Network security data information acquisition system

Abstract

The invention discloses a network security data information acquisition system, which comprises a network information acquisition module, a hardware information acquisition module, an acquisition evaluation module, a comprehensive analysis module and an information sending module, the network information acquisition module is used for acquiring related information of network information acquisition; the hardware information acquisition module is used for acquiring related information of hardware equipment; the acquisition and evaluation module is used for analyzing related information of network information acquisition to obtain network acquisition and evaluation information; the acquisition and evaluation module is also used for analyzing the related information of the hardware equipment to obtain hardware acquisition and evaluation information; and the comprehensive analysis module is used for processing the network acquisition evaluation information and the hardware acquisition evaluation information to obtain comprehensive evaluation information. According to the invention, more accurate and more reliable network security data can be acquired.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to a network security data information collection system. Background Art

[0002] Network security data refers to data collected, analyzed, and processed through technical means and management measures in a network environment. These data are closely related to the security, stability of the network system and the confidentiality, integrity, and availability of data. It includes but is not limited to network traffic data, log data, intrusion detection data, vulnerability scanning data, security audit data, etc.

[0003] In the process of collecting network security data information, a collection system is needed.

[0004] The existing collection system does not collect network security data with high accuracy, and the system itself does not perform monitoring, which may lead to many problems that affect the collection accuracy and data reliability, and has a certain impact on the use of the security protection system. Therefore, a network security data information collection system is proposed. Summary of the invention

[0005] The technical problem to be solved by the present invention is: how to solve the problem that the accuracy of the network security data information collected by the existing collection system is not high enough, and the system itself does not perform monitoring, which may lead to many problems affecting the collection accuracy and data reliability, and brings certain impacts on the use of the security protection system. A network security data information collection system is provided.

[0006] The present invention solves the above technical problems through the following technical solutions. The present invention includes a network information acquisition module, a hardware information acquisition module, an acquisition evaluation module, a comprehensive analysis module and an information sending module;

[0007] The network information collection module is used to obtain relevant information of network information collection;

[0008] The hardware information collection module is used to obtain relevant information of hardware devices;

[0009] The collection and evaluation module is used to analyze the relevant information of network information collection and obtain network collection and evaluation information;

[0010] The acquisition and evaluation module is also used to analyze the relevant information of the hardware equipment and obtain the hardware acquisition and evaluation information;

[0011] The comprehensive analysis module is used to process the network collection evaluation information and the hardware collection evaluation information to obtain comprehensive evaluation information;

[0012] The information sending module is used to send the hardware collection evaluation information, network collection evaluation information and comprehensive evaluation information to a preset receiving terminal after the above information is generated.

[0013] Furthermore, the specific process of the network information collection module obtaining the relevant information of the network information collection is as follows: extracting the number of collection tools used in the current network security data information collection, and obtaining the collection tool information, which is the relevant information of the network information collection.

[0014] Furthermore, the process of acquiring the network collection evaluation information is as follows: extracting the acquired network collection related information;

[0015] The number of collection tools is extracted from the relevant information collected from the network, the collection tools are tested according to the number of collection tools, the collection tool test information is obtained, the collection tool test information is processed, and the network collection evaluation information is obtained.

[0016] Furthermore, the specific process of performing a collection tool test according to the number of collection tools and obtaining the collection tool test information is as follows: extracting the number of collection tools, and when the number of collection tools is less than or equal to a preset value, performing a first test, and obtaining the collection tool test information through the first test;

[0017] When the number of collection tools is greater than the preset value, the second test is performed, and the collection tool test information is obtained through the second test:

[0018] The specific process of the first test is as follows: when the number of collection tools is less than or equal to the preset value, set a simulated data set, perform at least x simulated data collections, obtain x real-time collection results, compare the x real-time collection results with the simulated data set, obtain x similarities, and obtain collection tool test information;

[0019] The specific process of the second test is as follows: when the number of collection tools is greater than the preset value, a simulated data set is set, and simulated data collection is performed to obtain i data collection results, where i is the number of collection tools. The i data collection results are then converted into i real-time data in standard data formats. The i real-time data in standard data formats are then compared with the simulated data set to obtain i similarities, i.e., the collection tool test information is obtained.

