Network-based information security service method and system

Abstract

The invention discloses a network-based information security service method and system, and particularly relates to the technical field of information security management. Comprising a network information protection time division module, a network information security event acquisition module, a network information asset risk management module, a network information asset intrusion protection module, a network information security event response module, a network security protection technology value analysis module and a network security technology evaluation module. According to the invention, network activity data of each time monitoring sub-period of information security service monitoring time of a target enterprise network is collected, an information asset risk assessment index and an information asset intrusion detection index are calculated, and a network activity security event response coefficient and a network security protection value assessment coefficient are further obtained. By monitoring the information asset data and the intrusion data in real time, the information security condition of an enterprise network can be evaluated, so that a more effective security protection strategy is formulated, and the response efficiency of a network security event is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of information security management, and more specifically, to a network-based information security service method and system. Background Art

[0002] Information security services are a comprehensive system built on technology, strategies and management practices, designed to protect the network environment from unauthorized access, data leakage, malware attacks and other forms of network threats. With the acceleration of digital transformation, the importance of information security services has become increasingly prominent.

[0003] With the rapid development of network technology, the data assets of enterprises and individuals are facing unprecedented security threats. Common information security services ensure the confidentiality, integrity and availability of data and protect the security of data transmission and user identity by implementing multi-level defense mechanisms, encryption technology, and authentication and authorization strategies.

[0004] However, there are still some shortcomings in its actual use. For example, due to the diversification of enterprise networks, it is easy to cause information leakage. When information security vulnerabilities occur, security incidents cannot be effectively responded to. Therefore, it is necessary to strengthen the security of network information.

[0005] Existing enterprises lack a sound network security management mechanism and are unable to monitor and detect network attacks in real time. When there are risks such as abuse of authority or unauthorized access, sensitive information may be illegally obtained or tampered with, posing a serious threat to the enterprise's network security and making security protection work very inefficient. Summary of the invention

[0006] In order to overcome the above-mentioned defects of the prior art, an embodiment of the present invention provides a network-based information security service method and system for solving the problems raised in the above-mentioned background technology.

[0007] To achieve the above object, the present invention provides the following technical solution: a network-based information security service system, comprising:

[0008] Network information protection time division module: used to divide the information security service monitoring time into equal time monitoring sub-periods according to the equal time division method, and number each equal time monitoring sub-period.

[0009] Network information security event collection module: used to collect network activity data of each time monitoring sub-period during the information security service monitoring time of the target enterprise network. The network information security event collection module includes an information asset data collection unit and an information asset intrusion data collection unit.

[0010] Network information asset risk management module: Based on the information asset data of the information asset data collection unit, the information asset risk assessment index of each time monitoring sub-period of the information security service monitoring time of the target enterprise network is calculated.

[0011] Network information asset intrusion protection module: Based on the information asset intrusion data of the information asset intrusion data collection unit, the information asset intrusion detection index of each equal time monitoring sub-period of the network information security service monitoring time of the target enterprise network is calculated.

[0012] Network information security incident response module: used to calculate the network activity security incident response coefficient of the target enterprise network's information security service monitoring time, and to issue alarms for network security threat behaviors.

[0013] Network security protection technology value analysis module: used to calculate the network security protection value assessment coefficient of each equal time monitoring sub-period of the target enterprise network's information security service monitoring time based on the information asset risk assessment index and information asset intrusion detection index of each equal time monitoring sub-period of the target enterprise network's information security service monitoring time.

[0014] Network security technology assessment module: obtains the network security protection value assessment coefficient of each time monitoring sub-period of the information security service monitoring time of the target enterprise network, compares it with the preset network security protection value assessment coefficient, and processes it.

[0015] Preferably, the network information protection time division module is specifically:

[0016] The information security service monitoring time of the target enterprise network is obtained, the information security service monitoring time is divided into equal time monitoring sub-periods according to an equal time division method, and the equal time monitoring sub-periods of the information security service monitoring time are numbered 1, 2, ...i, ...n in sequence.

