Network security monitoring system and method

Abstract

The invention discloses a network security monitoring system and method, belongs to the technical field of network security, and aims to solve the technical problem of how to carry out network security detection on an online internet financial website. Comprising a network threat discovery subsystem which is used for analyzing a network attack sample of the Internet financial platform, extracting an event rule, carrying out routing inspection on the Internet financial platform, discovering a network threat event aiming at the Internet financial platform based on the event rule and a routing inspection result, and recording the network threat event; the website vulnerability scanning subsystem is used for carrying out asset detection and vulnerability scanning on the Internet financial website to find security vulnerabilities; and the mobile APP security detection subsystem is used for performing security detection and risk analysis on the Internet financial mobile application to discover security vulnerabilities and transaction security risks.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a network security monitoring system and method. Background Art

[0002] Internet financial websites have been launched one after another. If the business logic of the backend of the online Internet financial websites is immature or imperfect, it may lead to logical loopholes that affect business security. Since the cost of setting up a security team is very high, most Internet financial companies do not have their own security team, and the developers have limited security knowledge, which directly leads to the inevitable occurrence of security problems of varying degrees when developing websites and business systems.

[0003] How to conduct network security testing on online Internet financial websites is a technical problem that needs to be solved. Summary of the invention

[0004] The technical task of the present invention is to provide a network security monitoring system and method to solve the technical problem of how to perform network security detection on online Internet financial websites in view of the above shortcomings.

[0005] In a first aspect, the present invention provides a network security monitoring system, including a network threat discovery subsystem, a website vulnerability scanning subsystem, and a mobile APP security detection subsystem;

[0006] The network threat discovery subsystem is used to analyze samples of network attacks on Internet financial platforms, extract event rules, and inspect Internet financial platforms, discover network threat events targeting Internet financial platforms based on event rules and inspection results, and record network threat events;

[0007] The website vulnerability scanning subsystem is used to perform asset detection and vulnerability scanning on Internet financial websites to discover security vulnerabilities;

[0008] The mobile APP security detection subsystem is used for security detection and risk analysis of Internet financial mobile applications to discover security vulnerabilities and transaction security risks.

[0009] Preferably, the network threat discovery subsystem includes a website security active monitoring module, a malicious code analysis module, and a flow anomaly detection and discovery module;

[0010] The website security active monitoring module is used to perform the following: construct an Internet finance vulnerability library, analyze source code features and file application identification, correspond the identified applications to the Internet finance vulnerability library, and perform vulnerability discovery; construct an Internet finance network threat knowledge base, actively inspect the Internet finance platform, detect ongoing and possible attacks and threats through feature comparison and sandbox identification technology, perform network threat discovery, treat the discovered vulnerabilities and network threats as network threat events, and record network threat events;

[0011] The malicious code analysis module is used to perform the following: deploy virus monitoring probes, capture Internet finance-related or suspected virus files as samples through the virus monitoring probes, and analyze the samples, including comparison scanning, static analysis, behavior analysis, and association analysis, comprehensively determine the code information of the malicious code based on the analysis results, the code information includes the family, name, behavior, and threat of the code, and obtain the key data of the malicious code based on the code information of the malicious code, the key data includes the spread of the epidemic, threat level, behavior characteristics, and event association, and record the code information and key data of the malicious code;

[0012] The flow anomaly detection and discovery module is used to perform the following: use a baseline self-learning method to perform anomaly detection on the network environment where the Internet financial platform aggregates traffic data, discover large-scale network attacks and threat events in real time, and record large-scale network attacks and threat events.

[0013] As a preference, for the website vulnerability scanning subsystem, asset detection covers the web, server, database and port of the Internet financial platform, and vulnerability scanning covers XSS cross-site scripting, SQL injection, cryptographic algorithm strength, malicious external links, arbitrary code execution, sensitive information leakage, design flaws, weak passwords and deserialization.

