Computer network health safety assessment method and system

Abstract

The invention discloses a computer network health security assessment method and system, and belongs to the field of network security. Network use condition data obtained in the computer use process is imported into a network use anomaly analysis model for network use anomaly analysis; and importing the acquired browsing process data and browsing permission data into a browsing anomaly analysis model for browsing anomaly analysis, and importing the acquired network use anomaly analysis result and browsing anomaly analysis result into a network health and safety assessment model for network health and safety assessment. And performing network security early warning according to the obtained network health security evaluation result, comprehensively analyzing the historical login browsing information and the network use distribution information of the login person to obtain the historical login rule implicit characteristics of the login person, and comparing and analyzing the historical login rule implicit characteristics with the data in the login process to obtain the network security information of the login person. And whether the login is abnormal login or not is accurately judged.

Description

Technical Field

[0001] The present application relates to the field of network security, and more specifically to a computer network health and security assessment method and system. Background Art

[0002] When using a management system, different management permissions are usually assigned to ensure the security of the management system and to suit different groups of people. After logging in, people with different management permissions can usually only view and browse the content within their permission range. However, it often happens that the passwords and accounts of the login personnel are accidentally leaked, resulting in abnormal personnel logging into the management system to steal information;

[0003] When performing login security assessment, the existing technology cannot comprehensively analyze the login user's historical login browsing information and network usage distribution information, which leads to the inability to compare and analyze the implicit characteristics of historical login rules with the data in the current login process, thereby making it impossible to accurately determine whether the current login is an abnormal login. Most of the existing technologies have the above problems;

[0004] For example, a Chinese patent with application publication number CN115065512A discloses an account login method, system, device, electronic device and storage medium, which relates to the field of computer technology. The method receives a login request and determines the target account and account information based on the login request. The account information may include an account identifier and device information. Then, based on the account identifier and device information, the risk level corresponding to the login behavior of the target account can be comprehensively evaluated, and the login response operation corresponding to the target account can be determined based on the evaluated risk level. Thus, when the same target account on the same client initiates a login request at different times, a level evaluation will be performed first, and the corresponding login result can be dynamically changed in the time dimension. Even if the login credential information of the target account is obtained by other users, it is difficult for other users to log in through the target account, thereby improving the user's account security;

[0005] The above patents have the problems raised by this background technology;

[0006] In order to solve the problems raised by this background technology, the present application designs a computer network health and safety assessment method and system. Summary of the invention

[0007] In response to the deficiencies in the prior art, the present application proposes a computer network health and safety assessment method and system. The present application conducts a comprehensive analysis of the historical login browsing information and network usage allocation information of the registrant to obtain the implicit features of the registrant's historical login rules, and compares and analyzes the implicit features of the historical login rules with the data in the current login process to accurately determine whether the current login is an abnormal login, thereby improving the accuracy and security of detecting abnormal login processes.

[0008] To achieve the above objectives, the present application provides the following technical solutions: In the first aspect, the present application provides a computer network health and safety assessment method, which includes the following specific steps:

[0009] S1. Obtaining network usage data, browsing process data, and browsing permission data during computer use;

[0010] S2, importing the acquired network usage data during the use of the computer into a network usage anomaly analysis model to perform network usage anomaly analysis;

[0011] S3, importing the acquired browsing process data and browsing permission data into a browsing anomaly analysis model to perform browsing anomaly analysis;

[0012] S4, importing the obtained network usage anomaly analysis results and browsing anomaly analysis results into a network health and safety assessment model to perform network health and safety assessment;

[0013] S5. Issue network security warning based on the network health and security assessment results.

[0014] As a preferred technical solution for a computer network health and safety assessment method, the specific content of obtaining network usage data, browsing process data and browsing permission data during computer use is:

[0015] S11, the enterprise homepage managed by the registrant is logged in, network resource data used by the registrant on various types of web pages during the registrant's historical login process is obtained, and network resource data used by the registrant on various types of web pages during the current login process is obtained, wherein the network resource data is the used network traffic, and the obtained data is stored in the first storage component;

[0016] S12, obtaining web browsing data of the log-in user after logging in, the web browsing data including browsing time of the log-in user's browsing privileges and browsing time of browsing contents that are not within the log-in user's browsing privileges, and storing the obtained data in a second storage component.

