Computer network information security monitoring method

Abstract

The invention discloses a computer network information security monitoring method, which relates to the technical field of network information security monitoring, and comprises the following steps of: monitoring and collecting network flow data in real time by using a monitoring and collecting module, extracting and recording historical network flow data, judging the abnormal degree of the current flow by using a comprehensive evaluation and adjustment module, and judging the abnormal degree of the current flow. The method comprises the following steps: evaluating the overall risk level of network security, adjusting a network security policy, generating a policy adjustment report, executing the adjusted network security policy by using a security execution module based on the policy adjustment report, and continuously monitoring network traffic by using a monitoring acquisition module. The beneficial effects and optimization innovation of comprehensive assessment, dynamic risk assessment, flexible strategy adjustment and sensitivity improvement are realized, and the optimization and innovation not only solve the problems and defects in the prior art, but also improve the accuracy and reliability of the monitoring system. And a more comprehensive and effective guarantee is provided for computer network information security.

Description

Technical Field

[0001] The present invention relates to the technical field of network information security monitoring, and in particular to a computer network information security monitoring method. Background Art

[0002] With the widespread application and popularization of computer networks, network security threats are becoming increasingly severe. Hacker attacks, virus transmission, and phishing security incidents occur frequently, posing huge challenges to the information security of individuals, enterprises, and countries. These security threats may not only lead to data leakage and property loss, but also affect social stability and national security. Therefore, it is imperative to develop effective computer network information security monitoring methods. In the field of network security, the adjustment of security policies is an important means to deal with security threats.

[0003] Existing technologies mostly rely on a single traffic rate as an evaluation indicator, ignoring the key information of traffic peaks, resulting in incomplete evaluation results. Risk assessment and security policy adjustments are often based on static thresholds and fixed rules, and cannot be dynamically adjusted according to real-time changes in the network environment. When facing complex and changeable network attacks, existing technologies are not sensitive enough and it is difficult to detect potential security threats in a timely and accurate manner. In addition, the adjustment of security policies often relies on manual judgment and experience, and lacks an automated adjustment mechanism, resulting in slow response and low efficiency. Summary of the invention

[0004] The purpose of the present invention is to provide a computer network information security monitoring method to solve the problems raised in the above background technology.

[0005] To achieve the above object, the present invention provides the following technical solution, and the specific implementation steps are as follows: Step 1: Use the monitoring and collection module to monitor and collect network traffic data in real time, and extract the historical network traffic data; Step 2: Use the comprehensive assessment and adjustment module to determine the abnormality of the current traffic, assess the overall risk level of network security, adjust the network security strategy, and generate a strategy adjustment report; Step 3: Based on the policy adjustment report, the adjusted network security policy is executed by using the security execution module; Step 4: Use the monitoring and collection module to continuously monitor network traffic; The comprehensive assessment and adjustment module includes a monitoring and assessment unit for the degree of traffic anomaly, a comprehensive assessment unit for the current network security risk, and a security policy adjustment unit; The monitoring and collection module may include network traffic monitoring equipment, such as network traffic analyzers, network probes, etc., which are used to collect network traffic data in real time, including network traffic analyzers and network probes, which are used to monitor and collect network traffic data in real time; The equipment used by the comprehensive assessment and adjustment module includes a server, which is used to store historical traffic data, run monitoring software and algorithms, and perform security policy adjustments; The devices used by the security execution module include security devices, including firewalls, intrusion detection systems, and intrusion prevention systems, which are used to implement hardware support for network security policies.

[0006] Optionally, the calculation formula of the monitoring and evaluation unit for flow anomaly degree is as follows: ; in: XL is the abnormal flow assessment value; DL is the current traffic rate; PL is the average flow threshold, and PL is used to determine the flow level that generates traffic; DF is the current flow peak value, and DF reflects the instantaneous change of flow; LF is the average flow peak threshold, which is used to determine the abnormality of the flow peak; (DF-LF / LF) 2 The difference between the current flow peak value DF and the average flow peak threshold LF is magnified to highlight the abnormal changes in the flow peak value.