[0014] Preferably, the mobile APP security detection subsystem is configured with a mobile device resource pool, a mobile application software security business evaluation service platform and a mobile application software evaluation business application;

[0015] The mobile device resource pool is used to perform the following: establish a virtual operating environment for the operating system, provide an environment for mobile application evaluation, and provide support for dynamic operation detection of mobile applications;

[0016] The mobile application software evaluation business service platform is compatible with various mobile smart devices downwardly, and provides various testing services for business applications upwardly through a unified service interface, wherein the mobile application software evaluation business service platform is configured with multiple components, namely task distribution, overall task scheduling, static evaluation scheduling, dynamic evaluation scheduling, virus detection scheduling, dynamic evaluation engine, static evaluation engine and virus detection engine, providing various testing services for business applications based on multiple components;

[0017] The mobile application software evaluation business application is based on the mobile application software evaluation service platform and is used to provide three categories of mobile application software security testing services, including risk assessment, virus detection, and security vulnerability scanning.

[0018] In a second aspect, the present invention provides a network security monitoring method, characterized in that it is used to implement network security monitoring of an Internet financial platform through a network security monitoring system as described in any one of the first aspects, comprising the following steps:

[0019] Network threat discovery: Analyze samples of network attacks on Internet financial platforms, extract event rules, and conduct inspections on Internet financial platforms. Based on event rules and inspection results, network threat events targeting Internet financial platforms are discovered and recorded.

[0020] Website vulnerability scanning: conduct asset detection and vulnerability scanning on Internet financial websites to discover security vulnerabilities;

[0021] Mobile APP security testing: Conduct security testing and risk analysis on Internet financial mobile applications to identify security vulnerabilities and transaction security risks.

[0022] Preferably, the network threat discovery comprises the following steps:

[0023] Active monitoring of website security: Build an Internet finance vulnerability library, analyze source code features and file application identification, match the identified applications to the Internet finance vulnerability library, and discover vulnerabilities; build an Internet finance network threat knowledge base, actively inspect Internet finance platforms, detect ongoing and possible attacks and threats through feature comparison and sandbox identification technology, discover network threats, treat discovered vulnerabilities and network threats as network threat events, and record network threat events;

[0024] Malicious code analysis: deploy virus monitoring probes, capture Internet finance-related or suspected virus files as samples through virus monitoring probes, and analyze the samples, including comparison scanning, static analysis, behavior analysis, and correlation analysis. Based on the analysis results, comprehensively determine the code information of the malicious code, which includes the family, name, behavior, and threat of the code. Based on the code information of the malicious code, obtain the key data of the malicious code, which includes the spread of the epidemic, threat level, behavior characteristics, and event correlation, and record the code information and key data of the malicious code;

[0025] Flow anomaly detection and discovery: A baseline self-learning method is used to detect anomalies in the network environment where Internet financial platforms aggregate traffic data, discover large-scale network attacks and threat events in real time, and record large-scale network attacks and threat events.

[0026] As a priority, for website vulnerability scanning, asset detection covers the web, server, database and port of the Internet financial platform, and vulnerability scanning covers XSS cross-site scripting, SQL injection, password algorithm strength, malicious external links, arbitrary code execution, sensitive information leakage, design defects, weak passwords and deserialization.

[0027] Preferably, the mobile APP security detection includes the following operations:

[0028] Mobile device support services: Establish a virtual operating environment for the operating system, provide an environment for mobile application evaluation, and provide support for dynamic operation detection of mobile applications;

[0029] Mobile application software evaluation business service: compatible with various mobile smart devices, and provides various testing services for business applications through a unified service interface. Among them, the following operations are provided through the service interface to provide various testing services: task distribution, overall task scheduling, static evaluation scheduling, dynamic evaluation scheduling, virus detection scheduling, dynamic evaluation, static evaluation and virus detection;

[0030] Mobile application software evaluation business: Provide three categories of mobile application software security testing services, including risk assessment, virus detection, and security vulnerability scanning.

[0031] The network security monitoring system and method of the present invention have the following advantages: it can realize network security monitoring of Internet channel entrances such as websites of financial institutions and mobile APPs within a certain jurisdiction, discover major loopholes and attack incidents such as information leakage and transaction security, effectively prevent the occurrence of security incidents such as fund theft, ensure the safety of user funds, and be able to show users that the platform attaches great importance to security and enhance users' sense of trust. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0033] The present invention is further described below in conjunction with the accompanying drawings.