[0017] As a preferred technical solution of a computer network health and safety assessment method, the method of importing the acquired network usage data during computer use into a network usage anomaly analysis model for network usage anomaly analysis includes the following specific steps:

[0018] S21, obtaining the network resource data used by the registrant on various types of web pages during the registrant's historical login process and the network resource data used by the registrant on various types of web pages during the registrant's current login process;

[0019] S22, importing the network resource data used by each type of web page during the user's historical login process into the network resource data ratio calculation formula used by the type of web page to calculate the network resource data ratio used by the type of web page, wherein the network resource data ratio calculation formula used by the type i web page is: Wherein, mi is the number of times a web page of type i is opened in history, n is the type, and xij is the network resource data used for opening a web page of type i for the jth time in history;

[0020] S23, obtain the data of the proportion of network resource data used by each type of web page in history and the data of the proportion of network resource data used by each type of web page logged in this time, and import them into the network usage abnormal analysis value calculation formula to calculate the network usage abnormal analysis value, wherein the network usage abnormal analysis value calculation formula is: Among them, ci is the browsing permission level of the i-th type web page, kiw is the proportion of network resource data used by the i-th type web page logged in historically, kiq is the proportion of network resource data used by the i-th type web page logged in this time. In this formula, kiw-kiq is the difference between the proportion of network resource data used by the i-th type web page in history and the proportion of network resource data used by the i-th type web page logged in this time. The previous ci is weighted by using the browsing permission level of the type web page as the importance weight of this type of web page.

[0021] As a preferred technical solution of a computer network health and safety assessment method, the step of importing the acquired browsing process data and browsing permission data into a browsing anomaly analysis model for browsing anomaly analysis includes the following specific steps:

[0022] S31, obtaining web page browsing data of the login user after logging in, and importing the web page browsing abnormal value calculation formula to calculate the web page browsing abnormal value, wherein the web page browsing abnormal value is: Wherein, Q is the number of times the browsing content is browsed without the browsing privileges of the logged-in user, sq is the browsing level of the qth browsing of the browsing content without the browsing privileges of the logged-in user, tq is the browsing time of the qth browsing of the browsing content without the browsing privileges of the logged-in user, U is the total number of browsing times, Su is the browsing level of the content browsed for the uth time, and Tu is the browsing time of the content browsed for the uth time;

[0023] S32: Obtain the calculated web page browsing abnormal value.

[0024] As a preferred technical solution of a computer network health and safety assessment method, the method of importing the obtained network usage anomaly analysis results and browsing anomaly analysis results into a network health and safety assessment model for network health and safety assessment includes the following specific contents:

[0025] Obtain the calculated network usage anomaly analysis value and web browsing anomaly value and substitute them into the network health and safety evaluation value calculation formula to calculate the network health and safety evaluation value, where the network health and safety evaluation value calculation formula is: Among them, λ is the coefficient of abnormal network usage. The calculated network health and safety assessment value is obtained and compared with the set network health and safety assessment threshold. If the obtained network health and safety assessment value is greater than or equal to the set network health and safety assessment threshold, it means that the login is safe. If the obtained network health and safety assessment value is less than the set network health and safety assessment threshold, it means that the login is unsafe.

[0026] As a preferred technical solution of a computer network health and safety assessment method, the network security early warning according to the obtained network health and safety assessment results includes the following specific contents:

[0027] If the login is judged to be unsafe, a network security warning command is issued to the management end to remind the management end to monitor the corresponding login behavior.

[0028] In a second aspect, the present application provides a computer network health and safety assessment system, which is implemented based on the above-mentioned computer network health and safety assessment method, and specifically includes a data acquisition module, a network usage anomaly analysis module, a browsing anomaly analysis module, a network health and safety assessment module and a network security early warning module;

[0029] Wherein, the data acquisition module is used to acquire network usage data, browsing process data and browsing authority data during the use of the computer;

[0030] The network usage anomaly analysis module is used to import the acquired network usage data during the use of the computer into the network usage anomaly analysis model to perform network usage anomaly analysis;

[0031] The browsing anomaly analysis module is used to import the acquired browsing process data and browsing permission data into the browsing anomaly analysis model to perform browsing anomaly analysis;

[0032] The network health and safety assessment module is used to import the obtained network usage anomaly analysis results and browsing anomaly analysis results into the network health and safety assessment model to perform network health and safety assessment;

[0033] The network security early warning module is used to issue a network security early warning based on the obtained network health and safety assessment results;

[0034] At the same time, the system may also include a central control module, which is used to control the operation of the data acquisition module, the network usage anomaly analysis module, the browsing anomaly analysis module, the network health and safety assessment module and the network security early warning module.

