a representative predetermined time period by acquiring the historical operation data of the operation terminal. In actual situations, when the operation terminal is controlled by unauthorized personnel, the control of the operation terminal may be greatly different from the normal behavior characteristics. Therefore, considering the above-mentioned influence, the behavior characteristics of the operation terminal under normal use are accurately identified from multiple dimensions, which provides a reference basis for the subsequent matching of the real-time operation data with the normal behavior characteristics. The behavior characteristic matching value is determined by calculating the deviation between the current call frequency and information transmission frequency of each port and the corresponding characteristics under normalization to quantify the degree of difference in the behavior of the current operation terminal. The relationship between the two is comprehensively considered to more accurately grasp the change in the behavior characteristics of the port. For example, there may be a situation where the call frequency deviation of any port is small, but the information transmission frequency deviation is large. Therefore, the current operation behavior of the operation terminal is characterized and determined in the data dimension through a more detailed comparison of the comprehensive changes of the two parties, and the behavior characteristic matching value can characterize the abnormal tendency degree of the corresponding operation behavior of the current operation terminal, which provides data support for the subsequent accurate judgment of the abnormal category of the operation behavior.

[0038] In particular, the present invention identifies abnormal ports and identifies security abnormal time domain segments according to the behavioral characteristics of the abnormal ports. In actual situations, if the actual behavioral characteristics reflected by the operating terminal are different from the normal behavioral characteristics, the operating terminal may be controlled by unauthorized personnel. Therefore, the protection logic is triggered to consider that abnormal ports are more prone to security risks of information interaction. For example, if the call frequency of a port reaches or exceeds the abnormal call frequency threshold, or the information transmission frequency of a port reaches or exceeds the abnormal information transmission frequency threshold, it is clearly identified as an abnormal port, and then the behavioral characteristics of each abnormal port are monitored. For example, in the case of abnormal access to information by unauthorized operators, within a certain period of time, the information call frequency corresponding to the port used by the operator may be greatly different from the common sense behavioral characteristics; if the information of the operating terminal is stolen or transferred by external personnel for risky operations such as transmission, the information transmission frequency of the port used for risky operations may suddenly increase within a certain period of time;

[0039] Considering the above situation, the corresponding time domain segment is determined as the security abnormal time domain segment, and then, the abnormal frequently called port and the abnormal information transmission port in the security abnormal time domain segment are determined, and the security risk characterization value of the information is determined according to the interaction data in the security abnormal time domain segment of each port. In the actual information transmission process, the information transmission progress and the degree of completion of the information transmission can be determined by the information transmission completion ratio, for example, whether the information has completed the transmission task and whether the information has been transmitted to the next port; the abnormal possibility of information flow is characterized according to the number of information flows, and at the same time, it can be determined whether the information flow is within the normal transmission range and whether abnormal flow occurs, for example, abnormal forwarding of information, multiple unnecessary jumps and other abnormal situations, so as to evaluate the potential security risks of information transmission, and measure the security risk degree of the port and the information being transmitted by the security risk characterization value, so as to provide data support for the subsequent determination of whether to close the port and intercept the information transmission and other measures. The present invention can dynamically detect the security risk of information according to the operation behavior of the operation terminal, improve the efficiency and accuracy of abnormal port identification, and take targeted and effective prevention and control measures in time for the port with security risks to ensure the security of information and information transmission flow. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 This is a functional module diagram of the information security detection and management system of an embodiment of the invention;

[0041] Figure 2 A logic determination diagram for determining abnormal categories of operation behaviors of an operation terminal according to an embodiment of the invention;

[0042] Figure 3 A logic decision diagram for identifying a security anomaly time domain segment for an embodiment of the invention;

[0043] Figure 4 A logical decision diagram for determining whether to close a port and stop information transmission according to an embodiment of the present invention. DETAILED DESCRIPTION

[0044] In order to make the objects and advantages of the present invention more clearly understood, the present invention is further described below in conjunction with embodiments; it should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0045] The preferred embodiments of the present invention are described below with reference to the accompanying drawings. It should be understood by those skilled in the art that these embodiments are only used to explain the technical principles of the present invention and are not intended to limit the protection scope of the present invention.