[0034] Figure 1 It is a structural diagram of A;

[0035] Figure 2 It is a structural diagram of A;

[0036] Figure 3 A is a schematic diagram of the structure.

[0037] In the figure: 1, 2, DETAILED DESCRIPTION

[0038] The present invention is further described below in conjunction with the accompanying drawings and specific embodiments so that those skilled in the art can better understand the present invention and implement it. However, the embodiments are not intended to limit the present invention. In the absence of conflict, the embodiments of the present invention and the technical features in the embodiments may be combined with each other.

[0039] The embodiment of the present invention provides a network security monitoring system method for solving the technical problem of how to perform network security detection on an online Internet financial website.

[0040] Embodiment 1:

[0041] The present invention discloses a network security monitoring system, comprising a network threat discovery subsystem, a website vulnerability scanning subsystem and a mobile APP security detection subsystem.

[0042] The network threat discovery subsystem is used to analyze samples of network attacks on Internet financial platforms, extract event rules, and conduct inspections on Internet financial platforms. Based on event rules and inspection results, network threat events targeting Internet financial platforms are discovered and recorded.

[0043] The network threat discovery subsystem of this embodiment analyzes samples of network attacks on Internet financial platforms based on the characteristics of network security of Internet financial platforms, extracts event rules from the analysis, and inspects Internet financial platforms through active detection methods to discover external attack events and security risks such as DDoS attacks, website phishing, web page tampering, website Trojan horse, web page backdoors, holes, etc.

[0044] As a specific implementation of the network threat discovery subsystem, this subsystem includes a website security active monitoring module, a malicious code analysis module, and a flow anomaly detection and discovery module. The specific business logic and business process are as follows: for Internet financial websites, their website domain names and IP addresses are sent to the network threat discovery subsystem. The network threat discovery subsystem is configured with a network threat knowledge base. Based on this network threat knowledge base, feature comparison and sandbox identification are performed on the traffic corresponding to the Internet financial website and IP, network threat events targeting the Internet financial platform are discovered, and the threat events are recorded.

[0045] As a specific implementation of the website security active detection module, this module is used to perform the following: build an Internet financial vulnerability library, analyze source code features and file application identification, correspond the identified applications to the Internet financial vulnerability library, and discover vulnerabilities; build an Internet financial network threat knowledge base, actively inspect the Internet financial platform, detect ongoing and possible attacks and threats through feature comparison and sandbox identification technology, discover network threats, treat the discovered vulnerabilities and network threats as network threat events, and record network threat events.

[0046] As a specific implementation of the malicious code analysis module, this module is used to perform the following: deploy virus monitoring probes, capture Internet finance-related or suspected virus files as samples through the virus monitoring probes, and analyze the samples, including comparison scanning, static analysis, behavior analysis, and association analysis. Based on the analysis results, the code information of the malicious code is comprehensively determined. The code information includes the family, name, behavior, and threat of the code. Based on the code information of the malicious code, the key data of the malicious code is obtained. The key data includes the spread of the epidemic, threat level, behavior characteristics, and event association, and the code information and key data of the malicious code are recorded.

[0047] As a specific implementation of the flow anomaly detection and discovery module, this module is used to perform the following: use a baseline self-learning method to detect anomalies in the network environment where traffic data of the Internet financial platform is aggregated, discover large-scale network attacks and threat events in real time, and record large-scale network attacks and threat events.

[0048] The website vulnerability scanning subsystem is used to perform asset detection and vulnerability scanning on Internet financial websites to discover security vulnerabilities.

[0049] In this embodiment, for the website vulnerability scanning subsystem, asset detection covers the web, server, database and port of the Internet financial platform, and vulnerability scanning covers XSS cross-site scripting, SQL injection, cryptographic algorithm strength, malicious external links, arbitrary code execution, sensitive information leakage, design defects, weak passwords and deserialization.

