Enterprise security information management method and system based on big data

Abstract

The invention provides an enterprise security information management method and system based on big data, and relates to the technical field of enterprise network security. Extracting network traffic data entering the target enterprise server from the network security data, and determining traffic security features of each network node in the target enterprise server through the network traffic data; and determining the security decision amount of the target enterprise server during network communication according to all the traffic security features, extracting the correlation stability of each network node by using a pre-trained node correlation model, and performing security decision based on the security decision amount and all the correlation stability. Obtaining a communication risk entropy of the target enterprise server during network communication; according to the method and the device, the association relationship between the network nodes of the server can be utilized to mine potential abnormal nodes, so that the enterprise server anomaly detection precision is improved.

Description

Technical Field

[0001] The present application relates to the field of enterprise network security technology, and more specifically, to a method and system for enterprise security information management based on big data. Background Art

[0002] With the rapid development of information technology, the security situation of enterprises is becoming increasingly complex, and traditional security protection methods are gradually unable to cope with the increasing security threats. The introduction of big data technology has provided new opportunities for enterprise security information management, but it has also brought many challenges. Enterprise security information management based on big data refers to the use of big data technology to collect, store, analyze and process security data inside and outside the enterprise, so as to identify potential security threats, predict future security risks, and take corresponding protective measures. Through real-time analysis of multi-dimensional data such as network traffic, log data, user behavior, and device status, enterprises can respond quickly when security incidents occur, take timely response strategies, and minimize losses.

[0003] In enterprise security information management based on big data, data analysis is the core. Enterprises need to rely on data analysis technology, especially machine learning and artificial intelligence (AI) technology, to conduct in-depth analysis of the collected security data to detect potential security threats. However, in the existing technology, the target enterprise's server usually involves interactions between multiple network nodes during network communication, which affect each other, resulting in low accuracy in detecting anomalies in server traffic. Therefore, how to use the correlation between server network nodes to mine potential abnormal nodes and improve the accuracy of enterprise server anomaly detection is a difficult problem faced by the industry. Summary of the invention

[0004] The present application provides an enterprise security information management method and system based on big data, which can utilize the correlation between server network nodes to mine potential abnormal nodes, thereby improving the accuracy of enterprise server anomaly detection.

[0005] In a first aspect, the present application provides an enterprise security information management method based on big data, the management method comprising the following steps: Aggregate logs and data streams from different sources to obtain network security data of the target enterprise; Extracting network traffic data entering the target enterprise server from the network security data, and determining traffic security features of each network node in the target enterprise server through the network traffic data; Determine the security decision amount of the target enterprise server during network communication according to all traffic security features, use the pre-trained node association model to extract the correlation stability of each network node in the target enterprise server, make a security decision on the target enterprise server based on the security decision amount and the correlation stability between each network node, and obtain the communication risk entropy of the target enterprise server during network communication; An abnormality level detection is performed on the target enterprise server based on the communication risk entropy.

[0006] In this embodiment, logs and data streams from different sources are aggregated through deep learning algorithms.

[0007] In this embodiment, the network security data includes traffic data, user behavior data and device health data of the target enterprise server.

[0008] In this embodiment, extracting the network traffic data entering the target enterprise server from the network security data specifically includes: For each network node in the target enterprise server, obtaining the node address of the network node; Extracting all traffic logs corresponding to the network node from the network security data according to the node address; Collecting the data consisting of all traffic logs as the traffic record of the network node, and then obtaining the traffic record of each network node in the target enterprise server; The traffic records of all network nodes are recorded as network traffic data entering the target enterprise server.

[0009] In this embodiment, determining the traffic security features of each network node in the target enterprise server through the network traffic data specifically includes: For each network node in the target enterprise server, extracting the traffic record of the network node from the network traffic data; Performing abnormality identification on the traffic logs in the traffic records to obtain an abnormal traffic log set; The traffic security features of the network nodes are determined based on the abnormal traffic log set, and then the traffic security features of each network node in the target enterprise server are obtained.