[0046] In addition, it should be noted that in the description of the present invention, unless otherwise clearly specified and limited, the term "connection" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection. For those skilled in the art, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0047] See also Figures 1 to 4 As shown, Figure 1 This is a functional module diagram of the information security detection and management system according to an embodiment of the present invention. Figure 2 This is a logic determination diagram for determining the abnormal category of the operation behavior of the operation terminal according to an embodiment of the present invention. Figure 3 A logical decision diagram for identifying a security abnormality time domain segment in an embodiment of the invention, Figure 4 The present invention is a logic decision diagram for determining whether to close a port and stop information transmission in an embodiment of the present invention. The information security detection and management system in an embodiment of the present invention includes:

[0048] A feature acquisition module, used to acquire historical operation data of the operation terminal and identify the normal behavior characteristics of the operation terminal, wherein the normal behavior characteristics include the normal call frequency of each port corresponding to the operation terminal within a predetermined time period and the normal information transmission frequency of each port;

[0049] An activity analysis module, which is connected to the feature acquisition module, and is used to obtain the real-time operation data of the operation terminal and match it with the normal behavior characteristics, determine the behavior characteristic matching value, and determine the abnormal category of the operation behavior of the operation terminal;

[0050] an abnormality identification module, which is connected to the feature acquisition module and the activity analysis module respectively, and is used to identify abnormal frequent call ports and abnormal information transmission ports in response to the determination result of the activity analysis module;

[0051] A time domain identification module, which is connected to the abnormal identification module, is used to construct a corresponding time domain curve according to the calling frequency of the abnormal frequently called port and the information transmission frequency of the abnormal information transmission port, and identify the safety abnormal time domain segment according to the slope of each time domain curve;

[0052] An abnormality determination module, which is connected to the time domain identification module, is used to obtain the port interaction data of the security abnormality time domain segment to determine the security risk characterization value of the information, and determine whether to close the port and stop the information transmission;

[0053] The port interaction data includes the amount of transmitted data and the number of times the information is transferred.

[0054] In this embodiment, the duration from a single opening of the operation terminal to a closing of the operation terminal is determined as the predetermined time period.

[0055] Specifically, there is no limitation on the specific structures of the feature acquisition module, active analysis module, anomaly identification module, time domain discrimination module, anomaly determination module and security warning module, and they themselves or each unit therein can be composed of logic components or a combination of logic components, and the logic components include a field programmable processor, a computer or a microprocessor in a computer.

[0056] It is understandable that when an operating terminal (such as a personal computer, server, smart phone, etc.) communicates with other devices or servers, it usually needs to call the corresponding port for interaction, and there may be multiple interactions in a short period of time, and data transmission will be generated during the interaction, for example, loading information from the server, exchanging information with other terminals, etc.;

[0057] Furthermore, the calling frequency of each port can be obtained through the corresponding network monitoring tool, which will not be described in detail here.

[0058] The information transmission frequency of a port refers to the rate at which data is transmitted through a specific port, which can be measured in bits per second (bps).

[0059] Specifically, the process of the activity analysis module for obtaining the real-time operation data of the operation terminal and matching it with the regular behavior characteristics includes:

[0060] To obtain real-time operation data and regular behavior characteristics of the operation terminal;

[0061] for calculating a first difference ratio between the real-time calling frequency of each port and the regular calling frequency of the port;

[0062] The second difference ratio of the information transmission frequency corresponding to the real-time information transmission frequency of each port and the normal information transmission frequency of the port is calculated.

[0063] It can be understood that when calculating the difference ratio of two values, the difference ratio is obtained by solving the ratio of the difference between the two values ​​to the mean of the two values, which will not be described in detail.

[0064] Specifically, the process of determining the behavior feature matching value by the activity analysis module includes:

[0065] The first difference ratio and the second difference ratio are weightedly summed to determine a behavior feature matching value.

[0066] In this implementation, when performing weighted summation, the weight of the call frequency deviation is set to 0.45, and the weight of the information transmission frequency deviation is set to 0.55;

[0067] The present invention matches the real-time operation data of the operation terminal with the normal behavior characteristics, and identifies the call frequency and information transmission frequency of each port within a representative predetermined time period by acquiring the historical operation data of the operation terminal. In actual situations, when the operation terminal is controlled by unauthorized personnel, the control of the operation terminal may be greatly different from the normal behavior characteristics. Therefore, considering the above-mentioned influence, the behavior characteristics of the operation terminal under normal use are accurately identified from multiple dimensions, which provides a reference basis for the subsequent matching of the real-time operation data with the normal behavior characteristics. The behavior characteristic matching value is determined by calculating the deviation between the current call frequency and information transmission frequency of each port and the corresponding characteristics under normalization to quantify the degree of difference in the behavior of the current operation terminal. The relationship between the two is comprehensively considered to more accurately grasp the change in the behavior characteristics of the port. For example, there may be a situation where the call frequency deviation of any port is small, but the information transmission frequency deviation is large. Therefore, the current operation behavior of the operation terminal is characterized and determined in the data dimension through a more detailed comparison of the comprehensive changes of the two parties, and the behavior characteristic matching value can characterize the abnormal tendency degree of the corresponding operation behavior of the current operation terminal, which provides data support for the subsequent accurate judgment of the abnormal category of the operation behavior.