[0017] Preferably, the network information security event collection module is specifically:

[0018] Information asset data collection unit: collects the target enterprise network’s information security service monitoring time, the number of network devices, the number of servers, and the frequency of network vulnerabilities in each time monitoring sub-period, marked as zb i 、zq i 、zd i , where i = 1, 2, ... n, i represents the number of the i-th equal-time monitoring sub-period;

[0019] Information asset intrusion data collection unit: collects the firewall data packet inflow and outflow volume, normal port access traffic, abnormal port interception traffic, internal network access frequency, and public network access frequency during the information security service monitoring time of the target enterprise network, marked as cs i ,ck i ,cl i 、cw i ,cg i .

[0020] Preferably, the calculation formula of the information asset risk assessment index is:

[0021]

[0022] Among them, α i It is expressed as the information asset risk assessment index of the i-th equal-time monitoring sub-period, zb i It is expressed as the number of network devices in the ith equal-time monitoring sub-period, zq i It is represented as the number of servers in the ith equal-time monitoring sub-period, zd i It is represented as the frequency of network vulnerabilities in the i-th equal-time monitoring sub-period.

[0023] Preferably, the network information asset intrusion protection module is specifically:

[0024] Step S01: Calculate the network security health index by monitoring the firewall data packet inflow and outflow, port normal access flow, and internal network access frequency during each time period of the target enterprise network information security service monitoring time:

[0025]

[0026] Among them, KH i It is represented as the network security health indicator of the ith equal-time monitoring sub-period, cs i It is represented by the firewall data packet inflow and outflow volume in the ith equal-time monitoring sub-period, π is represented by a natural constant, ck i It is represented by the normal access flow of the port in the ith equal-time monitoring sub-period, e is represented by a natural constant, cw max It is expressed as the maximum value of the internal network access frequency, cw min It is expressed as the maximum value of the internal network access frequency, cw i It is represented as the internal network access frequency of the i-th equal-time monitoring sub-period;

[0027] Step S02: Calculate the network attack prevention index by monitoring the firewall data packet inflow and outflow, abnormal port interception flow, and public network access frequency during each time period of the target enterprise network information security service monitoring time:

[0028]

[0029] Among them, GF i It is expressed as the network attack prevention index of the i-th equal-time monitoring sub-period, cl i It is represented by the abnormal interception traffic of the port in the ith equal-time monitoring sub-period, cg i represents the frequency of public network access in the i-th equal-time monitoring sub-period, n represents the total number of monitoring sub-periods, T represents the monitoring duration of the sub-period, and i-1 represents the number of the i-1th equal-time monitoring sub-period;

[0030] Step S03: The calculation formula of the information asset intrusion detection index is:

[0031]

[0032] Among them, β i is represented by the information asset intrusion detection index of the i-th equal-time monitoring sub-period, ΔGF is represented by the mean value of the network attack prevention index, KH 预 Represented as preset network security health indicators.

[0033] Preferably, the network information security incident response module is specifically:

[0034] Step S01: The calculation formula of the network activity security incident response coefficient is:

[0035]

[0036] Among them, ω represents the network activity security incident response coefficient, T represents the monitoring duration of the sub-period, and α max Expressed as the maximum value of the information asset risk assessment index, β max Expressed as the maximum value of the information asset intrusion detection index, β min It is represented as the minimum value of the information asset intrusion detection index, and σ is represented as the standard deviation of the information asset risk assessment index;

[0037] Step S02: Obtain the network activity security incident response coefficient of the target enterprise network during the information security service monitoring period, and compare it with the preset network activity security incident response coefficient. If the network activity security incident response coefficient of the target enterprise network during the information security service monitoring period is greater than the preset network activity security incident response coefficient, it indicates that there is a network security threat behavior in the information security service monitoring of the enterprise, and an alarm should be issued to the network management personnel of the enterprise to formulate a response plan. Otherwise, it indicates that the enterprise network information is insecure during the information security service monitoring of the enterprise.

[0038] Preferably, the calculation formula of the network security protection value assessment coefficient is:

[0039]

[0040] Among them, θ i It is expressed as the network security protection value evaluation coefficient of the i-th equal-time monitoring sub-period, α min It is expressed as the minimum value of the information asset risk assessment index in the i-th equal-time monitoring sub-period.