[0050] In this embodiment, the website vulnerability scanning subsystem performs asset detection and vulnerability scanning on the Internet financial website to discover security vulnerabilities. Only with asset management can the asset value, security requirements and security impact of each module of the system be further analyzed. Only with a vulnerability scanning function that is comprehensive and can respond quickly to new vulnerabilities can the requirements of comprehensively discovering system internal vulnerabilities be met.

[0051] As the main functional modules of the website vulnerability scanning subsystem, Figure 2 As shown, it includes three functional modules: user login, background system and foreground system. The user login functional module involves the user inputting the account password. Correspondingly, the user login functional module performs vulnerability scanning on the process of the user inputting the account password; the users of the background system involve administrators, and this functional module provides user management and vulnerability management services. The users involved in the foreground system include administrators of ordinary users, and the corresponding services provided by this functional module include site management, task detection, baseline detection, 1-day vulnerabilities and asset / vulnerability statistics.

[0052] The specific business logic and business process of the website vulnerability scanning subsystem are as follows: for Internet financial websites, their website domain names and IP addresses are sent to the website vulnerability scanning subsystem. The vulnerability scanning subsystem integrates multiple scanners and can detect vulnerabilities in Internet financial websites.

[0053] The mobile APP security detection subsystem is used to perform security detection and risk analysis on Internet financial mobile applications to discover security vulnerabilities and transaction security risks.

[0054] In this embodiment, the overall architecture of the mobile APP security detection subsystem is organized from the bottom up from the three levels of IaaS, PaaS, and SaaS. The overall architecture is mainly divided into three parts: mobile device resource pool, mobile application software security business evaluation service platform, and mobile application software evaluation business application.

[0055] The main functional modules included in each layer are as follows: Figure 3As shown, the mobile device resource pool is used to perform the following: establish an operating system virtual operating environment, provide an environment for mobile application evaluation, and provide support for dynamic operation detection of mobile applications; the mobile application software evaluation business service platform is compatible with various types of mobile smart devices downward, and provides various types of testing services for business applications through a unified service interface upward. Among them, the mobile application software evaluation business service platform is configured with multiple components, namely task distribution, overall task scheduling, static evaluation scheduling, dynamic evaluation scheduling, virus detection scheduling, dynamic evaluation engine, static evaluation engine and virus detection engine, which provide various types of testing services for business applications based on multiple components; the mobile application software evaluation business application is based on the mobile application software evaluation service platform and is used to provide three categories of mobile application software security detection services, including risk assessment, virus detection, and security vulnerability scanning.

[0056] In this embodiment, the specific business logic and business process of the mobile APP security detection subsystem are as follows: for Internet financial mobile applications, the downloader APK installation package file (for the Android operating system, if it is other systems such as IOS or Hongmeng, you can choose an adapted installation package file), submit it to the mobile APP security detection subsystem for scanning, and through the Android emulator (for the Android operating system, if it is other systems such as IOS or Hongmeng, you can choose an adapted emulator), virus scanning engine, static analysis engine, dynamic scanning engine, attack simulator, etc. in the subsystem, vulnerabilities and potential risks in the installation package file can be discovered.

[0057] The system of this embodiment can perceive the threats faced by Internet financial platforms, discover network attack incidents in a timely manner, and aggregate, integrate, process and analyze multiple types of network threat data and vulnerable data.

[0058] Embodiment 2:

[0059] The present invention provides a network security monitoring method, which implements network security monitoring of an Internet financial platform through the system disclosed in Example 1. The method includes three steps: network threat discovery, website vulnerability scanning, and mobile APP security detection.

[0060] Step S100 Network threat discovery: Analyze samples of network attacks on Internet financial platforms, extract event rules, and inspect Internet financial platforms. Based on event rules and inspection results, discover network threat events targeting Internet financial platforms and record network threat events.

[0061] The network threat discovery of this embodiment targets the characteristics of the network security of the Internet financial platform, analyzes samples of network attacks on the Internet financial platform, extracts event rules from the analysis, and inspects the Internet financial platform through active detection methods to discover external attack events and security risks such as DDoS attacks, website phishing, web page tampering, website Trojan horse, web page backdoors, holes, etc.