[0020] Furthermore, when the number of collection tools is less than or equal to a preset value, the specific process of processing the collection tool test information to obtain the network collection evaluation information is as follows: x similarities are extracted from the collection tool test information. When the x similarities are all greater than the preset value, a first-level network collection evaluation is generated. When the number of the x similarities greater than the preset value exceeds When , the secondary network collection evaluation is generated. When the number of x similarities greater than the preset value does not exceed When , a three-level network collection evaluation is generated;

[0021] When the number of collection tools is greater than the preset value, the specific process of processing the collection tool test information to obtain the network collection evaluation information is as follows: i similarities are extracted from the collection tool test information. When i similarities are all greater than the preset value, a first-level network collection evaluation is generated. When the number of i similarities is greater than the preset value exceeds When , the secondary network collection evaluation is generated. When the number of i similarities greater than the preset value does not exceed When the three-level network collection evaluation is generated.

[0022] Furthermore, the specific process of obtaining the hardware collection evaluation information is as follows:

[0023] Extracting the collected hardware device related information, the hardware device related information is the related device information used for network security data collection, including switch device information and cable access device information;

[0024] Process the switch device information to obtain the switch device score;

[0025] Process the cable access device information to obtain the cable access score;

[0026] The switch equipment score and the cable access score are processed to obtain hardware collection evaluation information.

[0027] Furthermore, the switch device score is obtained as follows: extracting switch device information, the switch device information including port utilization, error rate and packet loss rate;

[0028] The port utilization is scored, and the scoring process is as follows: 0% < When the port utilization is ≤ 20%, its score is in the m1 range;

[0029] 20%<When the port utilization is ≤50%, its score is in the m2 range;

[0030] 50%<When the port utilization is ≤80%, its score is in the m3 range;

[0031] When port utilization exceeds 80%, its score is in the m4 range;

[0032] m1>m2>m3>m4;

[0033] The error rate is scored, and the scoring process is as follows: when the error rate is between 0% and 0.01%, its score is in the q1 range;

[0034] When the error rate is 0.01% ≤ ≤ 0.1%, its score is in the q2 range;

[0035] When the error rate is 0.1% ≤ 1%, the score is in the q3 range;

[0036] When the error rate is above 1%, its score is in the q4 range;

[0037] q1>q2>q3>q4;

[0038] The packet loss rate is scored, and the scoring process is as follows: when the packet loss rate is 0, its score is s;

[0039] When 0%<packet loss rate≤0.01%, its score is in the f1 range;

[0040] When the packet loss rate is 0.01%<≤0.1%, the score is in the f2 range;

[0041] When the packet loss rate is greater than 0.1%, its score is in the f3 range;

[0042] s>f1>f2>f3;

[0043] The port utilization score, error rate score and packet loss rate score are marked as T1, T2 and T3;

[0044] The port utilization score T1 is assigned a weight of Y1, the error rate score T2 is assigned a weight of Y2, and the packet loss rate score T3 is assigned a weight of Y3, Y3>Y1>Y2, Y3+Y1+Y2=1;

[0045] The switch device score is obtained through the formula T1*Y1+T2*Y2+T3*Y3=Tt.

[0046] Furthermore, the process of processing the cable access device information to obtain the cable access score is as follows:

[0047] Extract the cable access device information, which includes cable length information, cable label information, cable connection tightness and cable appearance status;

[0048] The cable length information is scored. When the cable length is greater than a preset value w1, the cable length score is a preset value z1;

[0049] When the cable length is between the preset values ​​w1 and w2, the cable length score is the preset value z2;

[0050] When the cable length is less than the preset value w2, the cable length score is the preset value z3;

[0051] w1>w2,z1<z2<z3;

[0052] Score the cable label information. If there is a preset label, the cable label score is a preset value r1. If there is no preset label, the cable label score is a preset value r2, where r1>r2;

[0053] The cable connection tightness is scored. When the cable connection tightness is greater than a preset value d1, the cable connection score is a preset value h1;

[0054] When the cable connection tightness is between the preset values ​​d1 and d2, the cable connection score is the preset value h2;

[0055] When the cable connection tightness is less than the preset value d2, the cable connection score is the preset value h3;

[0056] d1>d2,h3<h2

[0057] Score the appearance of the cable. The appearance of the cable refers to whether there are cracks on the outside of the cable. When there are cracks, the cable appearance score is a preset value v1. When there are no cracks, the cable appearance score is a preset value v2, where v1>v2.