[0041] Preferably, the network security technology assessment module is specifically:

[0042] Obtain the network security protection value assessment coefficient of each time monitoring sub-period of the target enterprise network's information security service monitoring time, and compare it with the preset network security protection value assessment coefficient. If the network security protection value assessment coefficient of a certain period of the target enterprise network's information security service monitoring time is less than the preset network security protection value assessment coefficient, it indicates that the network security protection value assessment of this period is low and the information security management technology configuration does not meet expectations. Otherwise, it indicates that the information security management technology configuration of this period meets expectations and the network security protection value assessment is high.

[0043] Preferably, a network-based information security service method comprises the following steps:

[0044] Step S01: Network information protection time division: used to divide the information security service monitoring time into equal time monitoring sub-periods according to the equal time division method, and number each equal time monitoring sub-period;

[0045] Step S02: Network information security event collection: used to collect network activity data of each time monitoring sub-period during the information security service monitoring time of the target enterprise network, and the network information security event collection includes an information asset data collection unit and an information asset intrusion data collection unit;

[0046] Step S03: Network information asset risk management: Calculate the information asset risk assessment index of each time monitoring sub-period of the target enterprise network's information security service monitoring time according to the information asset data of the information asset data collection unit;

[0047] Step S04: Network information asset intrusion protection: according to the information asset intrusion data of the information asset intrusion data collection unit, calculate the information asset intrusion detection index of each time monitoring sub-period of the network information security service monitoring time of the target enterprise network;

[0048] Step S05: Network information security incident response: used to calculate the network activity security incident response coefficient of the target enterprise network information security service monitoring time, and to issue an alarm for network security threat behavior;

[0049] Step S06: Network security protection technology value analysis: used to calculate the network security protection value assessment coefficient of each equal time monitoring sub-period of the target enterprise network's information security service monitoring time according to the information asset risk assessment index and information asset intrusion detection index of each equal time monitoring sub-period of the target enterprise network's information security service monitoring time;

[0050] Step S07: Network security technology assessment: obtain the network security protection value assessment coefficient of each time monitoring sub-period of the information security service monitoring time of the target enterprise network, compare it with the preset network security protection value assessment coefficient, and process it.

[0051] Technical effects and advantages of the present invention:

[0052] 1. The present invention provides a network-based information security service method and system, which collects network activity data of each equal-time monitoring sub-period during the information security service monitoring time of the target enterprise network, calculates the information asset risk assessment index of each equal-time monitoring sub-period during the information security service monitoring time of the target enterprise network according to the information asset data of the information asset data collection unit, calculates the information asset intrusion detection index of each equal-time monitoring sub-period during the network information security service monitoring time of the target enterprise network according to the information asset intrusion data collection unit, further analyzes and obtains the network activity security event response coefficient of the information security service monitoring time of the target enterprise network, and compares it with the preset network activity security event response coefficient. The coefficients are compared. If the network activity security incident response coefficient of the target enterprise network during the information security service monitoring period is greater than the preset network activity security incident response coefficient, it indicates that there are network security threat behaviors in the information security service monitoring of the enterprise, and an alarm should be issued to the network management personnel of the enterprise to formulate a response plan, including but not limited to event isolation, vulnerability repair, and data backup. Otherwise, it indicates that the enterprise network information security is in the information security service monitoring of the enterprise. By real-time monitoring of information asset data and intrusion data, the information security status of the enterprise network during the monitoring period can be evaluated, so as to formulate more effective security protection strategies, which is conducive to automatically judging the severity of network security incidents and improving the response efficiency of network security incidents;

[0053] 2. The present invention provides a network-based information security service method and system, which utilizes a network security protection technology value analysis module to calculate the network security protection value assessment coefficient of each equal-time monitoring sub-period of the information security service monitoring time of the target enterprise network through the information asset risk assessment index and the information asset intrusion detection index of each equal-time monitoring sub-period of the information security service monitoring time of the target enterprise network, and compares it with the preset network security protection value assessment coefficient. If the network security protection value assessment coefficient of a certain period of the information security service monitoring time of the target enterprise network is less than the preset network security protection value assessment coefficient, it indicates that the network security protection value assessment of the period is low and the information security management technology configuration does not meet expectations. Otherwise, it indicates that the information security management technology configuration of the period meets expectations and the network security protection value assessment is high. By establishing a scientific and standardized information security management evaluation system, the scientificity and standardization of information security management are improved. By dividing the equal-time monitoring sub-periods, the network security protection effects of different periods are dynamically evaluated, which helps enterprises to continuously optimize the information security management system and enhance network security protection capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1 It is a schematic diagram of the system module process connection of the present invention.