[0068] Specifically, the activity analysis module is used to determine the abnormal category of the operation behavior of the operation terminal, including:

[0069] If the behavior feature match value is not within the behavior feature match threshold range, it is determined that the operation behavior of the operation terminal belongs to the abnormal category;

[0070] If the behavior feature match value is within the behavior feature match threshold range, it is determined that the operation behavior of the operation terminal belongs to the non-abnormal category.

[0071] The behavioral feature matching threshold interval is [1.23,1.36].

[0072] Specifically, the abnormality identification module is used to perform abnormality identification analysis on the operation terminal in response to the determination result of the active analysis module, including:

[0073] If the operation behavior of the operation terminal belongs to the abnormal category, the abnormal frequent call port and the abnormal information transmission port are identified, and the time domain identification module and the abnormal determination module are synchronously called.

[0074] It is understandable that after calling the corresponding module, the time domain identification module and the abnormality determination module can perform corresponding functions and complete relevant logical determination or operation, which will not be repeated here.

[0075] Specifically, the process of the abnormal identification module for identifying abnormally frequently called ports and abnormal information transmission ports includes:

[0076] If the call frequency of any port is greater than or equal to the abnormal call frequency threshold, the port is identified as an abnormally frequent call port. It can be understood that the abnormal call frequency threshold for different ports may be different. The abnormal call frequency threshold is determined based on the port currently being calculated.

[0077] If the information transmission frequency of any port is greater than or equal to the information transmission frequency abnormal threshold, the port is identified as an abnormal information transmission port.

[0078] In this embodiment, the call frequency abnormality threshold and the information transmission frequency abnormality threshold are pre-set, and the call frequency historical data and the information transmission frequency historical data of each port of the operation terminal are obtained to solve the call frequency mean and the information transmission frequency mean. The call frequency abnormality threshold is set to 2.03 times to 3.04 times the call frequency mean, and the information transmission frequency abnormality threshold is set to 2.24 times to 3.32 times the information transmission frequency mean.

[0079] Specifically, the time domain identification module is used to identify the safety abnormal time domain segment according to the slope of each time domain curve, including:

[0080] If the slope of any time domain segment of any time domain curve is greater than or equal to a preset slope threshold, the time domain segment is identified as a safety abnormality time domain segment;

[0081] If the slope of any time domain segment of any time domain curve is less than a preset slope threshold, then the time domain segment is not a safety abnormality time domain segment.

[0082] In this embodiment, the corresponding time domain curve is constructed as follows:

[0083] A rectangular coordinate system is constructed with time as the horizontal axis and the calling frequency of the abnormally frequently called port as the vertical axis;

[0084] Marking the coordinate points of the calling frequency at each moment in the rectangular coordinate system;

[0085] Connecting the coordinate points with a smooth curve to obtain a call frequency time domain curve;

[0086] A rectangular coordinate system is constructed with time as the horizontal axis and the information transmission frequency of the abnormal information transmission port as the vertical axis;

[0087] Marking the coordinate points of the information transmission frequency at each moment in the rectangular coordinate system;

[0088] The coordinate points are connected with a smooth curve to obtain an information transmission frequency time domain curve.

[0089] In this embodiment, any time domain curve includes a calling frequency time domain curve and an information transmission frequency time domain curve, which will not be described in detail.

[0090] Among them, the slope threshold of the sub-time domain segment of the frequency-time domain curve is selected in the interval [0.52, 0.61];

[0091] The slope threshold of the sub-time domain segment of the information transmission frequency time domain curve is selected in the interval [0.68, 0.74];

[0092] Specifically, there is no limitation on the method of constructing each time domain curve. For example, the time domain curve can be fitted by using matlab related fitting software, which will not be described in detail.