[0058] The cable length score, cable label score, cable connection score and cable appearance score are marked as K1, K2, K3 and K4;

[0059] Assign a weight of P1 to the cable length score K1, a weight of P2 to the cable label score K2, a weight of P3 to the cable connection score K3, and a weight of P4 to the cable appearance score K4;

[0060] P1+P2+P3+P4=1,P4>P3>P2>P1;

[0061] The cable access score Kk is obtained through the formula K1*P1+K2*P2+K3*P3+K4*P4=Kk;

[0062] The process of obtaining the cable label information and the cable appearance status is as follows: the image information of the access cable is collected by an image acquisition device, the label model to be marked on the cable is imported into the image information, and the label model is recognized from the image information. When an object with a similarity with the label model greater than a preset value is identified on the cable, it indicates that there is a label on the cable;

[0063] The crack model is then imported into the image information, and the crack model is identified from the image information. When a real-time model with a crack similarity greater than a preset value is obtained, it means that the crack is identified.

[0064] Furthermore, the hardware collection evaluation information includes the first-level hardware evaluation, the second-level hardware evaluation and the third-level hardware evaluation. The process of processing the switch equipment score and the cable access score to obtain the hardware collection evaluation information is as follows:​

[0065] When the switch device score and the cable access score are both greater than the preset value, a first-level hardware evaluation is generated;

[0066] When either the switch device score or the cable access score is less than the preset value, a secondary hardware evaluation is generated;

[0067] When the switch equipment score and cable access score are both less than the preset value, a third-level hardware evaluation is generated.

[0068] Furthermore, the specific process of the comprehensive evaluation information is as follows: extracting the collected hardware collection evaluation information and network collection evaluation information;

[0069] When both the hardware collection evaluation information and the network collection evaluation information are at level one, the comprehensive evaluation information is level one comprehensive evaluation;

[0070] When either the hardware collection evaluation information or the network collection evaluation information is level 2, the comprehensive evaluation information is level 2 comprehensive evaluation;

[0071] When any two of the hardware collection evaluation information and the network collection evaluation information are level 2 or any one of them is level 3, the comprehensive evaluation information is level 3 comprehensive evaluation;

[0072] When any two of the hardware collection evaluation information and the network collection evaluation information are at level three, the comprehensive evaluation information is a level four comprehensive evaluation.

[0073] Compared with the prior art, the present invention has the following advantages: the network security data information collection system realizes a more efficient and more accurate security data collection process by comprehensively analyzing the relevant tools and relevant hardware equipment for network security data collection. It combines the flexibility of the software system and the stability of the hardware equipment to realize the comprehensive, accurate and secure collection of network data, and a more comprehensive network security data information collection evaluation, so that users can intuitively understand the reliability of the relevant network security data collected by the system, and can promptly discover problems in the software or hardware and eliminate them in time, thereby ensuring the stability of network security data collection, making the system more worthy of promotion and use. BRIEF DESCRIPTION OF THE DRAWINGS

[0074] Figure 1 It is the overall structural diagram of the present invention. DETAILED DESCRIPTION

[0075] The following is a detailed description of an embodiment of the present invention. This embodiment is implemented on the premise of the technical solution of the present invention, and a detailed implementation method and a specific operation process are given, but the protection scope of the present invention is not limited to the following embodiment.

[0076] like Figure 1 As shown, this embodiment provides a technical solution: a network security data information collection system, including a network information collection module, a hardware information collection module, a collection evaluation module, a comprehensive analysis module and an information sending module;

[0077] The network information collection module is used to obtain relevant information of network information collection;

[0078] The hardware information collection module is used to obtain relevant information of hardware devices;

[0079] The collection and evaluation module is used to analyze the relevant information of network information collection and obtain network collection and evaluation information;

[0080] The acquisition and evaluation module is also used to analyze the relevant information of the hardware equipment and obtain the hardware acquisition and evaluation information;

[0081] The comprehensive analysis module is used to process the network collection evaluation information and the hardware collection evaluation information to obtain comprehensive evaluation information;

[0082] The information sending module is used to send the hardware collection evaluation information, network collection evaluation information and comprehensive evaluation information to a preset receiving terminal after the above information is generated.