[0055] Figure 2 It is a schematic diagram of the structure of the network information security event collection module of the present invention.

[0056] Figure 3 It is a schematic diagram of the connection of the method steps of the present invention. DETAILED DESCRIPTION

[0057] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0058] See also Figure 1 As shown, the present invention provides a network-based information security service system, including a network information protection time division module, a network information security event collection module, a network information asset risk management module, a network information asset intrusion protection module, a network information security event response module, a network security protection technology value analysis module, and a network security technology evaluation module.

[0059] The network information protection time division module is connected to the network information security event collection module, the network information security event collection module is connected to the network information asset risk management module and the network information asset intrusion protection module, the network information asset risk management module and the network information asset intrusion protection module are connected to the network information security incident response module and the network security protection technology value analysis module, and the network security protection technology value analysis module is connected to the network security technology evaluation module.

[0060] The network information protection time division module is used to divide the information security service monitoring time into equal time monitoring sub-periods according to an equal time division method, and number each equal time monitoring sub-period of the information security service monitoring time.

[0061] In a possible design, the network information protection time division module is specifically:

[0062] The information security service monitoring time of the target enterprise network is obtained, the information security service monitoring time is divided into equal time monitoring sub-periods according to an equal time division method, and the equal time monitoring sub-periods of the information security service monitoring time are numbered 1, 2, ...i, ...n in sequence.

[0063] See also Figure 2 As shown, the network information security event collection module is used to collect network activity data of each time monitoring sub-period during the information security service monitoring time of the target enterprise network. The network information security event collection module includes an information asset data collection unit and an information asset intrusion data collection unit. The network activity data includes information asset data and information asset intrusion data.

[0064] In a possible design, the network information security event collection module is specifically:

[0065] Information asset data collection unit: collects the target enterprise network’s information security service monitoring time, the number of network devices, the number of servers, and the frequency of network vulnerabilities in each time monitoring sub-period, marked as zb i 、zq i 、zd i , where i = 1, 2, ... n, i represents the number of the i-th equal-time monitoring sub-period;

[0066] Information asset intrusion data collection unit: collects the firewall data packet inflow and outflow volume, normal port access traffic, abnormal port interception traffic, internal network access frequency, and public network access frequency during the information security service monitoring time of the target enterprise network, marked as cs i ,ck i ,cl i 、cw i,cg i .

[0067] The network information asset risk management module calculates the information asset risk assessment index of each time monitoring sub-period of the information security service monitoring time of the target enterprise network according to the information asset data of the information asset data collection unit.

[0068] In a possible design, the calculation formula of the information asset risk assessment index is:

[0069]

[0070] Among them, α i It is expressed as the information asset risk assessment index of the i-th equal-time monitoring sub-period, zb i It is expressed as the number of network devices in the ith equal-time monitoring sub-period, zq i It is represented as the number of servers in the ith equal-time monitoring sub-period, zd i It is represented as the frequency of network vulnerabilities in the i-th equal-time monitoring sub-period.

[0071] The network information asset intrusion protection module calculates the information asset intrusion detection index of each equal time monitoring sub-period of the network information security service monitoring time of the target enterprise network according to the information asset intrusion data of the information asset intrusion data collection unit.