[0062] The network threat discovery in this embodiment is implemented based on the network threat discovery subsystem disclosed in Example 1. As a specific implementation of network threat discovery, the operation includes active website security monitoring, malicious code analysis, and flow anomaly detection and discovery. The specific business logic and business process are as follows: for Internet financial websites, their website domain names and IP addresses are sent to the network threat discovery subsystem. The network threat discovery subsystem is configured with a network threat knowledge base. Based on this network threat knowledge base, feature comparison and sandbox identification are performed on the traffic corresponding to the Internet financial website and the IP, network threat events targeting the Internet financial platform are discovered, and the threat events are recorded.

[0063] As a specific implementation of active website security detection, the following is performed: build an Internet financial vulnerability library, analyze source code features and file application identification, correspond the identified applications to the Internet financial vulnerability library, and discover vulnerabilities; build an Internet financial network threat knowledge base, conduct active inspections of Internet financial platforms, detect ongoing and possible attacks and threats through feature matching and sandbox identification technology, discover network threats, treat discovered vulnerabilities and network threats as network threat events, and record network threat events.

[0064] As a specific implementation of malicious code analysis, the following is performed: deploy virus monitoring probes, capture Internet finance-related or suspected virus files as samples through the virus monitoring probes, and analyze the samples, including comparison scanning, static analysis, behavior analysis, and correlation analysis. Based on the analysis results, the code information of the malicious code is comprehensively determined. The code information includes the family, name, behavior, and threat of the code. Based on the code information of the malicious code, the key data of the malicious code is obtained. The key data includes the spread of the epidemic, threat level, behavior characteristics, and event correlation, and the code information and key data of the malicious code are recorded.

[0065] As a specific implementation of flow anomaly detection and discovery, the following is performed: a baseline self-learning method is used to detect anomalies in the network environment where traffic data of the Internet financial platform is aggregated, large-scale network attacks and threat events are discovered in real time, and large-scale network attacks and threat events are recorded.

[0066] Step S200: Website vulnerability scanning: perform asset detection and vulnerability scanning on Internet financial websites to discover security vulnerabilities.

[0067] In this embodiment, for website vulnerability scanning, asset detection covers the web, server, database and port of the Internet financial platform, and vulnerability scanning covers XSS cross-site scripting, SQL injection, cryptographic algorithm strength, malicious external links, arbitrary code execution, sensitive information leakage, design defects, weak passwords and deserialization.

[0068] In this embodiment, asset detection and vulnerability scanning are performed on Internet financial websites through website vulnerability scanning to discover security vulnerabilities. Only with asset management can the asset value, security requirements and security impact of each module of the system be further analyzed. Only with a vulnerability scanning function that is comprehensive and can respond quickly to new vulnerabilities can the requirements of comprehensively discovering system internal vulnerabilities be met.

[0069] The website vulnerability scanning in this embodiment is implemented based on the website vulnerability scanning subsystem disclosed in Example 1, and provides three functions: user login, background system and foreground system. The user login function involves the user entering the account password, and correspondingly, the user login function performs vulnerability scanning on the process of the user entering the account password; the users of the background system involve administrators, and this function provides user management and vulnerability management services; the users involved in the foreground system include administrators of ordinary users, and the corresponding services provided by this function include site management, task detection, baseline detection, 1-day vulnerabilities and asset / vulnerability statistics.

[0070] The specific business logic and business process of the website vulnerability scanning are as follows: for Internet financial websites, their website domain names and IP addresses are sent to the website vulnerability scanning system. The vulnerability scanning system integrates multiple scanners and can discover vulnerabilities in Internet financial websites.

[0071] Step S300: Mobile APP security detection: Perform security detection and risk analysis on Internet financial mobile applications to discover security vulnerabilities and transaction security risks.

[0072] In this embodiment, mobile APP security detection is implemented based on the mobile APP security detection subsystem disclosed in Example 1. Its overall architecture is organized from bottom to top from three levels: IaaS, PaaS, and SaaS. The overall architecture is mainly divided into three parts: mobile device resource pool, mobile application software security business evaluation service platform, and mobile application software evaluation business application.