[0083] The specific process of the network information collection module obtaining the relevant information of network information collection is as follows: extracting the number of collection tools used in the current network security data information collection, and obtaining the collection tool information, which is the relevant information of network information collection.

[0084] The process of obtaining the network collection evaluation information is as follows: extracting the obtained network collection related information;

[0085] Extract the number of collection tools from the relevant information collected on the network, test the collection tools according to the number of collection tools, obtain collection tool test information, process the collection tool test information, and obtain network collection evaluation information;

[0086] The above process achieves optimized resource allocation. Understanding the number of collection tools can help organizations or teams allocate resources more reasonably. Based on the number and performance of the tools, it can be decided whether new collection tools need to be added or the use of existing tools needs to be optimized to improve collection efficiency.

[0087] Improved data quality By testing the collection tools, you can evaluate their stability and accuracy. This helps ensure that the data collected from the network is of high quality and low error rate, providing a more reliable basis for subsequent data analysis and decision-making;

[0088] Enhanced security: During network collection, the security of collection tools is extremely important. Testing can identify potential security vulnerabilities or malware, so that timely measures can be taken to repair or replace them, ensuring the security of the data collection process.

[0089] Reduced costs: By testing and evaluating the efficiency and performance of acquisition tools, inefficient or unnecessary tools can be identified, thereby reducing investment in these tools;

[0090] Improved collection efficiency. Understanding the performance and quantity of collection tools can optimize collection strategies, such as parallel processing and load balancing, to maximize the speed and efficiency of data collection.

[0091] In addition, the network environment and technology are constantly changing. By continuously testing and evaluating collection tools, we can keep abreast of the emergence of new technologies and tools, and update or replace existing tools as needed to adapt to changes in the network environment.

[0092] The specific process of performing a collection tool test according to the number of collection tools and obtaining collection tool test information is as follows: extracting the number of collection tools, and when the number of collection tools is less than or equal to a preset value, performing a first test, and obtaining collection tool test information through the first test;

[0093] When the number of collection tools is greater than the preset value, the second test is performed, and the collection tool test information is obtained through the second test:

[0094] The specific process of the first test is as follows: when the number of collection tools is less than or equal to the preset value, set a simulated data set, perform at least x simulated data collections, obtain x real-time collection results, compare the x real-time collection results with the simulated data set, obtain x similarities, that is, obtain collection tool test information, x ≥ 10;

[0095] The specific process of the second test is as follows: when the number of collection tools is greater than the preset value, a simulated data set is set, and simulated data collection is performed to obtain i data collection results, where i is the number of collection tools. The i data collection results are then converted into i real-time data in standard data formats. The i real-time data in standard data formats are then compared with the simulated data set to obtain i similarities, i.e., the collection tool test information is obtained.

[0096] When the number of collection tools is less than or equal to the preset value, the specific process of processing the collection tool test information to obtain the network collection evaluation information is as follows: extract x similarities from the collection tool test information. When all x similarities are greater than the preset value, a first-level network collection evaluation is generated. When the number of x similarities greater than the preset value exceeds When , the secondary network collection evaluation is generated. When the number of x similarities greater than the preset value does not exceed When , a three-level network collection evaluation is generated;

[0097] When the number of collection tools is greater than the preset value, the specific process of processing the collection tool test information to obtain the network collection evaluation information is as follows: i similarities are extracted from the collection tool test information. When i similarities are all greater than the preset value, a first-level network collection evaluation is generated. When the number of i similarities is greater than the preset value exceeds When , the secondary network collection evaluation is generated. When the number of i similarities greater than the preset value does not exceed When , a three-level network collection evaluation is generated;

[0098] The above process automatically adjusts the evaluation strategy according to the number of collection tools. When the number of tools is small, it may focus more on the performance of each tool; when the number of tools is large, a certain proportion of tools can be allowed to perform poorly, because the overall collection efficiency and quality can still be maintained at a high level. This flexibility makes the evaluation process more adaptable to environments of different scales and data collection needs. By comprehensively evaluating multiple similarities rather than relying solely on the test results of a single indicator or tool, the accuracy of the evaluation can be improved. When most similarities meet the preset conditions, the generated network collection evaluation information is more likely to truly reflect the performance of the collection tools and the overall collection effect. Through a flexible, objective, accurate and adaptive evaluation strategy, the efficiency and accuracy of network collection evaluation are improved.