[0072] In a possible design, the network information asset intrusion protection module is specifically:

[0073] Step S01: Calculate the network security health index by monitoring the firewall data packet inflow and outflow, port normal access flow, and internal network access frequency during each time period of the target enterprise network information security service monitoring time:

[0074]

[0075] Among them, KH i It is represented as the network security health indicator of the ith equal-time monitoring sub-period, cs i It is represented by the firewall data packet inflow and outflow volume in the ith equal-time monitoring sub-period, π is represented by a natural constant, ck i It is represented by the normal access flow of the port in the ith equal-time monitoring sub-period, e is represented by a natural constant, cw max It is expressed as the maximum value of the internal network access frequency, cw min It is expressed as the maximum value of the internal network access frequency, cw i It is represented as the internal network access frequency of the i-th equal-time monitoring sub-period;

[0076] Step S02: Calculate the network attack prevention index by monitoring the firewall data packet inflow and outflow, abnormal port interception flow, and public network access frequency during each time period of the target enterprise network information security service monitoring time:

[0077]

[0078] Among them, GF i It is expressed as the network attack prevention index of the i-th equal-time monitoring sub-period, cl i It is represented by the abnormal interception traffic of the port in the ith equal-time monitoring sub-period, cg i represents the frequency of public network access in the i-th equal-time monitoring sub-period, n represents the total number of monitoring sub-periods, T represents the monitoring duration of the sub-period, and i-1 represents the number of the i-1th equal-time monitoring sub-period;

[0079] Step S03: The calculation formula of the information asset intrusion detection index is:

[0080]

[0081] Among them, β i is represented by the information asset intrusion detection index of the i-th equal-time monitoring sub-period, ΔGF is represented by the mean value of the network attack prevention index, KH 预 Represented as preset cybersecurity health indicators;

[0082] in,

[0083] The network information security incident response module obtains the historical information asset risk assessment index and the historical information asset intrusion detection index of each time monitoring sub-period of the information security service monitoring time of the target enterprise network, and calculates the network activity security incident response coefficient of the information security service monitoring time of the target enterprise network.

[0084] In a possible design, the network information security incident response module is specifically:

[0085] Step S01: The calculation formula of the network activity security incident response coefficient is:

[0086]

[0087] Among them, ω represents the network activity security incident response coefficient, T represents the monitoring duration of the sub-period, and α max Expressed as the maximum value of the information asset risk assessment index, β max Expressed as the maximum value of the information asset intrusion detection index, β minIt is represented as the minimum value of the information asset intrusion detection index, and σ is represented as the standard deviation of the information asset risk assessment index;

[0088] Step S02: Obtain the network activity security incident response coefficient of the target enterprise network during the information security service monitoring period, and compare it with the preset network activity security incident response coefficient. If the network activity security incident response coefficient of the target enterprise network during the information security service monitoring period is greater than the preset network activity security incident response coefficient, it indicates that there is a network security threat behavior in the information security service monitoring of the enterprise, and an alarm should be issued to the network management personnel of the enterprise to formulate a response plan, including but not limited to event isolation, vulnerability repair, and data backup. Otherwise, it indicates that the enterprise network information is secure during the information security service monitoring of the enterprise.

[0089] In this embodiment, it should be specifically explained that the calculation formula of the standard deviation of the information asset risk assessment index is:

[0090]

[0091] Where, σ represents the standard deviation of the information asset risk assessment index, Δα represents the mean of the information asset risk assessment index, n represents the total number of monitoring sub-periods, and α i It is expressed as the information asset risk assessment index of the i-th equal-time monitoring sub-period;

[0092] in,

[0093] The network security protection technology value analysis module is used to calculate the network security protection value assessment coefficient of each equal time monitoring sub-period of the information security service monitoring time of the target enterprise network based on the information asset risk assessment index and information asset intrusion detection index of each equal time monitoring sub-period of the information security service monitoring time of the target enterprise network.

[0094] In a possible design, the calculation formula of the network security protection value assessment coefficient is:

[0095]

[0096] Among them, θ i It is expressed as the network security protection value evaluation coefficient of the i-th equal-time monitoring sub-period, α min It is expressed as the minimum value of the information asset risk assessment index in the i-th equal-time monitoring sub-period.

[0097] The network security technology assessment module obtains the network security protection value assessment coefficient of each time monitoring sub-period of the information security service monitoring time of the target enterprise network, compares it with the preset network security protection value assessment coefficient, and processes it.