[0007] Optionally, based on the abnormal traffic evaluation value XL, a monitoring and collection module is used to extract the abnormal traffic evaluation value XL reflecting network security and stability in the previous n time periods. The specific calculation formula is as follows: XL avg =(XL1+XL2+XL3+……+XL3) / n; XL avg Evaluate the average value for n abnormal flows; n is the total number of extractions; XL1+XL2+XL3+......+XL3 calculates the sum of abnormal traffic assessment values ​​XL reflecting network security and stability in n time periods.

[0008] Optionally, the calculation formula for comprehensively evaluating the current network security risk unit is as follows: FX=FX prev × (1-S) + (XL / 100) a ×S; in: FX is the risk assessment value; FX prev is the risk assessment value of the previous period; a is a weight factor, which is used to adjust the influence of the abnormal flow assessment value XL in the risk assessment. The larger a is, the greater the influence of the abnormal flow assessment value XL on the risk assessment value FX is. S is the attenuation factor, which reflects the impact of historical risk assessment values ​​on current assessment values.

[0009] Optionally, based on the abnormal flow evaluation value XL and the n abnormal flow evaluation average values ​​XL avg , judge the current network status and analyze and adjust the attenuation factor S as follows: S1. If the abnormal flow evaluation value XL and the average value XL of n abnormal flow evaluations avg If the difference between them is small, it means that when the network status is relatively stable, the historical data has a high reference value for the current evaluation, and when the attenuation factor S is increased; S2. If the abnormal flow evaluation value XL and the average value XL of n abnormal flow evaluations avg If the difference between them is large, it means that when the network status changes rapidly, the reference value of historical data for current evaluation is low, and the attenuation factor S should be reduced.

[0010] Optionally, the calculation formula of the security policy adjustment unit is as follows: ; in: AC is the security policy adjustment factor; AC prev Security policy adjustment factor for the previous period; AQ is the preset safety threshold; T is the adjustment sensitivity, and T indicates the sensitivity of the security policy adjustment factor AC to change.

[0011] Optionally, based on the security policy adjustment factor AC and the security policy adjustment factor AC of the previous period prev The adjustment steps are as follows: S1, if AC <AC prev , it indicates that strict security policies need to be adopted, including limiting traffic, increasing encryption strength, and enabling higher-level firewall rules; S2, if AC>AC prev , it indicates that the current network security situation is good and the security policy should be maintained and relaxed.

[0012] Optionally, if the security policy adjustment factor AC indicates that the current network security is good, the abnormal traffic evaluation value XL of this algorithm will be brought into the average value XL of the abnormal traffic evaluations of n times in the next period.avg Calculation of If the security policy adjustment factor AC indicates that a strict security policy needs to be adopted, the input value of the current traffic rate DL in the next round will be reduced.

[0013] Compared with the prior art, the present invention has the following beneficial effects: 1. The present invention introduces the current flow peak value DF and the average flow peak threshold LF, and combines the current flow rate DL and the average flow threshold PL, so that the flow abnormality monitoring and evaluation unit can more comprehensively evaluate the abnormality of the flow. This comprehensive evaluation not only takes into account the average level of the flow, but also takes into account the instantaneous changes of the flow, thereby improving the accuracy and reliability of the evaluation.

[0014] 2. The present invention comprehensively evaluates the current network security risk unit by combining the risk assessment value FX of the previous period prev And the current abnormal traffic assessment value XL, and the introduction of attenuation factor S and weight factor a, to achieve dynamic adjustment of risk assessment. This dynamic adjustment mechanism can flexibly adjust the risk assessment value according to the real-time changes of the network environment, thereby more accurately reflecting the actual situation of network security.

[0015] 3. The security policy adjustment unit of the present invention introduces the security policy adjustment factor AC of the previous period prev , combined with the current risk assessment value FX, the preset security threshold AQ and the adjustment sensitivity T, the automatic adjustment of the security policy is realized. This flexible policy adjustment mechanism can quickly respond to changes in network security, thereby improving the security and stability of the network.