[0073] The mobile device resource pool is used to perform the following: establish a virtual operating environment for the operating system, provide an environment for mobile application evaluation, and provide support for dynamic operation detection of mobile applications; the mobile application software evaluation business service platform is compatible with various types of mobile smart devices downward, and provides various types of testing services for business applications through a unified service interface upward. The mobile application software evaluation business service platform is configured with multiple components, namely task distribution, overall task scheduling, static evaluation scheduling, dynamic evaluation scheduling, virus detection scheduling, dynamic evaluation engine, static evaluation engine and virus detection engine, which provide various types of testing services for business applications based on multiple components; the mobile application software evaluation business application is based on the mobile application software evaluation service platform and is used to provide three categories of mobile application software security detection services, including risk assessment, virus detection, and security vulnerability scanning.

[0074] The mobile APP security detection in this embodiment is implemented based on the mobile APP security detection subsystem disclosed in Example 1. The specific business logic and business process are as follows: for Internet financial mobile applications, download the APK installation package file (for the Android operating system, if it is other systems such as IOS or Hongmeng, you can choose an adapted installation package file), submit it to the APP security detection subsystem for scanning, and use the android emulator (for the Android operating system, if it is other systems such as IOS or Hongmeng, you can choose an adapted emulator), virus scanning engine, static analysis engine, dynamic scanning engine, attack simulator, etc. in the mobile APP security detection subsystem to discover vulnerabilities and potential risks in the installation package file.

[0075] The present invention has been shown and described in detail above through the accompanying drawings and preferred embodiments. However, the present invention is not limited to these disclosed embodiments. Based on the above multiple embodiments, those skilled in the art can know that the means in the above different embodiments can be combined to obtain more embodiments of the present invention, and these embodiments are also within the protection scope of the present invention.

Claims

1. A network security monitoring system, characterized in that: Including network threat discovery subsystem, website vulnerability scanning subsystem and mobile APP security detection subsystem; The network threat discovery subsystem is used to analyze samples of network attacks on Internet financial platforms, extract event rules, and inspect Internet financial platforms, discover network threat events targeting Internet financial platforms based on event rules and inspection results, and record network threat events; The website vulnerability scanning subsystem is used to perform asset detection and vulnerability scanning on Internet financial websites to discover security vulnerabilities; The mobile APP security detection subsystem is used for security detection and risk analysis of Internet financial mobile applications to discover security vulnerabilities and transaction security risks.

2. The network security monitoring system according to claim 1, characterized in that: The network threat discovery subsystem includes a website security active monitoring module, a malicious code analysis module, and a flow anomaly detection and discovery module; The website security active monitoring module is used to perform the following: construct an Internet finance vulnerability library, analyze source code features and file application identification, correspond the identified applications to the Internet finance vulnerability library, and perform vulnerability discovery; construct an Internet finance network threat knowledge base, actively inspect the Internet finance platform, detect ongoing and possible attacks and threats through feature comparison and sandbox identification technology, perform network threat discovery, treat the discovered vulnerabilities and network threats as network threat events, and record network threat events; The malicious code analysis module is used to perform the following: deploy virus monitoring probes, capture Internet finance-related or suspected virus files as samples through the virus monitoring probes, and analyze the samples, including comparison scanning, static analysis, behavior analysis, and association analysis, comprehensively determine the code information of the malicious code based on the analysis results, the code information includes the family, name, behavior, and threat of the code, and obtain the key data of the malicious code based on the code information of the malicious code, the key data includes the spread of the epidemic, threat level, behavior characteristics, and event association, and record the code information and key data of the malicious code; The flow anomaly detection and discovery module is used to perform the following: use a baseline self-learning method to perform anomaly detection on the network environment where the Internet financial platform aggregates traffic data, discover large-scale network attacks and threat events in real time, and record large-scale network attacks and threat events.

3. The network security monitoring system according to claim 1, characterized in that: For the website vulnerability scanning subsystem, asset detection covers the web, server, database and port of the Internet financial platform, and vulnerability scanning covers XSS cross-site scripting, SQL injection, password algorithm strength, malicious external links, arbitrary code execution, sensitive information leakage, design defects, weak passwords and deserialization.