[0035] In a third aspect, the present application provides an electronic device, comprising: a processor and a memory, wherein the memory stores a computer program that can be called by the processor;

[0036] The processor executes the above-mentioned computer network health and safety assessment method by calling the computer program stored in the memory.

[0037] In a fourth aspect, the present application provides a computer-readable storage medium storing instructions, which, when executed on a computer, enable the computer to execute a computer network health and security assessment method as described above.

[0038] Compared with the prior art, the beneficial effects of this application are:

[0039] The present application obtains network usage data, browsing process data and browsing permission data during the use of a computer, imports the obtained network usage data during the use of the computer into a network usage anomaly analysis model to perform network usage anomaly analysis, imports the obtained browsing process data and browsing permission data into a browsing anomaly analysis model to perform browsing anomaly analysis, imports the obtained network usage anomaly analysis results and browsing anomaly analysis results into a network health and safety assessment model to perform network health and safety assessment, performs network security early warning based on the obtained network health and safety assessment results, conducts a comprehensive analysis of the registrant's historical login browsing information and network usage allocation information, obtains implicit features of the registrant's historical login rules, compares and analyzes the implicit features of the historical login rules with the data during this login process, accurately determines whether this login is an abnormal login, and improves the accuracy and security of discovering abnormal login processes. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Other features, objects and advantages of the present application will become more apparent by reading the detailed description of non-limiting embodiments made with reference to the following drawings;

[0041] Figure 1 This is a schematic diagram of the overall process of a computer network health and safety assessment method for this application;

[0042] Figure 2 This is a schematic diagram of step S2 of a computer network health and safety assessment method for this application;

[0043] Figure 3 This is a schematic diagram of the overall framework of a computer network health and safety assessment system for this application. DETAILED DESCRIPTION

[0044] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. The following description of at least one exemplary embodiment is actually only illustrative and is by no means intended to limit the present application and its application or use.

[0045] Example 1

[0046] In order to solve the technical problems raised in the background technology, the present application provides a preferred embodiment: Figure 1-Figure 2 As shown, a computer network health and safety assessment method includes the following specific steps:

[0047] S1. Obtaining network usage data, browsing process data, and browsing permission data during computer use;

[0048] In one specific embodiment, the specific contents of obtaining the network usage data, browsing process data and browsing permission data during the use of the computer are:

[0049] S11, the login user logs in to the enterprise homepage managed by the login password and account, obtains the network resource data used by the login user in various types of webpages during the historical login process, and obtains the network resource data used by the login user in various types of webpages during the current login process, wherein the network resource data is the used network traffic, for example, the network traffic of the login user logging in to browse the company homepage is 3Mb, and the network traffic of maintaining the information of the current position is 8Mb, and the various types of webpages are the types of pages for logging in to the corresponding client, and the obtained data is stored in the first storage component;

[0050] S12, obtaining web browsing data after the login user logs in, the web browsing data including browsing time of the login user's browsing privileges and browsing time of browsing content that is not within the login user's browsing privileges, and storing the obtained data in a second storage component, wherein the browsing paths here are all browsing paths stored in the storage disk when the account and password are logged in;

[0051] S2, importing the acquired network usage data during the use of the computer into a network usage anomaly analysis model to perform network usage anomaly analysis;

[0052] In one specific embodiment, importing the acquired network usage data during computer use into a network usage anomaly analysis model to perform network usage anomaly analysis includes the following specific steps:

[0053] S21, obtaining the network resource data used by the registrant on various types of web pages during the registrant's historical login process and the network resource data used by the registrant on various types of web pages during the registrant's current login process;

[0054] S22, importing the network resource data used by each type of web page during the user's historical login process into the network resource data ratio calculation formula used by the type of web page to calculate the network resource data ratio used by the type of web page, wherein the network resource data ratio calculation formula used by the type i web page is: Wherein, mi is the number of times a web page of type i is opened in history, n is the type, and xij is the network resource data used for opening a web page of type i for the jth time in history;

