Network security system and security method

Abstract

The invention relates to the technical field of network security, and provides a network security system and a security method.The network security system comprises a network security management system, and the network security management system comprises a network security protection system, a network risk assessment system and a network risk learning system; the network security protection system comprises a physical security module, a logic security module and a management security module, and the network risk assessment system is used for calculating a network access risk coefficient within a period of time. Network security access is controlled from physical, logic and management levels, a mathematical model of the network risk assessment system is established, a network security numerical value is calculated, and deep learning is performed on the network security numerical value through a network risk learning system, so that the calculation speed and accuracy of the network risk assessment system are improved, and the network risk assessment efficiency is improved. Multi-directional network security management and monitoring are realized, and the security coefficient of network access is improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network security system and a security method. Background Art

[0002] With the development of computers and the Internet and the continuous increase in user demand, the scale of computer networks has been expanding, and the systems have become increasingly complex, resulting in an endless stream of network security incidents. Network security system is a new technology that has emerged in response to the needs of network security monitoring.

[0003] In the prior art, when a network security system is used to protect a network, interception, alarm, etc. are generally used. For example, the authorized Chinese patent document publication number CN105359157A discloses a network security system for generating an alarm in response to a security vulnerability detected in a proxy server in a data processing network. However, the current virus update cycle is fast and the means of intrusion are also diverse. It is difficult to ensure network security by relying solely on software interception.

[0004] Therefore, we make improvements to this and propose a network security system and security method. Summary of the invention

[0005] (I) The technical problem to be solved by the present invention is: how to ensure network security in an all-round way, evaluate network risks, improve the safety factor of network access, and further improve the accuracy and speed of risk assessment through sample training.

[0006] (II) Technical solution

[0007] In order to achieve the above-mentioned invention object, the present invention provides a network security system, including a network security management system, wherein the network security management system includes a network security prevention system, a network risk assessment system and a network risk learning system;

[0008] The network security prevention system includes a physical security module, a logical security module and a management security module, which are used to prevent network access security from the physical, logical and management levels. The network risk assessment system is used to calculate the network access risk coefficient over a period of time to obtain a network security value. The network risk learning system is used to obtain multiple network security values ​​for network access risk learning.

[0009] Preferably, the physical security module includes an anti-electromagnetic leakage unit, a computer room safety unit, a power supply safety unit, a line safety unit, an equipment safety unit and a fault-tolerant safety unit, which are used to manage and control electromagnetic leakage, computer room safety, power supply safety, line safety, equipment safety and the fault tolerance of all the above items; the logical security module includes a data backup unit, a data recovery unit, a software security unit, a virus prevention unit, a data encryption unit and an intrusion prevention unit, which are used to prevent network data backup, encryption, recovery and the software used by the system as well as viruses and human intrusions; the management security module includes a security organization unit, a security management unit, a security training unit and an emergency response unit, which are used to manage and control the organization, management, training and emergency response of staff in their daily work.

[0010] Preferably, the network risk assessment system includes a historical data acquisition module, a data normalization processing module, a host risk value calculation module, a network overall risk value calculation module, and a network attack risk value calculation module, which are used to obtain historical data of network security risks over a period of time, simplify the data, and establish three different models to evaluate the network security risk value.

[0011] Preferably, the network risk learning system includes a sample acquisition module, a sample training module and a result output module, which are used to obtain a certain amount of network security data from a database as training samples, perform training and learning on the samples and output the training results.

[0012] A network security method is applied to any one of the network security systems mentioned above, and the process of the network risk assessment system includes the following steps:

[0013] S1. For a certain network system, collect historical data on network system security risks over a period of time;

[0014] S2. Normalize the historical data of network system security risks to speed up the assessment of network system security risks;

[0015] S3. Three network security risk assessment models are established using three calculation methods: host risk value calculation, network overall risk value calculation, and network attack risk value calculation, to obtain network system security risk assessment results of three different models;

[0016] S4. Analyze the network system security risk assessment results of three different models, obtain their weights, and combine the assessment results to obtain the final network security value.

[0017] Preferably, in step S3, the host risk value J host The calculation formula is

[0018]

[0019] Network overall risk value J system The calculation formula is

[0020]

[0021] When the network is attacked by type j, the risk value of the network attack The calculation formula is

[0022]

[0023] Where n i is the number of antibodies detected on host i;

[0024] n ij is the number of antibodies on host i that can detect type j attack;

[0025] α j The danger of a type j attack;

[0026] β i The importance of host i;

[0027] x i is the number of antibodies detected by host i under normal network status.

[0028] Preferably, in step S4, the host risk value J calculated in step S3 is host 、Network overall risk value J system and the risk of network attacks The calculation formula for their safety value J(n) is:

[0029] J(n)=C(n)x(n)+v(n)

[0030] Where C(n) is the observation matrix;

[0031] x(n) is the state vector of the system at discrete time n;

[0032] v(n) is the process noise vector.