[0010] In this embodiment, determining the security decision amount of the target enterprise server during network communication based on all traffic security features specifically includes: For each network node in the target enterprise server, obtaining a node execution coefficient of the network node; Standardizing the traffic security features of the network node to obtain a security feature quantity of the network node; Determine the decision value of the network node using the node execution coefficient and the security feature quantity, and then obtain the decision value of each network node; The security decision amount of the target enterprise server during network communication is determined based on the decision values ​​of all network nodes.

[0011] In this embodiment, using the pre-trained node association model to extract the relevant stability of each network node in the target enterprise server specifically includes: Determine the correlation between each network node in the target enterprise server through a pre-trained node correlation model; For each network node in the target enterprise server, the correlation stability of the network node is determined according to all the correlation degrees corresponding to the network node, and then the correlation stability of each network node in the target enterprise server is obtained.

[0012] In this embodiment, a security decision is made on the target enterprise server based on the security decision amount and the correlation stability between each network node, and the communication risk entropy of the target enterprise server when performing network communication is obtained, which specifically includes: Obtaining the node execution coefficient of each network node in the target enterprise server; Conduct security assessment on each network node in the target enterprise server according to the corresponding node execution coefficient and the corresponding related stability, and then obtain the node risk value of each network node; The communication risk entropy of the target enterprise server during network communication is determined by the node risk values ​​of all network nodes and the security decision amount.

[0013] In this embodiment, performing abnormal level detection on the target enterprise server according to the communication risk entropy specifically includes: Get the preset abnormal level range; The communication risk entropy and the abnormal level interval are detected and matched to obtain the abnormal level of the target enterprise server, thereby completing the abnormal level detection of the target enterprise server.

[0014] In a second aspect, the present application provides an enterprise security information management system based on big data, which is used to execute an enterprise security information management method based on big data, and the management system includes: Data aggregation module, used to aggregate logs and data streams from different sources to obtain the network security data of the target enterprise; A feature extraction module, used to extract network traffic data entering the target enterprise server from the network security data, and determine the traffic security features of each network node in the target enterprise server through the network traffic data; A communication risk determination module is used to determine the security decision amount of the target enterprise server during network communication based on all traffic security features, extract the correlation stability of each network node in the target enterprise server using a pre-trained node association model, make a security decision on the target enterprise server based on the security decision amount and the correlation stability between each network node, and obtain the communication risk entropy of the target enterprise server during network communication; The anomaly detection module is used to perform anomaly level detection on the target enterprise server based on the communication risk entropy.

[0015] The technical solution provided by the embodiments disclosed in this application has the following beneficial effects: By aggregating logs and data streams from different sources, the network security data of the target enterprise is obtained; the network traffic data entering the target enterprise server is extracted from the network security data, and the traffic security characteristics of each network node in the target enterprise server are determined through the network traffic data; the security decision amount of the target enterprise server during network communication is determined according to all the traffic security characteristics, and the correlation stability of each network node in the target enterprise server is extracted using a pre-trained node association model. A security decision is made for the target enterprise server based on the security decision amount and the correlation stability between each network node, and the communication risk entropy of the target enterprise server during network communication is obtained; and the target enterprise server is detected for abnormality level according to the communication risk entropy.

[0016] It can be seen that in the present application, firstly, by extracting network traffic data and analyzing the traffic security characteristics of each network node, the traffic security characteristics of each network node can be obtained, which is helpful to identify abnormal traffic behavior patterns, and multi-dimensional analysis of the traffic characteristics of each network node can enhance the accuracy of anomaly detection; then, by analyzing the traffic security characteristics of each network node, the network behavior of the target enterprise server can be analyzed in detail to help the decision-making system identify abnormal traffic or potential security threats, and through the pre-trained node association model, the correlation between each network node can be effectively extracted, which helps to discover the potential correlation relationship between nodes, and by calculating the communication risk entropy, the risk level of the target enterprise server network communication can be quantified; finally, the target enterprise can accurately identify the abnormal level of the server based on the communication risk entropy value calculated in real time.