[0055] S23, obtain the data of the proportion of network resource data used by each type of web page in history and the data of the proportion of network resource data used by each type of web page logged in this time, and import them into the network usage abnormal analysis value calculation formula to calculate the network usage abnormal analysis value, wherein the network usage abnormal analysis value calculation formula is: Among them, ci is the browsing authority level of the i-th type web page, kiw is the proportion of network resource data used by the i-type web page logged in historically, and kiq is the proportion of network resource data used by the i-type web page logged in this time. In this formula, kiw-kiq is the difference between the proportion of network resource data used by the i-type web page in history and the proportion of network resource data used by the i-type web page logged in this time. The previous ci is the browsing authority level of the type web page as the importance weight of this type of web page, and then the network use abnormal analysis value of this login is comprehensively considered. It should be noted here that the type web page here, for example, the login user is personnel, and the type web pages that are opened most in history should be personnel management web pages and personal attendance management web pages, and the task quality web pages made by employees are rarely or even never opened. In this way, the difference in the type web pages opened after login can be used to distinguish whether there is impersonation by the login personnel;

[0056] S3, importing the acquired browsing process data and browsing permission data into a browsing anomaly analysis model to perform browsing anomaly analysis;

[0057] In one specific embodiment, importing the acquired browsing process data and browsing permission data into a browsing anomaly analysis model to perform browsing anomaly analysis includes the following specific steps:

[0058] S31, obtaining web page browsing data of the login user after logging in, and importing the web page browsing abnormal value calculation formula to calculate the web page browsing abnormal value, wherein the web page browsing abnormal value is: Wherein, Q is the number of times the browsing content is browsed without the browsing privileges of the logged-in user, sq is the browsing level of the qth browsing of the browsing content without the browsing privileges of the logged-in user, tq is the browsing time of the qth browsing of the browsing content without the browsing privileges of the logged-in user, U is the total number of browsing times, Su is the browsing level of the content browsed for the uth time, and Tu is the browsing time of the content browsed for the uth time;

[0059] S32. Obtaining the calculated web browsing abnormal value

[0060] S4, importing the obtained network usage anomaly analysis results and browsing anomaly analysis results into a network health and safety assessment model to perform network health and safety assessment;

[0061] In one specific embodiment, importing the obtained network usage anomaly analysis results and browsing anomaly analysis results into a network health and safety assessment model to perform network health and safety assessment includes the following specific contents:

[0062] Obtain the calculated network usage anomaly analysis value and web browsing anomaly value and substitute them into the network health and safety evaluation value calculation formula to calculate the network health and safety evaluation value, where the network health and safety evaluation value calculation formula is: Wherein, λ is the coefficient of abnormal network usage; the calculated network health and safety assessment value is obtained and compared with the set network health and safety assessment threshold. If the obtained network health and safety assessment value is greater than or equal to the set network health and safety assessment threshold, it means that the login is safe; if the obtained network health and safety assessment value is less than the set network health and safety assessment threshold, it means that the login is unsafe;

[0063] S5. Conduct network security early warning based on the network health and security assessment results;

[0064] In one specific embodiment, the network security early warning according to the obtained network health and security assessment results includes the following specific contents:

[0065] If the login is judged to be unsafe, a network security warning command is issued to the management end to remind the management end to monitor the corresponding login behavior.

[0066] It should be noted here that the network usage anomaly ratio coefficient and the network health and safety assessment threshold are determined in the following way: 500 sets of network usage data, browsing process data and browsing permission data during computer use are obtained, and the data are substituted into the network health and safety assessment value calculation formula to calculate the network health and safety assessment value. At the same time, the judgment results of whether these logins are intrusion logins are extracted, and the network health and safety assessment value and the judgment results of whether the logins are intrusion logins are imported into the fitting software, and the values ​​of the network usage anomaly ratio coefficient and the network health and safety assessment threshold that meet the maximum judgment accuracy are output.

[0067] The advantages of this embodiment over the prior art are as follows: obtaining network usage data, browsing process data and browsing permission data during computer use, importing the obtained network usage data during computer use into a network usage anomaly analysis model to perform network usage anomaly analysis, importing the obtained browsing process data and browsing permission data into a browsing anomaly analysis model to perform browsing anomaly analysis, importing the obtained network usage anomaly analysis results and browsing anomaly analysis results into a network health and safety assessment model to perform network health and safety assessment, performing network security early warning based on the obtained network health and safety assessment results, performing a comprehensive analysis of the registrant's historical login browsing information and network usage allocation information, obtaining implicit features of the registrant's historical login rules, comparing and analyzing the implicit features of the historical login rules with the data during this login process, accurately judging whether this login is an abnormal login, and improving the accuracy and security of discovering abnormal login processes.