[0098] In a possible design, the network security technology assessment module is specifically:

[0099] Obtain the network security protection value assessment coefficient of each time monitoring sub-period of the target enterprise network's information security service monitoring time, and compare it with the preset network security protection value assessment coefficient. If the network security protection value assessment coefficient of a certain period of the target enterprise network's information security service monitoring time is less than the preset network security protection value assessment coefficient, it indicates that the network security protection value assessment of this period is low and the information security management technology configuration does not meet expectations. Otherwise, it indicates that the information security management technology configuration of this period meets expectations and the network security protection value assessment is high.

[0100] See also Figure 3 As shown, in this embodiment, it should be specifically explained that the present invention provides a network-based information security service method, comprising the following steps:

[0101] Step S01: Network information protection time division: used to divide the information security service monitoring time into equal time monitoring sub-periods according to the equal time division method, and number each equal time monitoring sub-period;

[0102] Step S02: Network information security event collection: used to collect network activity data of each time monitoring sub-period during the information security service monitoring time of the target enterprise network, and the network information security event collection includes an information asset data collection unit and an information asset intrusion data collection unit;

[0103] Step S03: Network information asset risk management: Calculate the information asset risk assessment index of each time monitoring sub-period of the target enterprise network's information security service monitoring time according to the information asset data of the information asset data collection unit;

[0104] Step S04: Network information asset intrusion protection: according to the information asset intrusion data of the information asset intrusion data collection unit, calculate the information asset intrusion detection index of each time monitoring sub-period of the network information security service monitoring time of the target enterprise network;

[0105] Step S05: Network information security incident response: used to calculate the network activity security incident response coefficient of the target enterprise network information security service monitoring time, and to issue an alarm for network security threat behavior;

[0106] Step S06: Network security protection technology value analysis: used to calculate the network security protection value assessment coefficient of each equal time monitoring sub-period of the target enterprise network's information security service monitoring time according to the information asset risk assessment index and information asset intrusion detection index of each equal time monitoring sub-period of the target enterprise network's information security service monitoring time;

[0107] Step S07: Network security technology assessment: obtain the network security protection value assessment coefficient of each time monitoring sub-period of the information security service monitoring time of the target enterprise network, compare it with the preset network security protection value assessment coefficient, and process it.

[0108] In the present embodiment, it should be specifically explained that the present invention collects network activity data of each equal-time monitoring sub-period during the information security service monitoring time of the target enterprise network, calculates the information asset risk assessment index of each equal-time monitoring sub-period during the information security service monitoring time of the target enterprise network according to the information asset data of the information asset data collection unit, calculates the information asset intrusion detection index of each equal-time monitoring sub-period during the network information security service monitoring time of the target enterprise network according to the information asset intrusion data collection unit, further analyzes and obtains the network activity security incident response coefficient of the information security service monitoring time of the target enterprise network, and compares it with the preset network activity security incident response coefficient. By comparison, if the network activity security incident response coefficient of the target enterprise network's information security service monitoring period is greater than the preset network activity security incident response coefficient, it indicates that there is a network security threat behavior in the enterprise's information security service monitoring, and an alarm should be issued to the enterprise's network management personnel to formulate a response plan, including but not limited to event isolation, vulnerability repair, and data backup. Otherwise, it indicates that the enterprise network information security is in the enterprise's information security service monitoring. By real-time monitoring of information asset data and intrusion data, the information security status of the enterprise network during the monitoring time can be evaluated, thereby formulating more effective security protection strategies, which is conducive to automatically judging the severity of network security incidents and improving the response efficiency of network security incidents.

[0109] The present invention utilizes a network security protection technology value analysis module to calculate the network security protection value assessment coefficient of each equal-time monitoring sub-period of the target enterprise network's information security service monitoring time through the information asset risk assessment index and the information asset intrusion detection index of each equal-time monitoring sub-period of the target enterprise network's information security service monitoring time, and compares it with the preset network security protection value assessment coefficient. If the network security protection value assessment coefficient of a certain period of the target enterprise network's information security service monitoring time is less than the preset network security protection value assessment coefficient, it indicates that the network security protection value assessment of the period is low, and the information security management technology configuration does not meet expectations. Otherwise, it indicates that the information security management technology configuration of the period meets expectations, and the network security protection value assessment is high. By establishing a scientific and standardized information security management evaluation system, the scientificity and standardization of information security management are improved. By dividing the equal-time monitoring sub-periods, the network security protection effects of different periods are dynamically evaluated, which helps enterprises to continuously optimize the information security management system and enhance network security protection capabilities.