[0017] In summary, the technical solution adopted in this application can utilize the correlation between server network nodes to mine potential abnormal nodes, thereby improving the accuracy of enterprise server anomaly detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0019] Figure 1 It is a flow chart of the enterprise security information management method based on big data provided by this application; Figure 2 is an exemplary flow chart for determining traffic security features of each network node in a target enterprise server according to the present application; Figure 3 is an exemplary flow chart for determining the communication risk entropy of a target enterprise server when performing network communication according to the present application; Figure 4 This is a module structure diagram of the enterprise security information management system based on big data provided by this application. DETAILED DESCRIPTION

[0020] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0021] The embodiment of the present application provides a method and system for enterprise security information management based on big data, the core of which is to aggregate logs and data streams from different sources to obtain network security data of the target enterprise; extract network traffic data entering the target enterprise server from the network security data, and determine the traffic security features of each network node in the target enterprise server through the network traffic data; determine the security decision amount of the target enterprise server during network communication based on all traffic security features, use the pre-trained node association model to extract the relevant stability of each network node in the target enterprise server, make security decisions on the target enterprise server based on the security decision amount and the relevant stability between each network node, and obtain the communication risk entropy of the target enterprise server during network communication; perform abnormal level detection on the target enterprise server based on the communication risk entropy. The above scheme can be used to utilize the correlation between server network nodes to dig out potential abnormal nodes, thereby improving the accuracy of enterprise server abnormality detection.

[0022] Embodiment 1 In order to better understand the above technical solution, the above technical solution will be described in detail below in conjunction with the accompanying drawings and specific implementation methods. Figure 1 As shown, this figure is an exemplary flow chart of an enterprise security information management method based on big data according to this embodiment of the present application, and the management method includes the following steps: In step S1, logs and data streams from different sources are aggregated to obtain the network security data of the target enterprise.

[0023] In specific implementation, logs and data streams from different sources can be aggregated through deep learning algorithms; in this application, the deep learning algorithm used is a multi-layer neural network (such as convolutional neural network CNN, recurrent neural network RNN), which can be used to efficiently process and aggregate logs and data streams from multiple sources, so that the aggregated data is used as the network security data of the target enterprise, and the network security data includes the traffic data of the target enterprise server, user behavior data and device health data, among which the target enterprise server traffic data refers to inbound traffic data, which is usually obtained through network devices (such as firewalls, IDS / IPS systems, routers, etc.), and the inbound traffic data contains traffic logs, IP addresses, ports, protocols, data packet sizes, request types and other information.

[0024] In step S2, network traffic data entering the target enterprise server is extracted from the network security data, and traffic security features of each network node in the target enterprise server are determined through the network traffic data.

[0025] In this embodiment, the network traffic data entering the target enterprise server can be extracted from the network security data in the following manner, namely: For each network node in the target enterprise server, obtaining the node address of the network node; Extracting all traffic logs corresponding to the network node from the network security data according to the node address; Collecting the data consisting of all traffic logs as the traffic record of the network node, and then obtaining the traffic record of each network node in the target enterprise server; The traffic records of all network nodes are recorded as network traffic data entering the target enterprise server.

[0026] In the specific implementation, first, for each network node in the target enterprise server, the node address of the network node can be obtained through the enterprise network management system; then, all traffic logs corresponding to the network node can be extracted from the network security data based on the node address, and the node address is used as a unique identifier for query to obtain all traffic logs corresponding to the network node. The traffic log is usually used to record all traffic data related to each network node. The traffic data described in this application refers to inbound traffic data; secondly, the data composed of all traffic logs can be combined as a traffic record of the network node. The traffic record of each network node in the target enterprise server can be obtained in the above manner; finally, the traffic records of all network nodes can be used as network traffic data entering the target enterprise server.

[0027] Preferably, in this embodiment, reference Figure 2 As shown, this figure is an exemplary flow chart of determining the traffic security features of each network node in the target enterprise server in an embodiment of the present application. In this embodiment, the traffic security features of each network node in the target enterprise server are determined by the network traffic data, which can be implemented by the following steps: First, in step S21, for each network node in the target enterprise server, the flow record of the network node is extracted from the network flow data; Then, in step S22, anomaly identification is performed on the traffic log in the traffic record to obtain an abnormal traffic log set; Finally, in step S23, the traffic security characteristics of the network node are determined based on the abnormal traffic log set, and then the traffic security characteristics of each network node in the target enterprise server are obtained.