[0016] 4. By adjusting the weight factor a and adjusting the sensitivity T, the present invention can more flexibly control the influence of the abnormal flow assessment value XL and the risk assessment value FX in the monitoring process, thereby improving the sensitivity of the monitoring system, which enables the monitoring system to detect potential security threats more timely and accurately, and take corresponding countermeasures. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 This is a method flow chart of the computer network information security monitoring method; Figure 2 It is a structural schematic diagram of the comprehensive evaluation and adjustment module of the present invention; Figure 3 This is a schematic diagram of the overall feedback loop of the computer network information security monitoring method. DETAILED DESCRIPTION

[0018] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0019] Regarding this computer network information security monitoring method, it is different from traditional monitoring methods. Traditional monitoring methods often rely on a single traffic rate threshold to determine whether the network is attacked by abnormal traffic. However, with the continuous evolution and complexity of network attack methods, it is difficult to comprehensively and accurately evaluate the abnormality and risk of network security by relying solely on traffic rate. This algorithm unit achieves the beneficial effects and optimization innovations of comprehensive evaluation, dynamic risk assessment, flexible strategy adjustment and improved sensitivity. These optimizations and innovations not only solve the problems and shortcomings of the existing technology, but also improve the accuracy and reliability of the monitoring system, providing more comprehensive and effective protection for computer network information security.

[0020] For examples, see Figures 1 to 3 This implementation provides a computer network information security monitoring method, and the specific implementation steps are as follows: Step 1: Use the monitoring and collection module to monitor and collect network traffic data in real time, and extract the historical network traffic data; Step 2: Use the comprehensive assessment and adjustment module to determine the abnormality of the current traffic, assess the overall risk level of network security, adjust the network security strategy, and generate a strategy adjustment report; Step 3: Based on the policy adjustment report, the adjusted network security policy is executed by using the security execution module; Step 4: Use the monitoring and collection module to continuously monitor network traffic; The comprehensive assessment and adjustment module includes a monitoring and assessment unit for the degree of traffic anomaly, a comprehensive assessment unit for the current network security risk, and a security policy adjustment unit; The equipment used by the monitoring and collection module includes network traffic monitoring equipment, such as network traffic analyzers, network probes, etc., which are used to collect network traffic data in real time. Network traffic analyzers and network probes are used to monitor and collect network traffic data in real time. The equipment used by the comprehensive assessment and adjustment module includes a server, which is used to store historical traffic data, run monitoring software and algorithms, and perform security policy adjustments; The devices used by the security execution module include security devices, including firewalls, intrusion detection systems, and intrusion prevention systems, which are used to implement hardware support for network security policies.

[0021] In this embodiment, the system performs its respective functions in the network information security monitoring system through the mutual cooperation of three algorithm units and the combination of the three operation results of XL, FX and AC, and jointly realizes the comprehensive assessment, risk quantification and policy adjustment of network security. XL is the abnormal traffic assessment value. This quantification not only considers the average level of traffic, but also considers the instantaneous change of traffic, so as to more comprehensively assess the abnormality of traffic. FX is the risk assessment value, which can flexibly adjust the contribution of the abnormal traffic assessment value XL in the risk assessment, so that the risk assessment result is more in line with the actual situation. AC is the security policy adjustment factor, which reflects the degree of deviation between the current network security status and the security threshold, and the degree of influence of this deviation on the adjustment of security policy, so that the monitoring system can automatically adjust the security policy to cope with the ever-changing network security threats, and the calculation results of AC can also affect the calculations fed back to XL and FX, so that the three algorithms of this system have high correlation and entanglement, and the three algorithm units are interrelated and supportive of each other, together forming an efficient and flexible network security monitoring and response mechanism.