[0110] Finally: The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A network-based information security service system, characterized in that: include: Network information protection time division module: used to divide the information security service monitoring time into equal time monitoring sub-periods according to the equal time division method, and number each equal time monitoring sub-period; Network information security event collection module: used to collect network activity data of each time monitoring sub-period during the information security service monitoring time of the target enterprise network, and the network information security event collection module includes an information asset data collection unit and an information asset intrusion data collection unit; Network information asset risk management module: Based on the information asset data of the information asset data collection unit, the information asset risk assessment index of each time monitoring sub-period of the information security service monitoring time of the target enterprise network is calculated; Network information asset intrusion protection module: based on the information asset intrusion data of the information asset intrusion data collection unit, calculate the information asset intrusion detection index of each time monitoring sub-period of the network information security service monitoring time of the target enterprise network; Network information security incident response module: used to calculate the network activity security incident response coefficient of the target enterprise network information security service monitoring time, and to issue an alarm for network security threat behavior; Network security protection technology value analysis module: used to calculate the network security protection value assessment coefficient of each equal time monitoring sub-period of the target enterprise network's information security service monitoring time according to the information asset risk assessment index and information asset intrusion detection index of each equal time monitoring sub-period of the target enterprise network's information security service monitoring time; Network security technology assessment module: obtains the network security protection value assessment coefficient of each time monitoring sub-period of the information security service monitoring time of the target enterprise network, compares it with the preset network security protection value assessment coefficient, and processes it.

2. A network-based information security service system according to claim 1, characterized in that: The network information protection time division module is specifically: The information security service monitoring time of the target enterprise network is obtained, the information security service monitoring time is divided into equal time monitoring sub-periods according to an equal time division method, and the equal time monitoring sub-periods of the information security service monitoring time are numbered 1, 2, ...i, ...n in sequence.

3. The network-based information security service system according to claim 1, characterized in that: The network information security event collection module is specifically: Information asset data collection unit: collects the target enterprise network’s information security service monitoring time, the number of network devices, the number of servers, and the frequency of network vulnerabilities in each time monitoring sub-period, marked as zb i 、zq i 、zd i , where i = 1, 2, ... n, i represents the number of the i-th equal-time monitoring sub-period; Information asset intrusion data collection unit: collects the firewall data packet inflow and outflow volume, normal port access traffic, abnormal port interception traffic, internal network access frequency, and public network access frequency during the information security service monitoring time of the target enterprise network, marked as cs i ,ck i ,cl i 、cw i ,cg i .

4. The network-based information security service system according to claim 1, characterized in that: The calculation formula of the information asset risk assessment index is: Among them, α i It is expressed as the information asset risk assessment index of the i-th equal-time monitoring sub-period, zb i It is expressed as the number of network devices in the ith equal-time monitoring sub-period, zq i It is represented as the number of servers in the ith equal-time monitoring sub-period, zd i It is represented as the frequency of network vulnerabilities in the i-th equal-time monitoring sub-period.

5. The network-based information security service system according to claim 1, characterized in that: The network information asset intrusion protection module is specifically: Step S01: Calculate the network security health index by monitoring the firewall data packet inflow and outflow, port normal access flow, and internal network access frequency during each time period of the target enterprise network information security service monitoring time: Among them, KH i It is represented as the network security health indicator of the ith equal-time monitoring sub-period, cs i It is represented by the firewall data packet inflow and outflow volume in the ith equal-time monitoring sub-period, π is represented by a natural constant, ck i It is represented by the normal access flow of the port in the ith equal-time monitoring sub-period, e is represented by a natural constant, cw max It is expressed as the maximum value of the internal network access frequency, cw min It is expressed as the maximum value of the internal network access frequency, cw i It is represented as the internal network access frequency of the i-th equal-time monitoring sub-period; Step S02: Calculate the network attack prevention index by monitoring the firewall data packet inflow and outflow, abnormal port interception flow, and public network access frequency during each time period of the target enterprise network information security service monitoring time: Among them, GF i It is expressed as the network attack prevention index of the i-th equal-time monitoring sub-period, cl i It is represented by the abnormal interception traffic of the port in the ith equal-time monitoring sub-period, cg i represents the frequency of public network access in the i-th equal-time monitoring sub-period, n represents the total number of monitoring sub-periods, T represents the monitoring duration of the sub-period, and i-1 represents the number of the i-1th equal-time monitoring sub-period; Step S03: The calculation formula of the information asset intrusion detection index is: Among them, β i is represented by the information asset intrusion detection index of the i-th equal-time monitoring sub-period, ΔGF is represented by the mean value of the network attack prevention index, KH 预 Represented as preset network security health indicators.