[0099] The specific process of obtaining the hardware collection evaluation information is as follows:

[0100] Extracting the collected hardware device related information, the hardware device related information is the related device information used for network security data collection, including switch device information and cable access device information;

[0101] Process the switch device information to obtain the switch device score;

[0102] Process the cable access device information to obtain the cable access score;

[0103] Process the switch equipment score and cable access score to obtain hardware collection evaluation information;

[0104] The above process, i.e. extracting switch device information and cable access device information from the collected hardware-related information, and processing this information separately to obtain the switch device score and cable access score, covers the evaluation of two key components in the network security data collection system, namely switch devices and cable access collection devices. By comprehensively considering these two aspects of information, the overall performance and stability of the hardware system can be more comprehensively reflected, and the switch devices and cable access collection devices can be scored separately, making the evaluation results more targeted. This segmented evaluation method helps to quickly locate the problem, such as whether it is a problem with the switch device or a problem with the cable access, so as to take more accurate solutions.

[0105] The preset scoring criteria and processing procedures make the scoring process more objective and fair, reduce the impact of human factors on the evaluation results, and improve the reliability and credibility of the evaluation results.

[0106] Combining the switch device score and the cable access score can quickly generate hardware collection evaluation information. This efficient processing method helps to quickly understand the overall status of the hardware system and provide strong support for subsequent decision-making and optimization.

[0107] The process of obtaining the switch device score is as follows: extracting switch device information, the switch device information including port utilization, error rate and packet loss rate;

[0108] The port utilization is scored, and the scoring process is as follows: 0% < When the port utilization is ≤ 20%, its score is in the m1 range;

[0109] 20%<When the port utilization is ≤50%, its score is in the m2 range;

[0110] 50%<When the port utilization is ≤80%, its score is in the m3 range;

[0111] When port utilization exceeds 80%, its score is in the m4 range;

[0112] m1>m2>m3>m4;

[0113] The error rate is scored, and the scoring process is as follows: when the error rate is between 0% and 0.01%, its score is in the q1 range;

[0114] When the error rate is 0.01% ≤ ≤ 0.1%, its score is in the q2 range;

[0115] When the error rate is 0.1% ≤ 1%, the score is in the q3 range;

[0116] When the error rate is above 1%, its score is in the q4 range;

[0117] q1>q2>q3>q4;

[0118] The packet loss rate is scored, and the scoring process is as follows: when the packet loss rate is 0, its score is s;

[0119] When 0%<packet loss rate≤0.01%, its score is in the f1 range;

[0120] When the packet loss rate is 0.01%<≤0.1%, the score is in the f2 range;

[0121] When the packet loss rate is greater than 0.1%, its score is in the f3 range;

[0122] s>f1>f2>f3;

[0123] The port utilization score, error rate score and packet loss rate score are marked as T1, T2 and T3;

[0124] The port utilization score T1 is assigned a weight of Y1, the error rate score T2 is assigned a weight of Y2, and the packet loss rate score T3 is assigned a weight of Y3, Y3>Y1>Y2, Y3+Y1+Y2=1;

[0125] The switch device score is obtained through the formula T1*Y1+T2*Y2+T3*Y3=Tt.

[0126] The process of processing the cable access device information to obtain the cable access score is as follows:

[0127] Extract the cable access device information, which includes cable length information, cable label information, cable connection tightness and cable appearance status;

[0128] The cable length information is scored. When the cable length is greater than a preset value w1, the cable length score is a preset value z1;

[0129] When the cable length is between the preset values ​​w1 and w2, the cable length score is the preset value z2;

[0130] When the cable length is less than the preset value w2, the cable length score is the preset value z3;

[0131] w1>w2,z1<z2<z3;

[0132] Score the cable label information. If there is a preset label, the cable label score is a preset value r1. If there is no preset label, the cable label score is a preset value r2, where r1>r2;

[0133] The cable connection tightness is scored. When the cable connection tightness is greater than a preset value d1, the cable connection score is a preset value h1;

[0134] When the cable connection tightness is between the preset values ​​d1 and d2, the cable connection score is the preset value h2;

[0135] When the cable connection tightness is less than the preset value d2, the cable connection score is the preset value h3;

[0136] d1>d2,h3<h2

[0137] Score the appearance of the cable. The appearance of the cable refers to whether there are cracks on the outside of the cable. When there are cracks, the cable appearance score is a preset value v1. When there are no cracks, the cable appearance score is a preset value v2, where v1>v2.