[0093] Specifically, the process of the abnormality determination module obtaining the port interaction data of the security abnormality time domain segment to determine the security risk characterization value of the information includes:

[0094] Using the ratio of the amount of transmitted data to the threshold value of the amount of transmitted data as the first risk feature;

[0095] The ratio of the number of information circulations to the circulation number threshold is used as the second risk feature;

[0096] The sum of the first risk feature and the second risk feature is determined as the security risk characterization value of the port.

[0097] In this embodiment, the data transmission volume threshold and the information flow number threshold are preset, and the historical data of the data transmission volume and the historical data of the information flow number within the detection time of the operation terminal and the corresponding port during the transmission process are obtained, and the average data transmission volume and the average information flow number are solved. The data transmission volume threshold is set to 1.08 times to 1.16 times the average data transmission volume, and the information flow number threshold is set to 1.12 times to 1.24 times the average information flow number;

[0098] The detection duration is equal to the duration corresponding to the security anomaly time domain segment.

[0099] Specifically, the abnormality determination module is used to determine whether to close the port and stop the information transmission, including:

[0100] If the security risk characterization value is greater than or equal to the security risk characterization threshold, it is determined to close the port and stop information transmission;

[0101] If the security risk characterization value is less than the security risk characterization threshold, it is determined that there is no need to close the port and intercept information transmission.

[0102] The safety risk characterization threshold is selected in the interval [1.68,1.73].

[0103] Specifically, there is no specific limitation on the method of stopping information transmission. For example, a reset packet may be sent to an operating terminal that is transmitting information to forcibly close the TCP connection to terminate the information transmission. Of course, other methods may also be used, which will not be described in detail.

[0104] The present invention identifies abnormal ports and identifies security abnormal time domain segments according to the behavioral characteristics of the abnormal ports. In actual situations, if the actual behavioral characteristics reflected by the operation terminal are different from the normal behavioral characteristics, the operation terminal may be controlled by unauthorized personnel. Therefore, the protection logic is triggered to consider that abnormal ports are more prone to security risks of information interaction. For example, if the call frequency of a port reaches or exceeds the abnormal call frequency threshold, or the information transmission frequency of a port reaches or exceeds the abnormal information transmission frequency threshold, it is clearly identified as an abnormal port, and then the behavioral characteristics of each abnormal port are monitored. For example, in the case of abnormal access to information by unauthorized operators, within a certain period of time, the information call frequency corresponding to the port used by the operator may be greatly different from the common sense behavioral characteristics; if the information of the operation terminal is stolen or transferred by external personnel for risky operations such as risky operations, the information transmission frequency of the port used for transmission during risky operations may suddenly increase within a certain period of time;

[0105] Considering the above situation, the corresponding time domain segment is determined as the security abnormal time domain segment, and then, the abnormal frequently called port and the abnormal information transmission port in the security abnormal time domain segment are determined, and the security risk characterization value of the information is determined according to the interaction data in the security abnormal time domain segment of each port. In the actual information transmission process, the information transmission progress and the degree of completion of the information transmission can be determined by the information transmission completion ratio, for example, whether the information has completed the transmission task and whether the information has been transmitted to the next port; the abnormal possibility of information flow is characterized according to the number of information flows, and at the same time, it can be determined whether the information flow is within the normal transmission range and whether abnormal flow occurs, for example, abnormal forwarding of information, multiple unnecessary jumps and other abnormal situations, so as to evaluate the potential security risks of information transmission, and measure the security risk degree of the port and the information being transmitted by the security risk characterization value, so as to provide data support for the subsequent determination of whether to close the port and intercept the information transmission and other measures. The present invention can dynamically detect the security risk of information according to the operation behavior of the operation terminal, improve the efficiency and accuracy of abnormal port identification, and take targeted and effective prevention and control measures in time for the port with security risks to ensure the security of information and information transmission flow.

[0106] Specifically, it also includes a safety warning module, which is connected to the abnormality determination module and is used to issue a warning prompt signal according to the determination result of the abnormality determination module.

[0107] In this embodiment, if the abnormality determination module determines to close the port and stop the information transmission, it determines to send an early warning prompt signal;

[0108] Among them, the early warning prompt signal can be sent to the main console corresponding to the operation terminal so that the maintenance personnel can take timely protective measures. The early warning prompt signal includes the name of the abnormal port and the abnormal port category, which will not be repeated here.