[0028] In the specific implementation, first, for each network node in the target enterprise server, the traffic record of the network node can be extracted from the network traffic data; then, the traffic log in the traffic record can be identified for anomalies, and the characteristics of normal and abnormal traffic can be automatically identified by training machine learning models (such as isolation forests, support vector machines, etc.), so that complex abnormal traffic behaviors can be identified more flexibly and accurately. Among them, abnormal traffic behavior refers to traffic behavior that deviates from the normal business traffic pattern. The traffic log containing abnormal traffic behavior can be used as an abnormal traffic log, thereby obtaining an abnormal traffic log set: Finally, the traffic security feature of the network node can be determined based on the abnormal traffic log set. The traffic security feature is a feature used to represent the security level of the inbound traffic of the network node. The ratio of the total number of abnormal traffic logs in the abnormal traffic log set to the total number of traffic logs of the network node can be used as the traffic security feature of the network node. The traffic security feature of each network node in the target enterprise server can be obtained in the above manner.

[0029] It should be noted that by extracting network traffic data and analyzing the traffic security characteristics of each network node, the traffic security characteristics of each network node can be obtained, which helps to identify abnormal traffic behavior patterns. By performing multi-dimensional analysis of the traffic characteristics of each network node, the accuracy of anomaly detection can be enhanced.

[0030] In step S3, the security decision amount of the target enterprise server during network communication is determined based on all traffic security features, and the relevant stability of each network node in the target enterprise server is extracted using a pre-trained node association model. A security decision is made for the target enterprise server based on the security decision amount and the relevant stability between each network node, and the communication risk entropy of the target enterprise server during network communication is obtained.

[0031] In this embodiment, the security decision amount of the target enterprise server during network communication can be determined according to all traffic security features in the following manner, namely: For each network node in the target enterprise server, obtaining a node execution coefficient of the network node; Standardizing the traffic security features of the network node to obtain a security feature quantity of the network node; Determine the decision value of the network node using the node execution coefficient and the security feature quantity, and then obtain the decision value of each network node; The security decision amount of the target enterprise server during network communication is determined based on the decision values ​​of all network nodes.

[0032] In the specific implementation, first, for each network node in the target enterprise server, the node execution coefficient of the network node can be obtained, wherein the node execution coefficient is used to represent the execution ratio of the network node in the target enterprise server, and the execution ratio of the network node can be obtained in the execution rule of the target enterprise server; then, the traffic security features of the network nodes can be standardized. The purpose of standardization is to eliminate the unfair influence caused by different scales between different traffic security features, so that each traffic security feature has the same weight and comparability when calculating decisions. By using the Z-score standardization method, the standardized traffic security features can be used as the security feature quantity of the network node.

[0033] In addition, in the specific implementation, the node execution coefficient and the security feature quantity can be used to determine the decision value of the network node, wherein the decision value represents the degree of contribution of the network node to the overall security of the target enterprise server, and the product of the node execution coefficient and the security feature quantity can be used as the decision value of the network node. The decision value of each network node can be obtained in the above manner; finally, the security decision quantity of the target enterprise server during network communication can be determined based on the decision values ​​of all network nodes, wherein the security decision quantity represents the overall security level of the target enterprise server during network communication, and the standard deviation of the decision values ​​of all network nodes can be used as the security decision quantity of the target enterprise server during network communication.

[0034] In this embodiment, the related stability of each network node in the target enterprise server is extracted using the pre-trained node association model in the following manner, namely: Determine the correlation between each network node in the target enterprise server through a pre-trained node correlation model; For each network node in the target enterprise server, the correlation stability of the network node is determined according to all the correlation degrees corresponding to the network node, and then the correlation stability of each network node in the target enterprise server is obtained.