[0022] See also Figures 1 to 3 , the calculation formula for monitoring and evaluating the flow anomaly degree unit is as follows: ; in: XL is the abnormal flow assessment value; DL is the current traffic rate; PL is the average flow threshold, and PL is used to determine the flow level that generates traffic; DF is the current flow peak value, and DF reflects the instantaneous change of flow; LF is the average flow peak threshold, which is used to determine the abnormality of the flow peak; (DF-LF / LF) 2 The difference between the current flow peak value DF and the average flow peak threshold LF is magnified to highlight the abnormal changes in the flow peak value.

[0023] In this embodiment: First, in this algorithm unit, " "This part calculates the square of the difference between the current traffic rate DL and the average traffic threshold PL, and divides it by the square of the average traffic threshold PL for normalization. Its purpose is to quantify the degree to which the current traffic rate DL deviates from the average traffic threshold PL, that is, the degree of traffic abnormality. The square operation amplifies the deviation value, making the abnormal value more significant; This algorithm unit not only focuses on the average level of traffic, that is, the comparison between the current traffic rate DL and the average traffic threshold PL, but also introduces the concept of the current traffic peak DF and the average traffic peak threshold LF, thereby realizing a multi-dimensional consideration of traffic characteristics. This consideration method enables the monitoring system to more comprehensively capture the abnormal characteristics of network traffic, including those sudden high-traffic attacks that may be hidden below the average level. By comparing the current traffic rate DL and the average traffic threshold PL and the current traffic peak DF and the average traffic peak threshold LF, the monitoring system can accurately identify abnormal traffic patterns in the network. Both continuous high traffic and sudden traffic peaks can be effectively captured and analyzed. Since this algorithm unit considers both the average level and instantaneous changes of traffic, the monitoring and evaluation unit of traffic anomaly degree can capture small abnormal changes of traffic. This high sensitivity enables the monitoring system to issue early warnings at the beginning of an attack, buying valuable time for subsequent defense measures. By early warning of potential security threats, the monitoring system can help network administrators take timely measures to prevent the attack from further spreading and worsening. The calculated abnormal traffic assessment value XL enables the monitoring system to quantify the degree of traffic abnormality, providing an objective basis for subsequent risk assessment and security policy adjustment. This quantification method makes the decision-making process more scientific and reasonable. As the abnormal traffic assessment value XL changes, the monitoring system can dynamically adjust its monitoring strategy and security strategy to adapt to the ever-changing network security environment.

[0024] See also Figures 1 to 3 , the calculation formula for comprehensively evaluating the current network security risk unit is as follows: FX=FX prev × (1-S) + (XL / 100) a ×S; in: FX is the risk assessment value; FX prev is the risk assessment value of the previous period; a is a weight factor, which is used to adjust the influence of the abnormal flow assessment value XL in the risk assessment. The larger a is, the greater the influence of the abnormal flow assessment value XL on the risk assessment value FX is. S is the attenuation factor, which reflects the impact of historical risk assessment values ​​on current assessment values.

[0025] In this embodiment, first, the calculation of the part "(1-S)" is the complement of the attenuation factor S, which is used to calculate the risk assessment value FX of the previous period. prevThe weight in the risk assessment value FX, when the attenuation factor S increases, "(1-S)" decreases, indicating that the impact of the historical value on the current value decreases. Conversely, when the attenuation factor S decreases, "(1-S)" increases, indicating that the impact of the historical value on the current value increases. This algorithm unit combines the risk assessment value of the previous period FX prev The current abnormal traffic assessment value XL is dynamically calculated to obtain the current risk assessment value FX. This calculation method enables the risk assessment result to reflect the actual situation of network security in real time. By introducing the attenuation factor S and the weight factor a, the comprehensive assessment of the current network security risk unit can more accurately assess the risk level of network security. The introduction of the attenuation factor S gradually weakens the impact of historical information on the current assessment value, while the adjustment of the weight factor a can flexibly control the contribution of the abnormal traffic assessment value XL in the risk assessment according to the actual situation. By adjusting the weight factor a, the monitoring system can customize the assessment of network security risk levels according to different network environments and security requirements. This customized assessment method makes the monitoring system more flexible and adaptable. According to the risk assessment results, the monitoring system can optimize its monitoring strategy and security strategy to better deal with network security threats. The introduction of the attenuation factor D enables the monitoring system to comprehensively consider historical information and current information when assessing network security risks. This comprehensive consideration makes the assessment results more comprehensive and accurate. By balancing the impact of historical and current information, the monitoring system can avoid bias and misjudgment caused by over-reliance on historical or current information.