[0068] Example 2

[0069] like Figure 3 As shown, a computer network health and safety assessment system is implemented based on the above-mentioned computer network health and safety assessment method, which specifically includes a data acquisition module, a network usage anomaly analysis module, a browsing anomaly analysis module, a network health and safety assessment module and a network security early warning module;

[0070] The data acquisition module is used to acquire network usage data, browsing process data and browsing permission data during the use of the computer;

[0071] A network usage anomaly analysis module, used to import the acquired network usage data during the computer use process into the network usage anomaly analysis model to perform network usage anomaly analysis;

[0072] A browsing anomaly analysis module, used to import the acquired browsing process data and browsing permission data into a browsing anomaly analysis model to perform browsing anomaly analysis;

[0073] A network health and safety assessment module, used to import the obtained network usage anomaly analysis results and browsing anomaly analysis results into a network health and safety assessment model to perform network health and safety assessment;

[0074] A network security early warning module is used to issue a network security early warning based on the network health and safety assessment results;

[0075] At the same time, the system may also include a central control module, which is used to control the operation of the data acquisition module, the network usage anomaly analysis module, the browsing anomaly analysis module, the network health and safety assessment module and the network security early warning module;

[0076] The above-mentioned parameters and steps for each unit module to implement corresponding functions in a computer network health and safety assessment system of the present application can refer to the parameters and steps in the embodiment of a computer network health and safety assessment method above, and will not be repeated here.

[0077] Example 3

[0078] This embodiment provides an electronic device, including: a processor and a memory, wherein the memory stores a computer program that can be called by the processor;

[0079] The processor executes the above-mentioned computer network health and safety assessment method by calling the computer program stored in the memory.

[0080] The electronic device may have relatively large differences due to different configurations or performances, and may include one or more processors and one or more memories, wherein the memory stores at least one computer program, and the computer program is loaded and executed by the processor to implement a computer network health and safety assessment method provided by the above method embodiment. The electronic device may also include other components for implementing the functions of the device, for example, the electronic device may also have components such as a wired or wireless network interface and an input and output interface to input and output data. This embodiment will not be described in detail here.

[0081] Example 4

[0082] This embodiment provides a computer-readable storage medium having a rewritable computer program stored thereon;

[0083] When the computer program runs on a computer device, the computer device is caused to execute the above-mentioned computer network health and safety assessment method.

[0084] For example, the computer readable storage medium can be a read-only memory, a random access memory, a read-only CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, and the like.

[0085] The above embodiments can be implemented in whole or in part by software, hardware, firmware or any other combination. When implemented using software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When a computer instruction or computer program is loaded or executed on a computer, a process or function according to an embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network or other programmable device. Computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, computer instructions can be transmitted from a website site, a computer, a server or a data center to another website site, a computer, a server or a data center through a wired network or / and a wireless network. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or a data center that contains one or more available media sets. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state hard disk.

[0086] The terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion such that a process, method, article, or apparatus that includes a list of elements includes not only those elements but also other elements not expressly listed, or also includes elements inherent to such process, method, article, or apparatus.

[0087] The above description is only a preferred embodiment of the present application and an explanation of the technical principles used. Those skilled in the art should understand that the scope of application involved in the present application is not limited to the technical solution formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the aforementioned application concept. For example, the above features are replaced with (but not limited to) technical features with similar functions applied in the present application.

Claims

1. A computer network health and safety assessment method, characterized in that: It includes the following specific steps: S1. Obtaining network usage data, browsing process data, and browsing permission data during computer use; S2, importing the obtained network usage data during the use of the computer into a network usage anomaly analysis model to perform network usage anomaly analysis; S3, importing the acquired browsing process data and browsing permission data into a browsing anomaly analysis model to perform browsing anomaly analysis; S4, importing the obtained network usage anomaly analysis results and browsing anomaly analysis results into a network health and safety assessment model to perform network health and safety assessment; S5. Issue network security warning based on the network health and security assessment results.