[0033] Preferably, the process of the network risk learning system includes the following steps:

[0034] a. Obtain Q network security numerical training samples from the database;

[0035] b. According to the relationship between neurons in the hidden layer and the input layer, a weight matrix model is established to conduct sample training;

[0036] c. Upload the sample training results to the network security management system, perform deep learning, and output the learning results.

[0037] (III) Beneficial effects

[0038] The network security system and security method provided by the present invention have the following beneficial effects:

[0039] By controlling network security access from the physical, logical and management levels, building a mathematical model of the network risk assessment system, calculating the host risk value, the overall network risk value and the network attack risk value, and obtaining the network security value, the network security access process is monitored, and through the network risk learning system, the network security value is deeply learned to improve the speed and accuracy of the network risk assessment system calculation, thus achieving multi-faceted management and monitoring of network security and improving the safety factor of network access. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0041] Figure 1 A schematic diagram of a network security system and a security method provided by the present application;

[0042] Figure 2 A schematic diagram of a network security prevention system for a network security system and a security method provided by the present application;

[0043] Figure 3 A schematic diagram of a network risk assessment system for a network security system and security method provided in this application;

[0044] Figure 4 A schematic diagram of a network risk learning system for a network security system and a security method provided by this application;

[0045] Figure 5 A schematic diagram of a network risk assessment process for a network security system and a security method provided in this application;

[0046] Figure 6 A schematic diagram of a network risk learning process for a network security system and security method provided in this application. DETAILED DESCRIPTION

[0047] The specific implementation of the present invention is further described in detail below in conjunction with the accompanying drawings and examples of the specification. The following examples are only used to illustrate the present invention, but cannot be used to limit the scope of the present invention.

[0048] like Figure 1-Figure 6 As shown, this embodiment proposes a network security system, including a network security management system, wherein the network security management system includes a network security prevention system, a network risk assessment system, and a network risk learning system;

[0049] The network security prevention system includes a physical security module, a logical security module and a management security module, which are used to prevent network access security from the physical, logical and management levels. The network risk assessment system is used to calculate the network access risk coefficient over a period of time to obtain a network security value. The network risk learning system is used to obtain multiple network security values ​​for network access risk learning.

[0050] In this embodiment, the physical security module includes an anti-electromagnetic leakage unit, a computer room safety unit, a power supply safety unit, a line safety unit, an equipment safety unit and a fault-tolerant safety unit, which are used to manage and control electromagnetic leakage, computer room safety, power supply safety, line safety, equipment safety and the fault tolerance of all the above items. The logical security module includes a data backup unit, a data recovery unit, a software security unit, a virus prevention unit, a data encryption unit and an intrusion prevention unit, which are used to prevent network data backup, encryption, recovery and the software used by the system as well as viruses and human intrusions. The management security module includes a security organization unit, a security management unit, a security training unit and an emergency response unit, which are used to manage and control the organization, management, training and emergency response of staff in their daily work.

[0051] In this embodiment, the network risk assessment system includes a historical data acquisition module, a data normalization processing module, a host risk value calculation module, a network overall risk value calculation module, and a network attack risk value calculation module, which are used to obtain historical data of network security risks over a period of time, simplify the data, and establish three different models to evaluate the network security risk value.

[0052] In this embodiment, the network risk learning system includes a sample acquisition module, a sample training module and a result output module, which are used to obtain a certain amount of network security data from a database as training samples, train and learn the samples, and output the training results.

[0053] A network security method is applied to any one of the network security systems mentioned above, and the process of the network risk assessment system includes the following steps:

[0054] S1. For a certain network system, collect historical data on network system security risks over a period of time;

[0055] S2. Normalize the historical data of network system security risks to speed up the assessment of network system security risks;

[0056] S3. Three network security risk assessment models are established using three calculation methods: host risk value calculation, network overall risk value calculation, and network attack risk value calculation, to obtain network system security risk assessment results of three different models;

[0057] S4. Analyze the network system security risk assessment results of three different models, obtain their weights, and combine the assessment results to obtain the final network security value.

[0058] In this embodiment, in step S3, the host risk value J host The calculation formula is

[0059]

[0060] Network overall risk value J system The calculation formula is

[0061]

[0062] When the network is attacked by type j, the risk value of the network attack The calculation formula is

[0063]

[0064] Where n i is the number of antibodies detected on host i;

[0065] n ij is the number of antibodies on host i that can detect type j attack;

[0066] α j The danger of a type j attack;

[0067] β i The importance of host i;

[0068] x i is the number of antibodies detected by host i under normal network status.