[0026] See also Figures 1 to 3 Based on the abnormal traffic evaluation value XL, the monitoring and collection module is used to extract the abnormal traffic evaluation value XL reflecting the security and stability of the network in the previous n time periods. The specific calculation formula is as follows: XL avg =(XL1+XL2+XL3+……+XL3) / n; XL avg Evaluate the average value for n abnormal flows; n is the total number of extractions; XL1+XL2+XL3+......+XL3 calculates the sum of the abnormal traffic assessment values ​​XL reflecting network security and stability in n time periods; Based on the abnormal flow rate evaluation value XL and the n abnormal flow rate evaluation average values ​​XL avg , judge the current network status and analyze and adjust the attenuation factor S as follows: S1. If the abnormal flow evaluation value XL and the average value XL of n abnormal flow evaluations avgIf the difference between them is small, it means that when the network status is relatively stable, the historical data has a high reference value for the current evaluation, and when the attenuation factor S is increased; S2. If the abnormal flow evaluation value XL and the average value XL of n abnormal flow evaluations avg If the difference between them is large, it means that when the network status changes rapidly, the reference value of historical data for current evaluation is low, and the attenuation factor S should be reduced.

[0027] In this embodiment, by comprehensively considering the average value of the abnormal traffic evaluation value XL reflecting the network security and stability in n time periods, the network security status can be evaluated more comprehensively. This method reduces the misjudgment that may be caused by a single indicator, improves the accuracy and reliability of the judgment, and because the average value XL of the abnormal traffic evaluation n time periods reflects the network security and stability, the network security status can be evaluated more comprehensively. avg It is calculated based on the current good network security situation, so it has a certain degree of dynamic adaptability. As the network environment and business needs change, the average value of n abnormal traffic evaluations XL avg The judgment criteria will be adjusted accordingly to ensure that they are always consistent with the actual situation. When n abnormal traffic values ​​are evaluated as average value XL avg When the deviation from the average value reaches a certain level, the early warning mechanism can be triggered. avg It is calculated based on data in good condition, so this early warning mechanism is more sensitive and accurate, and can detect potential security threats in time; Based on the abnormal flow evaluation value XL and the n abnormal flow evaluation average value XL avg The deviation between them can be used to adjust the network security strategy more finely, and the average value XL can be evaluated by reasonably setting n abnormal traffic. avg The judgment criteria can make more effective use of network security resources. When the network security situation is good, the investment in security resources can be appropriately reduced. When the network security situation deteriorates, the investment in security resources can be quickly increased to deal with risks. In addition, through timely early warning and fine-grained policy adjustments, it can ensure that the network maintains a good operating state in most cases, which can not only reduce service interruptions and performance degradation caused by network security issues, but also improve the overall user experience.

[0028] See also Figures 1 to 3 , the calculation formula of the security policy adjustment unit is as follows: ; in: AC is the security policy adjustment factor; AC prev Security policy adjustment factor for the previous period; AQ is the preset safety threshold; T is the adjustment sensitivity, and T indicates the sensitivity of the security policy adjustment factor AC to change.