2. A computer network health and safety assessment method as claimed in claim 1, characterized in that: The step of importing the acquired network usage data during the use of the computer into the network usage anomaly analysis model to perform network usage anomaly analysis comprises the following specific steps: Obtain the network resource data used by the login user on various types of web pages during the login history process and the network resource data used by the login user on various types of web pages during the current login process; The network resource data used by each type of web page during the user's historical login process is imported into the network resource data ratio calculation formula used by the type of web page to calculate the network resource data ratio used by the type of web page, where the network resource data ratio calculation formula used by the type i web page is: Wherein, mi is the number of times a web page of type i is opened in history, n is the type, and xij is the network resource data used for opening a web page of type i for the jth time in history; The network resource data proportion data used by each type of web page in history and the network resource data proportion data used by each type of web page logged in this time are obtained and imported into the network usage abnormal analysis value calculation formula to calculate the network usage abnormal analysis value, wherein the network usage abnormal analysis value calculation formula is: Among them, ci is the browsing permission level of the i-th type web page, kiw is the proportion of network resource data used by the i-th type web page logged in historically, and kiq is the proportion of network resource data used by the i-th type web page logged in this time.

3. A computer network health and safety assessment method as claimed in claim 1, characterized in that: The step of importing the acquired browsing process data and browsing permission data into the browsing anomaly analysis model for browsing anomaly analysis includes the following specific steps: Obtain the web browsing data of the login user after logging in, and import it into the web browsing abnormal value calculation formula to calculate the web browsing abnormal value, where the web browsing abnormal value is: Wherein, Q is the number of times the browsing content is browsed without the browsing privileges of the logged-in user, sq is the browsing level of the qth browsing of the browsing content without the browsing privileges of the logged-in user, tq is the browsing time of the qth browsing of the browsing content without the browsing privileges of the logged-in user, U is the total number of browsing times, Su is the browsing level of the content browsed for the uth time, and Tu is the browsing time of the content browsed for the uth time; Gets the calculated pageview anomaly value.

4. A computer network health and safety assessment method as claimed in claim 3, characterized in that: The method of importing the obtained network usage anomaly analysis results and browsing anomaly analysis results into the network health and safety assessment model to perform network health and safety assessment includes the following specific contents: Obtain the calculated network usage anomaly analysis value and web browsing anomaly value and substitute them into the network health and safety evaluation value calculation formula to calculate the network health and safety evaluation value, where the network health and safety evaluation value calculation formula is: Among them, λ is the coefficient of abnormal network usage. The calculated network health and safety assessment value is obtained and compared with the set network health and safety assessment threshold. If the obtained network health and safety assessment value is greater than or equal to the set network health and safety assessment threshold, it means that the login is safe. If the obtained network health and safety assessment value is less than the set network health and safety assessment threshold, it means that the login is unsafe.

5. A computer network health and safety assessment method as claimed in claim 4, characterized in that: The network security early warning according to the obtained network health and security assessment results includes the following specific contents: If the login is judged to be unsafe, a network security warning command is issued to the management end to remind the management end to monitor the corresponding login behavior.

6. A computer network health and safety assessment method as claimed in claim 5, characterized in that: The specific contents of obtaining the network usage data, browsing process data and browsing authority data during the use of the computer are as follows: S11, the registrant logs in to the enterprise homepage managed by the registrant, obtains the network resource data used by the registrant on various types of web pages during the registrant's historical login process, obtains the network resource data used by the registrant on various types of web pages during the current login process, and stores the obtained data in the first storage component; S12, obtaining web browsing data of the log-in user after logging in, and storing the obtained data in a second storage component.

7. A computer network health and safety assessment system, which is implemented based on the computer network health and safety assessment method according to any one of claims 1 to 6, characterized in that: It specifically includes a data acquisition module, a network usage anomaly analysis module, a browsing anomaly analysis module, a network health and safety assessment module, and a network security early warning module; Wherein, the data acquisition module is used to acquire network usage data, browsing process data and browsing authority data during the use of the computer; The network usage anomaly analysis module is used to import the acquired network usage data during the use of the computer into the network usage anomaly analysis model to perform network usage anomaly analysis; The browsing anomaly analysis module is used to import the acquired browsing process data and browsing permission data into the browsing anomaly analysis model to perform browsing anomaly analysis; The network health and safety assessment module is used to import the obtained network usage anomaly analysis results and browsing anomaly analysis results into the network health and safety assessment model to perform network health and safety assessment; The network security early warning module is used to issue a network security early warning based on the obtained network health and safety assessment results.

8. An electronic device comprising: A processor and a memory, wherein the memory stores a computer program that can be called by the processor; It is characterized in that the processor executes a computer network health and safety assessment method as described in any one of claims 1 to 6 by calling a computer program stored in the memory.

9. A computer-readable storage medium, characterized in that: Instructions are stored, and when the instructions are executed on a computer, the computer executes a computer network health and safety assessment method as described in any one of claims 1 to 6.

Images