[0109] So far, the technical solutions of the present invention have been described in conjunction with the preferred embodiments shown in the accompanying drawings. However, it is easy for those skilled in the art to understand that the protection scope of the present invention is obviously not limited to these specific embodiments. Without departing from the principle of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after these changes or substitutions will fall within the protection scope of the present invention.

Claims

1. An information security detection and management system, characterized in that: include: A feature acquisition module, used to acquire historical operation data of the operation terminal and identify the normal behavior characteristics of the operation terminal, wherein the normal behavior characteristics include the normal call frequency of each port corresponding to the operation terminal within a predetermined time period and the normal information transmission frequency of each port; An activity analysis module, which is connected to the feature acquisition module, and is used to obtain the real-time operation data of the operation terminal and match it with the normal behavior characteristics, determine the behavior characteristic matching value, and determine the abnormal category of the operation behavior of the operation terminal; an abnormality identification module, which is connected to the feature acquisition module and the activity analysis module respectively, and is used to identify abnormal frequent call ports and abnormal information transmission ports in response to the determination result of the activity analysis module; A time domain identification module, which is connected to the abnormal identification module, is used to construct a corresponding time domain curve according to the calling frequency of the abnormal frequently called port and the information transmission frequency of the abnormal information transmission port, and identify the safety abnormal time domain segment according to the slope of each time domain curve; An abnormality determination module, which is connected to the time domain identification module, is used to obtain the port interaction data of the security abnormality time domain segment to determine the security risk characterization value of the information, and determine whether to close the port and stop the information transmission; The port interaction data includes the amount of transmitted data and the number of times the information is transferred.

2. The information security detection and management system according to claim 1, characterized in that: The process of the activity analysis module obtaining the real-time operation data of the operation terminal and matching it with the regular behavior characteristics includes: To obtain real-time operation data and regular behavior characteristics of the operation terminal; for calculating a first difference ratio between the real-time calling frequency of each port and the regular calling frequency of the port; The second difference ratio of the information transmission frequency corresponding to the real-time information transmission frequency of each port and the normal information transmission frequency of the port is calculated.

3. The information security detection and management system according to claim 2 is characterized in that: The process of determining the behavior feature matching value by the activity analysis module includes: The first difference ratio and the second difference ratio are weightedly summed to determine a behavior feature matching value.

4. The information security detection and management system according to claim 1, characterized in that: The activity analysis module is used to determine the abnormal category of the operation behavior of the operation terminal. include, If the behavior feature match value is not within the behavior feature match threshold range, it is determined that the operation behavior of the operation terminal belongs to the abnormal category.

5. The information security detection and management system according to claim 1, characterized in that: The abnormality identification module is used to perform abnormality identification analysis on the operation terminal in response to the determination result of the active analysis module, including: If the operation behavior of the operation terminal belongs to the abnormal category, the abnormal frequent call port and the abnormal information transmission port are identified, and the time domain identification module and the abnormal determination module are synchronously called.

6. The information security detection and management system according to claim 1, characterized in that: The process of the abnormal identification module for identifying abnormally frequently called ports and abnormal information transmission ports includes: If the calling frequency of any port is greater than or equal to the abnormal calling frequency threshold, the port is identified as an abnormally frequently called port; If the information transmission frequency of any port is greater than or equal to the information transmission frequency abnormal threshold, the port is identified as an abnormal information transmission port.

7. The information security detection and management system according to claim 1, characterized in that: The time domain identification module is used to identify the safety abnormal time domain segment according to the slope of each time domain curve, including: If the slope of any time domain segment of any time domain curve is greater than or equal to a preset slope threshold, the time domain segment is identified as a safety abnormality time domain segment.

8. The information security detection and management system according to claim 1, characterized in that: The process of the abnormality determination module obtaining the port interaction data of the security abnormality time domain segment to determine the security risk characterization value of the information includes: Using the ratio of the amount of transmitted data to the threshold value of the amount of transmitted data as the first risk feature; The ratio of the number of information circulations to the circulation number threshold is used as the second risk feature; The sum of the first risk feature and the second risk feature is determined as the security risk characterization value of the port.

9. The information security detection and management system according to claim 8, characterized in that: The abnormality determination module is used to determine whether to close the port and stop the information transmission, including: If the security risk characterization value is greater than or equal to the security risk characterization threshold, it is determined to close the port and stop information transmission.

10. The information security detection and management system according to claim 1, characterized in that: It also includes a safety warning module, which is connected to the abnormality determination module and is used to issue a warning prompt signal according to the determination result of the abnormality determination module.

Images