[0029] In this embodiment, the value of the security policy adjustment factor AC in this algorithm unit directly reflects the deviation between the current network security status and the security threshold and the degree of influence of this deviation on the security policy adjustment. Through the value of the security policy adjustment factor AC, the monitoring system can clearly know whether the security policy needs to be adjusted and the direction and strength of the adjustment. Based on the value of the security policy adjustment factor AC, the monitoring system can automatically adjust the security policy, and can achieve rapid response and effective defense without manual intervention or with little manual intervention. The denominator FX+AQ+T design in the security policy adjustment unit makes the change of the security policy adjustment factor AC more stable when the risk assessment value FX is close to the preset security threshold AQ. This design avoids the problem of frequent security policy adjustments caused by small changes in the risk assessment value FX, thereby improving the stability and reliability of the system. The smooth adjustment process reduces the inconvenience and trouble caused to users by frequent adjustments, and improves user experience and satisfaction; When it is detected that the network security situation has deteriorated, that is, the risk assessment value FX increases, the security policy adjustment factor AC will decrease rapidly, thereby triggering a stricter security policy adjustment. This rapid response mechanism enables the monitoring system to respond to security threats in the shortest time and take effective measures to defend against them. Through rapid response and effective defense, the monitoring system can minimize the losses and impacts of network security incidents on the network and users.

[0030] See also Figures 1 to 3 , based on the security policy adjustment factor AC and the security policy adjustment factor AC of the previous period prev The adjustment steps are as follows: S1, if AC <AC prev , it indicates that strict security policies need to be adopted, including limiting traffic, increasing encryption strength, and enabling higher-level firewall rules; S2, if AC>AC prev , it indicates that the current network security situation is good and the security policy should be maintained and relaxed; If the security policy adjustment factor AC indicates that the current network security is good, the abnormal traffic evaluation value XL of this algorithm will be brought into the average value XL of the abnormal traffic evaluation of the next period of time avg Calculation of If the security policy adjustment factor AC indicates that a strict security policy needs to be adopted, the input value of the current traffic rate DL in the next round will be reduced.

[0031] In this embodiment, the algorithm unit is based on the security policy adjustment unit and guides the adjustment of the security policy through the security policy adjustment factor AC. These adjustment measures will directly affect the traffic pattern and abnormal traffic situation in the network. Therefore, after the security policy is adjusted, the current traffic rate DL in the network will change and thus affect the calculation of the abnormal traffic evaluation value XL in the monitoring and evaluation traffic abnormality unit. This dynamic adjustment process forms a closed-loop feedback mechanism that enables the monitoring system to continuously optimize its monitoring effect. Through the closed-loop feedback mechanism, the monitoring system can continuously adjust its monitoring strategy and security strategy according to changes in the network security situation to achieve continuous improvement and optimization. Through the closed-loop feedback mechanism, the monitoring system can more accurately monitor abnormal traffic patterns in the network and promptly detect potential security threats. This precise monitoring capability improves the effectiveness and reliability of the monitoring system. After discovering potential security threats, the monitoring system can quickly adjust its security strategy and take effective measures to defend against them, thereby ensuring the security and stability of the network. Since the network environment is constantly changing, new security threats and attack methods emerge in an endless stream. Through the cyclical impact of the security policy adjustment unit on the monitoring and evaluation unit of the degree of traffic anomalies, the monitoring system can flexibly respond to these changes and adjust its monitoring strategy and security strategy according to actual conditions to ensure the continuity and effectiveness of network security. By constantly adapting to changes in the network environment, the monitoring system can enhance its resilience and resistance to attacks, thereby better protecting the network and users from security threats.

[0032] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations can be made to the embodiments without departing from the principles and spirit of the present invention, and the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A computer network information security monitoring method, characterized in that: The specific implementation steps are as follows: Step 1: Use the monitoring and collection module to monitor and collect network traffic data in real time, and extract the historical network traffic data; Step 2: Use the comprehensive assessment and adjustment module to determine the abnormality of the current traffic, assess the overall risk level of network security, adjust the network security strategy, and generate a strategy adjustment report; Step 3: Based on the policy adjustment report, the adjusted network security policy is executed by using the security execution module; Step 4: Use the monitoring and collection module to continuously monitor network traffic; The comprehensive assessment and adjustment module includes a unit for monitoring and assessing the degree of traffic anomaly, a unit for comprehensively assessing the current network security risk, and a security policy adjustment unit.