[0035] In specific implementation, first, the correlation between each network node in the target enterprise server can be determined through a pre-trained node correlation model, wherein the correlation represents the degree of correlation between the network nodes, and the network nodes can be input into the pre-trained node correlation model in pairs, thereby taking the evaluation result of the node correlation model as the correlation between the input network node pairs, and the correlation between each network node in the target enterprise server can be obtained in the above manner; then, for each network node in the target enterprise server, the correlation stability of the network node can be determined based on all the correlations corresponding to the network node, wherein the correlation stability represents the stability of the overall correlation between the network node and other network nodes, and the difference between the standard deviation of all the correlations corresponding to the network node and 1 can be taken as the correlation stability of the network node, and the correlation stability of each network node in the target enterprise server can be obtained in the above manner.

[0036] Preferably, in this embodiment, reference Figure 3 As shown, this figure is an exemplary flow chart of determining the communication risk entropy of the target enterprise server when performing network communication in an embodiment of the present application. In this embodiment, a security decision is made on the target enterprise server based on the security decision amount and the correlation stability between each network node, and the communication risk entropy of the target enterprise server when performing network communication is obtained. Specifically, the following steps can be used to implement: First, in step S31, the node execution coefficient of each network node in the target enterprise server is obtained; Then, in step S32, security assessment is performed on each network node in the target enterprise server according to the corresponding node execution coefficient and the corresponding related stability, thereby obtaining the node risk value of each network node; Finally, in step S33, the communication risk entropy of the target enterprise server during network communication is determined by using the node risk values ​​of all network nodes and the security decision amount.

[0037] In specific implementation, first, the node execution coefficient of each network node in the target enterprise server can be obtained; then, the security assessment of each network node in the target enterprise server can be performed based on the corresponding node execution coefficient and the corresponding related stability, that is, a security assessment model can be initialized, the node execution coefficient is used as the assessment parameter of the security assessment model, and the related stability is used as the adjustment parameter of the security assessment model. The assessment result of the security assessment model can be used as the node risk value of the network node, wherein the node risk value represents the risk level of the network node in the target enterprise server, and the node risk value of each network node can be obtained in the above manner; finally, the communication risk entropy of the target enterprise server when performing network communication can be determined by the node risk values ​​of all network nodes and the security decision amount, wherein the communication risk entropy is an indicator for measuring the risk abnormality level of the target enterprise server when performing network communication, and the product of the ratio of the variance of the node risk values ​​of all network nodes to the mean of the node risk values ​​of all network nodes and the security decision amount can be used as the communication risk entropy of the target enterprise server when performing network communication.

[0038] It should be noted that by analyzing the traffic security characteristics of each network node, the network behavior of the target enterprise server can be analyzed in detail to help the decision-making system identify abnormal traffic or potential security threats. The pre-trained node association model can effectively extract the correlation between each network node, which helps to discover the potential correlation between nodes and find those nodes that may exhibit abnormal behavior. By calculating the communication risk entropy, the risk level of the target enterprise server network communication can be quantified. Enterprises can optimize the system accordingly, strengthen defense measures, and reduce security risks.

[0039] In step S4, an abnormality level detection is performed on the target enterprise server based on the communication risk entropy.

[0040] In this embodiment, the abnormal level detection of the target enterprise server according to the communication risk entropy can be specifically performed in the following manner, namely: Get the preset abnormal level range; The communication risk entropy and the abnormal level interval are detected and matched to obtain the abnormal level of the target enterprise server, thereby completing the abnormal level detection of the target enterprise server.

[0041] In specific implementation, first, the abnormal level range can be set according to historical experiments and data analysis. The abnormal level range can be divided into: Normal state: The communication risk entropy is low, indicating that the risk of network communication is small, and the correlation between nodes and traffic characteristics are stable; Slight anomaly: The communication risk entropy is moderate, indicating that there may be some unstable factors in network communication, but it does not pose a serious threat; Moderate abnormality: The communication risk entropy is high, indicating that there may be potential security threats in network communications, which requires further investigation and protection; Severe anomaly: The communication risk entropy is very high, indicating that there is a significant risk of network communication, which may be attacked or the system fails, and immediate action is required.