[0069] In this embodiment, in step S4, the host risk value J calculated in step S3 is host 、Network overall risk value J system and the risk of network attacks The calculation formula for their safety value J(n) is:

[0070] J(n)=C(n)x(n)+v(n)

[0071] Where C(m) is the observation matrix;

[0072] x(m) is the state vector of the system at discrete time n;

[0073] v(n) is the process noise vector.

[0074] In this embodiment, the process of the network risk learning system includes the following steps:

[0075] a. Obtain Q network security numerical training samples from the database;

[0076] b. According to the relationship between neurons in the hidden layer and the input layer, a weight matrix model is established to conduct sample training;

[0077] c. Upload the sample training results to the network security management system, perform deep learning, and output the learning results.

[0078] By controlling network security access from the physical, logical and management levels, building a mathematical model of the network risk assessment system, calculating the host risk value, the overall network risk value and the network attack risk value, and obtaining the network security value, the network security access process is monitored, and through the network risk learning system, the network security value is deeply learned to improve the speed and accuracy of the network risk assessment system calculation, thus achieving multi-faceted management and monitoring of network security and improving the safety factor of network access.

[0079] The above embodiments are only used to illustrate the present invention, but not to limit the present invention. Although the present invention is described in detail with reference to the embodiments, it should be understood by those skilled in the art that various combinations, modifications or equivalent substitutions of the technical solutions of the present invention do not depart from the spirit and scope of the technical solutions of the present invention, and should be included in the scope of the claims of the present invention.

Claims

1. A network security system, including a network security management system, characterized in that: The network security management system includes a network security prevention system, a network risk assessment system and a network risk learning system; The network security prevention system includes a physical security module, a logical security module and a management security module, which are used to prevent network access security from the physical, logical and management levels. The network risk assessment system is used to calculate the network access risk coefficient over a period of time to obtain a network security value. The network risk learning system is used to obtain multiple network security values ​​for network access risk learning.

2. A network security system according to claim 1, characterized in that: The physical security module includes an anti-electromagnetic leakage unit, a computer room safety unit, a power supply safety unit, a line safety unit, an equipment safety unit and a fault-tolerant safety unit, which are used to manage and control electromagnetic leakage, computer room safety, power supply safety, line safety, equipment safety and the fault tolerance of all the above items. The logical security module includes a data backup unit, a data recovery unit, a software security unit, a virus prevention unit, a data encryption unit and an intrusion prevention unit, which are used to prevent network data backup, encryption, recovery and the software used by the system as well as viruses and human intrusions. The management security module includes a security organization unit, a security management unit, a security training unit and an emergency response unit, which are used to manage and control the organization, management, training and emergency response of staff in their daily work.

3. A network security system according to claim 1, characterized in that: The network risk assessment system includes a historical data acquisition module, a data normalization processing module, a host risk value calculation module, a network overall risk value calculation module and a network attack risk value calculation module, which are used to obtain historical network security risk data over a period of time, simplify the data and establish three different models to evaluate the network security risk value.

4. A network security system according to claim 1, characterized in that: The network risk learning system includes a sample acquisition module, a sample training module and a result output module, which are used to obtain a certain amount of network security data from a database as training samples, perform training and learning on the samples and output the training results.

5. A network security method, applied to a network security system according to any one of claims 1 to 4, characterized in that: The process of the network risk assessment system includes the following steps S1. For a certain network system, collect historical data on network system security risks over a period of time; S2. Normalize the historical data of network system security risks to speed up the assessment of network system security risks; S3. Three network security risk assessment models are established using three calculation methods: host risk value calculation, network overall risk value calculation, and network attack risk value calculation, to obtain network system security risk assessment results of three different models; S4. Analyze the network system security risk assessment results of three different models, obtain their weights, and combine the assessment results to obtain the final network security value.

6. A network security system according to claim 5, characterized in that: In step S3, the host risk value J host The calculation formula is Network overall risk value J system The calculation formula is When the network is attacked by type j, the risk value of the network attack The calculation formula is Where n i is the number of antibodies detected on host i; n ij is the number of antibodies on host i that can detect type j attack; α j The danger of a type j attack; β i The importance of host i; x i is the number of antibodies detected by host i under normal network status.

7. A network security method according to claim 5, characterized in that: In step S4, the host risk value J calculated in step S3 is host 、Network overall risk value J system and the risk of network attacks The calculation formula to obtain their safety value J(n) is J(n)=C(n)x(n)+v(n) Where c(n) is the observation matrix; x(n) is the state vector of the system at discrete time n; v(n) is the process noise vector.

8. A network security method according to claim 5, characterized in that: The process of the network risk learning system includes the following steps a. Obtain Q network security numerical training samples from the database; b. According to the relationship between neurons in the hidden layer and the input layer, a weight matrix model is established to conduct sample training; c. Upload the sample training results to the network security management system, perform deep learning, and output the learning results.

Images