6. The network-based information security service system according to claim 1, characterized in that: The network information security incident response module is specifically: Step S01: The calculation formula of the network activity security incident response coefficient is: Among them, ω represents the network activity security incident response coefficient, T represents the monitoring duration of the sub-period, and α max Expressed as the maximum value of the information asset risk assessment index, β max Expressed as the maximum value of the information asset intrusion detection index, β min It is represented as the minimum value of the information asset intrusion detection index, and σ is represented as the standard deviation of the information asset risk assessment index; Step S02: Obtain the network activity security incident response coefficient of the target enterprise network during the information security service monitoring period, and compare it with the preset network activity security incident response coefficient. If the network activity security incident response coefficient of the target enterprise network during the information security service monitoring period is greater than the preset network activity security incident response coefficient, it indicates that there is a network security threat behavior in the information security service monitoring of the enterprise, and an alarm should be issued to the network management personnel of the enterprise to formulate a response plan. Otherwise, it indicates that the enterprise network information is insecure during the information security service monitoring of the enterprise.

7. The network-based information security service system according to claim 1, characterized in that: The calculation formula of the network security protection value assessment coefficient is: Among them, θ i It is expressed as the network security protection value evaluation coefficient of the i-th equal-time monitoring sub-period, α min It is expressed as the minimum value of the information asset risk assessment index in the i-th equal-time monitoring sub-period.

8. The network-based information security service system according to claim 1, characterized in that: The network security technology assessment module is specifically: Obtain the network security protection value assessment coefficient of each time monitoring sub-period of the target enterprise network's information security service monitoring time, and compare it with the preset network security protection value assessment coefficient. If the network security protection value assessment coefficient of a certain period of the target enterprise network's information security service monitoring time is less than the preset network security protection value assessment coefficient, it indicates that the network security protection value assessment of this period is low and the information security management technology configuration does not meet expectations. Otherwise, it indicates that the information security management technology configuration of this period meets expectations and the network security protection value assessment is high.

9. A network-based information security service method, using a network-based information security service system as claimed in any one of claims 1 to 8, characterized in that: The following steps are involved: Step S01: Network information protection time division: used to divide the information security service monitoring time into equal time monitoring sub-periods according to the equal time division method, and number each equal time monitoring sub-period; Step S02: Network information security event collection: used to collect network activity data of each time monitoring sub-period during the information security service monitoring time of the target enterprise network, and the network information security event collection includes an information asset data collection unit and an information asset intrusion data collection unit; Step S03: Network information asset risk management: Calculate the information asset risk assessment index of each time monitoring sub-period of the target enterprise network's information security service monitoring time according to the information asset data of the information asset data collection unit; Step S04: Network information asset intrusion protection: according to the information asset intrusion data of the information asset intrusion data collection unit, calculate the information asset intrusion detection index of each time monitoring sub-period of the network information security service monitoring time of the target enterprise network; Step S05: Network information security incident response: used to calculate the network activity security incident response coefficient of the target enterprise network information security service monitoring time, and to issue an alarm for network security threat behavior; Step S06: Network security protection technology value analysis: used to calculate the network security protection value assessment coefficient of each equal time monitoring sub-period of the target enterprise network's information security service monitoring time according to the information asset risk assessment index and information asset intrusion detection index of each equal time monitoring sub-period of the target enterprise network's information security service monitoring time; Step S07: Network security technology assessment: obtain the network security protection value assessment coefficient of each time monitoring sub-period of the information security service monitoring time of the target enterprise network, compare it with the preset network security protection value assessment coefficient, and process it.

Images