[0042] Then, the communication risk entropy and the abnormal level interval can be detected and matched to obtain the abnormal level of the target enterprise server. By calculating the communication risk entropy of the target enterprise server and matching it with the preset abnormal level interval, it is determined in which interval the communication risk entropy falls. For example: If the communication risk entropy is lower than the preset normal state threshold, it is classified as "normal state".

[0043] If the communication risk entropy is in the slightly abnormal range, it is classified as “slightly abnormal”.

[0044] If the communication risk entropy is in the medium abnormal range, it is judged as "moderate abnormal".

[0045] If the communication risk entropy exceeds the threshold of the severe abnormality interval, it is judged as "severe abnormality".

[0046] The above method can be used to complete the abnormal level detection of the target enterprise server.

[0047] It should be noted that the target enterprise can accurately identify the abnormality level of the server based on the communication risk entropy value calculated in real time. This not only helps the enterprise to discover potential security risks in a timely manner, but also can take corresponding security measures according to different abnormality levels.

[0048] It can be seen that in the present application, firstly, by extracting network traffic data and analyzing the traffic security characteristics of each network node, the traffic security characteristics of each network node can be obtained, which is helpful to identify abnormal traffic behavior patterns, and multi-dimensional analysis of the traffic characteristics of each network node can enhance the accuracy of anomaly detection; then, by analyzing the traffic security characteristics of each network node, the network behavior of the target enterprise server can be analyzed in detail to help the decision-making system identify abnormal traffic or potential security threats, and through the pre-trained node association model, the correlation between each network node can be effectively extracted, which helps to discover the potential correlation relationship between nodes, and by calculating the communication risk entropy, the risk level of the target enterprise server network communication can be quantified; finally, the target enterprise can accurately identify the abnormal level of the server based on the communication risk entropy value calculated in real time.

[0049] In summary, the technical solution adopted in this application can utilize the correlation between server network nodes to mine potential abnormal nodes, thereby improving the accuracy of enterprise server anomaly detection.

[0050] Embodiment 2 This application provides an enterprise security information management system based on big data, referring to Figure 4 As shown, this figure is a schematic diagram of a management system according to this embodiment of the present application, and the management system includes: The data aggregation module 100 is used to aggregate logs and data streams from different sources to obtain network security data of the target enterprise; A feature extraction module 200 is used to extract network traffic data entering the target enterprise server from the network security data, and determine the traffic security features of each network node in the target enterprise server through the network traffic data; The communication risk determination module 300 is used to determine the security decision amount of the target enterprise server during network communication according to all traffic security features, extract the correlation stability of each network node in the target enterprise server using a pre-trained node association model, make a security decision on the target enterprise server based on the security decision amount and the correlation stability between each network node, and obtain the communication risk entropy of the target enterprise server during network communication; The anomaly detection module 400 is used to perform anomaly level detection on the target enterprise server based on the communication risk entropy.

[0051] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0052] A person skilled in the art may understand that all or part of the steps in the various methods of the above embodiments may be completed by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, the storage medium including a read-only memory (ROM), a random access memory (RAM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), a one-time programmable read-only memory (OTPROM), an electronically-erasable programmable read-only memory (EEPROM), a compact disc (CD-ROM) or other optical disc storage, magnetic disk storage, magnetic tape storage, or any other computer-readable medium that can be used to carry or store data.

[0053] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

Claims

1. A method for enterprise security information management based on big data, characterized in that: The management method comprises the following steps: Aggregate logs and data streams from different sources to obtain network security data of the target enterprise; Extracting network traffic data entering the target enterprise server from the network security data, and determining traffic security features of each network node in the target enterprise server through the network traffic data; Determine the security decision amount of the target enterprise server during network communication according to all traffic security features, use the pre-trained node association model to extract the correlation stability of each network node in the target enterprise server, make a security decision on the target enterprise server based on the security decision amount and the correlation stability between each network node, and obtain the communication risk entropy of the target enterprise server during network communication; An abnormality level detection is performed on the target enterprise server based on the communication risk entropy.