4. The network security monitoring system according to claim 1, characterized in that: The mobile APP security detection subsystem is configured with a mobile device resource pool, a mobile application software security business evaluation service platform and a mobile application software evaluation business application; The mobile device resource pool is used to perform the following: establish a virtual operating environment for the operating system, provide an environment for mobile application evaluation, and provide support for dynamic operation detection of mobile applications; The mobile application software evaluation business service platform is compatible with various mobile smart devices downwardly, and provides various testing services for business applications upwardly through a unified service interface, wherein the mobile application software evaluation business service platform is configured with multiple components, namely task distribution, overall task scheduling, static evaluation scheduling, dynamic evaluation scheduling, virus detection scheduling, dynamic evaluation engine, static evaluation engine and virus detection engine, providing various testing services for business applications based on multiple components; The mobile application software evaluation business application is based on the mobile application software evaluation service platform and is used to provide three categories of mobile application software security testing services, including risk assessment, virus detection, and security vulnerability scanning.

5. A network security monitoring method, characterized in that: The method is used to implement network security monitoring of an Internet financial platform through a network security monitoring system as claimed in any one of claims 1 to 4, comprising the following steps: Network threat discovery: Analyze samples of network attacks on Internet financial platforms, extract event rules, and conduct inspections on Internet financial platforms. Based on event rules and inspection results, network threat events targeting Internet financial platforms are discovered and recorded. Website vulnerability scanning: Conduct asset detection and vulnerability scanning on Internet financial websites to discover security vulnerabilities; Mobile APP security testing: Conduct security testing and risk analysis on Internet financial mobile applications to identify security vulnerabilities and transaction security risks.

6. The network security monitoring method according to claim 5, characterized in that: The network threat discovery comprises the following steps: Active monitoring of website security: Build an Internet finance vulnerability library, analyze source code features and file application identification, match the identified applications to the Internet finance vulnerability library, and discover vulnerabilities; build an Internet finance network threat knowledge base, actively inspect Internet finance platforms, detect ongoing and possible attacks and threats through feature comparison and sandbox identification technology, discover network threats, treat discovered vulnerabilities and network threats as network threat events, and record network threat events; Malicious code analysis: deploy virus monitoring probes, capture Internet finance-related or suspected virus files as samples through virus monitoring probes, and analyze the samples, including comparison scanning, static analysis, behavior analysis, and correlation analysis. Based on the analysis results, comprehensively determine the code information of the malicious code, which includes the family, name, behavior, and threat of the code. Based on the code information of the malicious code, obtain the key data of the malicious code, which includes the spread of the epidemic, threat level, behavior characteristics, and event correlation, and record the code information and key data of the malicious code; Flow anomaly detection and discovery: A baseline self-learning method is used to detect anomalies in the network environment where Internet financial platforms aggregate traffic data, discover large-scale network attacks and threat events in real time, and record large-scale network attacks and threat events.

7. The network security monitoring method according to claim 5, characterized in that: For website vulnerability scanning, asset detection covers the web, server, database and port of the Internet financial platform, and vulnerability scanning covers XSS cross-site scripting, SQL injection, password algorithm strength, malicious external links, arbitrary code execution, sensitive information leakage, design defects, weak passwords and deserialization.

8. The network security monitoring method according to claim 5, characterized in that: Mobile APP security testing includes the following operations: Mobile device support services: Establish a virtual operating environment for the operating system, provide an environment for mobile application evaluation, and provide support for dynamic operation detection of mobile applications; Mobile application software evaluation business service: compatible with various mobile smart devices, and provides various testing services for business applications through a unified service interface. Among them, the following operations are provided through the service interface to provide various testing services: task distribution, overall task scheduling, static evaluation scheduling, dynamic evaluation scheduling, virus detection scheduling, dynamic evaluation, static evaluation and virus detection; Mobile application software evaluation business: Provide three categories of mobile application software security testing services, including risk assessment, virus detection, and security vulnerability scanning.

Images