[0138] The cable length score, cable label score, cable connection score and cable appearance score are marked as K1, K2, K3 and K4;

[0139] Assign a weight of P1 to the cable length score K1, a weight of P2 to the cable label score K2, a weight of P3 to the cable connection score K3, and a weight of P4 to the cable appearance score K4;

[0140] P1+P2+P3+P4=1,P4>P3>P2>P1;

[0141] The cable access score Kk is obtained through the formula K1*P1+K2*P2+K3*P3+K4*P4=Kk;

[0142] The process of obtaining the cable label information and the cable appearance status is as follows: the image information of the access cable is collected by an image acquisition device, the label model to be marked on the cable is imported into the image information, and the label model is recognized from the image information. When an object with a similarity with the label model greater than a preset value is identified on the cable, it indicates that there is a label on the cable;

[0143] Then, the crack model is imported into the image information, and the crack model is identified from the image information. When a real-time model with a crack similarity greater than a preset value is obtained, it means that the crack is identified;

[0144] The above score reflects the overall performance and stability of the cable access collection equipment. Based on this score, you can prioritize cable access or decide whether to replace or repair the cable, thereby ensuring the stability of network security data collection.

[0145] The hardware collection and evaluation information includes the first-level hardware evaluation, the second-level hardware evaluation, and the third-level hardware evaluation. The process of processing the switch device score and the cable access score to obtain the hardware collection and evaluation information is as follows:

[0146] When the switch device score and the cable access score are both greater than the preset value, a first-level hardware evaluation is generated;​

[0147] When either the switch device score or the cable access score is less than the preset value, a secondary hardware evaluation is generated;

[0148] When the switch device score and the cable access score are both less than the preset value, a third-level hardware evaluation is generated;

[0149] The lower the level assessment, the better the hardware status;

[0150] Through this process, the performance and status of the hardware devices used in the network security data collection process can be comprehensively and systematically evaluated, providing strong support for network security management and maintenance;

[0151] The specific process of the comprehensive evaluation information is as follows: extracting the collected hardware collection evaluation information and network collection evaluation information;

[0152] When both the hardware collection evaluation information and the network collection evaluation information are at level one, the comprehensive evaluation information is level one comprehensive evaluation;

[0153] When either the hardware collection evaluation information or the network collection evaluation information is level 2, the comprehensive evaluation information is level 2 comprehensive evaluation;

[0154] When any two of the hardware collection evaluation information and the network collection evaluation information are level 2 or any one of them is level 3, the comprehensive evaluation information is level 3 comprehensive evaluation;

[0155] When any two of the hardware collection evaluation information and the network collection evaluation information are level three, the comprehensive evaluation information is level four comprehensive evaluation;

[0156] The higher the level, the worse the comprehensive evaluation status is, and vice versa;

[0157] Through continuous monitoring and evaluation of hardware collection and evaluation information and network collection and evaluation information, problems and deficiencies in the system can be discovered in a timely manner. This continuous improvement mechanism helps to promote continuous improvement and optimization of the system and improve the overall efficiency and reliability of the system.

[0158] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In the description of the present invention, the meaning of "plurality" is at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

[0159] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.

[0160] Although the embodiments of the present invention have been shown and described above, it is to be understood that the above embodiments are exemplary and are not to be construed as limitations of the present invention. A person skilled in the art may change, modify, replace and vary the above embodiments within the scope of the present invention.

Claims

1. A network security data information collection system, characterized in that: It includes network information collection module, hardware information collection module, collection evaluation module, comprehensive analysis module and information sending module; The network information collection module is used to obtain relevant information of network information collection; The hardware information collection module is used to obtain relevant information of hardware devices; The collection and evaluation module is used to analyze the relevant information of network information collection and obtain network collection and evaluation information; The acquisition and evaluation module is also used to analyze the relevant information of the hardware equipment and obtain the hardware acquisition and evaluation information; The comprehensive analysis module is used to process the network collection evaluation information and the hardware collection evaluation information to obtain comprehensive evaluation information; The information sending module is used to send the hardware collection evaluation information, network collection evaluation information and comprehensive evaluation information to a preset receiving terminal after the above information is generated.