2. The enterprise security information management method based on big data according to claim 1, characterized in that: Aggregate logs and data streams from different sources through deep learning algorithms.

3. The enterprise security information management method based on big data according to claim 1, characterized in that: The network security data includes traffic data, user behavior data and device health data of the target enterprise server.

4. The enterprise security information management method based on big data according to claim 1, characterized in that: Extracting network traffic data entering the target enterprise server from the network security data specifically includes: For each network node in the target enterprise server, obtaining the node address of the network node; Extracting all traffic logs corresponding to the network node from the network security data according to the node address; Collecting the data consisting of all traffic logs as the traffic record of the network node, and then obtaining the traffic record of each network node in the target enterprise server; The traffic records of all network nodes are recorded as network traffic data entering the target enterprise server.

5. The enterprise security information management method based on big data as claimed in claim 1, characterized in that: Determining the traffic security features of each network node in the target enterprise server through the network traffic data specifically includes: For each network node in the target enterprise server, extracting the traffic record of the network node from the network traffic data; Performing abnormality identification on the traffic logs in the traffic records to obtain an abnormal traffic log set; The traffic security features of the network nodes are determined based on the abnormal traffic log set, and then the traffic security features of each network node in the target enterprise server are obtained.

6. The enterprise security information management method based on big data according to claim 1, characterized in that: Determine the target enterprise server's security decision volume during network communication based on all traffic security features, including: For each network node in the target enterprise server, obtaining a node execution coefficient of the network node; Standardizing the traffic security features of the network node to obtain a security feature quantity of the network node; Determine the decision value of the network node using the node execution coefficient and the security feature quantity, and then obtain the decision value of each network node; The security decision amount of the target enterprise server during network communication is determined based on the decision values ​​of all network nodes.

7. The enterprise security information management method based on big data as claimed in claim 1, characterized in that: The relevant stability of each network node in the target enterprise server is extracted using the pre-trained node association model, including: Determine the correlation between each network node in the target enterprise server through a pre-trained node correlation model; For each network node in the target enterprise server, the correlation stability of the network node is determined according to all the correlation degrees corresponding to the network node, and then the correlation stability of each network node in the target enterprise server is obtained.

8. The enterprise security information management method based on big data as claimed in claim 1, characterized in that: Based on the security decision amount and the correlation stability between each network node, a security decision is made on the target enterprise server, and the communication risk entropy of the target enterprise server when performing network communication is obtained, which specifically includes: Obtaining the node execution coefficient of each network node in the target enterprise server; Conduct security assessment on each network node in the target enterprise server according to the corresponding node execution coefficient and the corresponding related stability, and then obtain the node risk value of each network node; The communication risk entropy of the target enterprise server during network communication is determined by the node risk values ​​of all network nodes and the security decision amount.

9. The enterprise security information management method based on big data as claimed in claim 1, characterized in that: The abnormal level detection of the target enterprise server according to the communication risk entropy specifically includes: Get the preset abnormal level range; The communication risk entropy and the abnormal level interval are detected and matched to obtain the abnormal level of the target enterprise server, thereby completing the abnormal level detection of the target enterprise server.

10. An enterprise security information management system based on big data, used to execute an enterprise security information management method based on big data as claimed in any one of claims 1 to 9, characterized in that: The management system comprises: Data aggregation module, used to aggregate logs and data streams from different sources to obtain the network security data of the target enterprise; A feature extraction module, used to extract network traffic data entering the target enterprise server from the network security data, and determine the traffic security features of each network node in the target enterprise server through the network traffic data; A communication risk determination module is used to determine the security decision amount of the target enterprise server during network communication based on all traffic security features, extract the correlation stability of each network node in the target enterprise server using a pre-trained node association model, make a security decision on the target enterprise server based on the security decision amount and the correlation stability between each network node, and obtain the communication risk entropy of the target enterprise server during network communication; The anomaly detection module is used to perform anomaly level detection on the target enterprise server based on the communication risk entropy.

Images