2. A computer network information security monitoring method according to claim 1, characterized in that: The monitoring and collection module may include network traffic monitoring equipment, such as network traffic analyzers, network probes, etc., which are used to collect network traffic data in real time, including network traffic analyzers and network probes, which are used to monitor and collect network traffic data in real time; The equipment used by the comprehensive assessment and adjustment module includes a server, which is used to store historical traffic data, run monitoring software and algorithms, and perform security policy adjustments; The devices used by the security execution module include security devices, including firewalls, intrusion detection systems, and intrusion prevention systems, which are used to implement hardware support for network security policies.

3. A computer network information security monitoring method according to claim 2, characterized in that: The calculation formula of the monitoring and evaluation flow anomaly degree unit is as follows: ； in: XL is the abnormal flow assessment value; DL is the current traffic rate; PL is the average flow threshold, and PL is used to determine the flow level that generates traffic; DF is the current flow peak value, and DF reflects the instantaneous change of flow; LF is the average flow peak threshold, which is used to determine the abnormality of the flow peak; The difference between the current flow peak value DF and the average flow peak threshold LF is magnified to highlight the abnormal changes in the flow peak value.

4. A computer network information security monitoring method according to claim 2, characterized in that: Based on the abnormal traffic evaluation value XL, the monitoring and collection module is used to extract the abnormal traffic evaluation value XL reflecting the security and stability of the network in the previous n time periods. The specific calculation formula is as follows: XL avg =(XL1+XL2+XL3+......+XL3) / n; XL avg Evaluate the average value for n abnormal flows; n is the total number of extractions; XL1+XL2+XL3+......+XL3 calculates the sum of abnormal traffic assessment values ​​XL reflecting network security and stability in n time periods.

5. A computer network information security monitoring method according to claim 4, characterized in that: The calculation formula for comprehensively evaluating the current network security risk unit is as follows: FX=FX prev ×(1-S)+(XL / 100) a ×S; in: FX is the risk assessment value; FX prev is the risk assessment value of the previous period; a is a weight factor, which is used to adjust the influence of the abnormal flow assessment value XL in the risk assessment. The larger a is, the greater the influence of the abnormal flow assessment value XL on the risk assessment value FX is. S is the attenuation factor, which reflects the impact of historical risk assessment values ​​on current assessment values.

6. A computer network information security monitoring method according to claim 5, characterized in that: Based on the abnormal flow rate evaluation value XL and the n abnormal flow rate evaluation average values ​​XL avg , judge the current network status and analyze and adjust the attenuation factor S as follows: If the abnormal flow evaluation value XL and the average value XL of n abnormal flow evaluations avg If the difference between them is small, it means that when the network status is relatively stable, the historical data has a high reference value for the current evaluation, and the attenuation factor S is increased; If the abnormal flow evaluation value XL and the average value XL of n abnormal flow evaluations avg If the difference between them is large, it means that when the network condition changes rapidly, the reference value of historical data for current evaluation is low, and the attenuation factor S should be reduced.

7. A computer network information security monitoring method according to claim 6, characterized in that: The calculation formula of the security policy adjustment unit is as follows: ； in: AC is the security policy adjustment factor; AC prev Security policy adjustment factor for the previous period; AQ is the preset safety threshold; T is the adjustment sensitivity, and T indicates the sensitivity of the security policy adjustment factor AC to change.

8. A computer network information security monitoring method according to claim 7, characterized in that: Based on the security policy adjustment factor AC and the security policy adjustment factor AC of the previous period prev The adjustment steps are as follows: If AC <AC prev , it indicates that strict security policies need to be adopted, including limiting traffic, increasing encryption strength, and enabling higher-level firewall rules; If AC>AC prev , it indicates that the current network security situation is good and the security policy should be maintained and relaxed.

9. A computer network information security monitoring method according to claim 8, characterized in that: If the security policy adjustment factor AC indicates that the current network security status is good, the abnormal traffic evaluation value XL will be brought into the average value XL of the abnormal traffic evaluations in the next period of time. avg Calculation of If the security policy adjustment factor AC indicates that a strict security policy needs to be adopted, the input value of the current traffic rate DL in the next round will be reduced.

Images