2. A network security data information collection system according to claim 1, characterized in that: The specific process of the network information collection module obtaining the relevant information of network information collection is as follows: extracting the number of collection tools used in the current network security data information collection, and obtaining the collection tool information, which is the relevant information of network information collection.

3. A network security data information collection system according to claim 2, characterized in that: The process of obtaining the network collection evaluation information is as follows: extracting the obtained network collection related information; The number of collection tools is extracted from the relevant information collected from the network, the collection tools are tested according to the number of collection tools, the collection tool test information is obtained, the collection tool test information is processed, and the network collection evaluation information is obtained.

4. A network security data information collection system according to claim 3, characterized in that: The specific process of performing a collection tool test according to the number of collection tools and obtaining collection tool test information is as follows: extracting the number of collection tools, and when the number of collection tools is less than or equal to a preset value, performing a first test, and obtaining collection tool test information through the first test; When the number of collection tools is greater than the preset value, the second test is performed, and the collection tool test information is obtained through the second test: The specific process of the first test is as follows: when the number of collection tools is less than or equal to the preset value, set a simulated data set, perform at least x simulated data collections, obtain x real-time collection results, compare the x real-time collection results with the simulated data set, obtain x similarities, and obtain collection tool test information; The specific process of the second test is as follows: when the number of collection tools is greater than the preset value, a simulated data set is set, and simulated data collection is performed to obtain i data collection results, where i is the number of collection tools. The i data collection results are then converted into i real-time data in standard data formats. The i real-time data in standard data formats are then compared with the simulated data set to obtain i similarities, i.e., the collection tool test information is obtained.

5. A network security data information collection system according to claim 4, characterized in that: The network collection and evaluation information includes the first-level network collection and evaluation, the second-level network collection and evaluation, and the third-level network collection and evaluation; When the number of collection tools is less than or equal to the preset value, the specific process of processing the collection tool test information to obtain the network collection evaluation information is as follows: extract x similarities from the collection tool test information. When all x similarities are greater than the preset value, a first-level network collection evaluation is generated. When the number of x similarities greater than the preset value exceeds When , the secondary network collection evaluation is generated. When the number of x similarities greater than the preset value does not exceed When , a three-level network collection evaluation is generated; When the number of collection tools is greater than the preset value, the specific process of processing the collection tool test information to obtain the network collection evaluation information is as follows: i similarities are extracted from the collection tool test information. When i similarities are all greater than the preset value, a first-level network collection evaluation is generated. When the number of i similarities is greater than the preset value exceeds When , the secondary network collection evaluation is generated. When the number of i similarities greater than the preset value does not exceed When the three-level network collection evaluation is generated.

6. A network security data information collection system according to claim 1, characterized in that: The specific process of obtaining the hardware collection evaluation information is as follows: Extracting the collected hardware device related information, the hardware device related information is the related device information used for network security data collection, including switch device information and cable access device information; Process the switch device information to obtain the switch device score; Process the cable access device information to obtain the cable access score; The switch equipment score and the cable access score are processed to obtain hardware collection evaluation information.

7. A network security data information collection system according to claim 6, characterized in that: The process of obtaining the switch device score is as follows: extracting switch device information, the switch device information including port utilization, error rate and packet loss rate; The port utilization is scored, and the scoring process is as follows: 0% < When the port utilization is ≤ 20%, its score is in the m1 range; 20%<When the port utilization is ≤50%, its score is in the m2 range; 50%<When the port utilization is ≤80%, its score is in the m3 range; When port utilization exceeds 80%, its score is in the m4 range; m1>m2>m3>m4; The error rate is scored, and the scoring process is as follows: when the error rate is between 0% and 0.01%, its score is in the q1 range; When the error rate is 0.01% ≤ ≤ 0.1%, its score is in the q2 range; When the error rate is 0.1% ≤ 1%, the score is in the q3 range; When the error rate is above 1%, its score is in the q4 range; q1>q2>q3>q4; The packet loss rate is scored, and the scoring process is as follows: when the packet loss rate is 0, its score is s; When 0%<packet loss rate≤0.01%, its score is in the f1 range; When the packet loss rate is 0.01%<≤0.1%, the score is in the f2 range; When the packet loss rate is greater than 0.1%, its score is in the f3 range; s>f1>f2>f3; The port utilization score, error rate score and packet loss rate score are marked as T1, T2 and T3; The port utilization score T1 is assigned a weight of Y1, the error rate score T2 is assigned a weight of Y2, and the packet loss rate score T3 is assigned a weight of Y3, Y3>Y1>Y2, Y3+Y1+Y2=1; The switch device score is obtained through the formula T1*Y1+T2*Y2+T3*Y3=Tt.

8. A network security data information collection system according to claim 6, characterized in that: The process of processing the cable access device information to obtain the cable access score is as follows: Extract the cable access device information, which includes cable length information, cable label information, cable connection tightness and cable appearance status; The cable length information is scored. When the cable length is greater than a preset value w1, the cable length score is a preset value z1; When the cable length is between the preset values ​​w1 and w2, the cable length score is the preset value z2; When the cable length is less than the preset value w2, the cable length score is the preset value z3; w1>w2,z1<z2<z3; Score the cable label information. If there is a preset label, the cable label score is a preset value r1. If there is no preset label, the cable label score is a preset value r2, where r1>r2; The cable connection tightness is scored. When the cable connection tightness is greater than a preset value d1, the cable connection score is a preset value h1; When the cable connection tightness is between the preset values ​​d1 and d2, the cable connection score is the preset value h2; When the cable connection tightness is less than the preset value d2, the cable connection score is the preset value h3; d1>d2,h3<h2<h1; Score the appearance of the cable. The appearance of the cable refers to whether there are cracks on the outside of the cable. When there are cracks, the cable appearance score is a preset value v1. When there are no cracks, the cable appearance score is a preset value v2, where v1>v2. The cable length score, cable label score, cable connection score and cable appearance score are marked as K1, K2, K3 and K4; Assign a weight of P1 to the cable length score K1, a weight of P2 to the cable label score K2, a weight of P3 to the cable connection score K3, and a weight of P4 to the cable appearance score K4; P1+P2+P3+P4=1, P4>P3>P2>P1; The cable access score Kk is obtained through the formula K1*P1+K2*P2+K3*P3+K4*P4=Kk; The process of obtaining the cable label information and the cable appearance status is as follows: the image information of the access cable is collected by an image acquisition device, the label model to be marked on the cable is imported into the image information, and the label model is recognized from the image information. When an object with a similarity with the label model greater than a preset value is identified on the cable, it indicates that there is a label on the cable; The crack model is then imported into the image information, and the crack model is identified from the image information. When a real-time model with a crack similarity greater than a preset value is obtained, it means that the crack is identified.

9. A network security data information collection system according to claim 6, characterized in that: The hardware collection and evaluation information includes the first-level hardware evaluation, the second-level hardware evaluation, and the third-level hardware evaluation. The process of processing the switch device score and the cable access score to obtain the hardware collection and evaluation information is as follows: When the switch device score and the cable access score are both greater than the preset value, a first-level hardware evaluation is generated; When either the switch device score or the cable access score is less than the preset value, a secondary hardware evaluation is generated; When the switch device score and the cable access score are both less than the preset value, a third-level hardware evaluation is generated.

10. A network security data information collection system according to claim 1, characterized in that: The specific process of the comprehensive evaluation information is as follows: extracting the collected hardware collection evaluation information and network collection evaluation information; When both the hardware collection evaluation information and the network collection evaluation information are at level one, the comprehensive evaluation information is level one comprehensive evaluation; When either the hardware collection evaluation information or the network collection evaluation information is level 2, the comprehensive evaluation information is level 2 comprehensive evaluation; When any two of the hardware collection evaluation information and the network collection evaluation information are level 2 or any one of them is level 3, the comprehensive evaluation information is level 3 comprehensive evaluation; When any two of the hardware collection evaluation information and the network collection evaluation information are at level three, the comprehensive evaluation information is a level four comprehensive evaluation.

Images