Information security tracking system based on network supervision demand

Abstract

The invention belongs to the technical field of network supervision, and particularly relates to an information security tracking system based on network supervision requirements, which comprises a multi-dimensional network monitoring module, an intelligent analysis engine module, a threat early warning response module, a behavior tracking and tracing module and an administrator terminal, according to the invention, through integration of key technologies such as multi-dimensional monitoring, intelligent analysis, threat early warning, behavior tracking and data privacy protection, comprehensive monitoring, intelligent analysis, accurate early warning and efficient tracking of a network environment are realized, and increasingly complex network supervision requirements are met; time period risk rating analysis is performed through the time period risk rating module to determine a high-risk time period and a low-risk time period, so that a network supervision scheme can be reasonably and scientifically formulated subsequently for different time periods, and the network supervision condition of the detection period is analyzed through the supervision analysis output module to enhance network supervision in time; and the working difficulty of an administrator is obviously reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of network supervision, in particular to an information security tracking system based on network supervision requirements. Background Art

[0002] With the rapid development of the Internet, cyberspace has become an important carrier of social and economic activities. However, the diversity and complexity of cyber threats are increasing, bringing huge challenges to network supervision.

[0003] Traditional network security systems often focus on single-dimensional protection, making it difficult to fully respond to complex and ever-changing network threats. They are also unable to reasonably provide feedback on network risks at different times and accurately assess network supervision status over a period of time, making it difficult for administrators to plan and adjust supervision plans, and increasing the difficulty of administrators' work. They are also low in intelligence.

[0004] In view of the above technical defects, a solution is now proposed. Summary of the invention

[0005] The purpose of the present invention is to provide an information security tracking system based on network supervision needs, which solves the problem that the existing technology is difficult to comprehensively cope with complex and changeable network threats, and cannot reasonably feedback the network risks in each time period and accurately evaluate the network supervision status within a period of time, which is not conducive to the administrator's subsequent supervision plan adjustment and has a low degree of intelligence.

[0006] To achieve the above object, the present invention provides the following technical solutions:

[0007] An information security tracking system based on network supervision needs, including a multi-dimensional network monitoring module, an intelligent analysis engine module, a threat warning response module, a behavior tracking and tracing module, and an administrator terminal;

[0008] The multi-dimensional network monitoring module monitors the multi-dimensional information of network traffic, user behavior and system logs in real time, and uses deep packet inspection and traffic analysis technology to comprehensively monitor the network environment, and sends the monitored data to the intelligent analysis engine module;

[0009] The intelligent analysis engine module conducts in-depth mining and analysis of the monitored data, automatically identifies suspicious network activities, and sends the identified suspicious network activities to the threat warning response module and the behavior tracking and tracing module;

[0010] The threat warning response module automatically triggers the warning mechanism based on the results of the intelligent analysis engine module, and sends alerts to the administrator terminal via email, SMS or pop-up windows, and provides emergency response plans and automated disposal processes to deal with corresponding suspicious network activities;

[0011] The behavior tracking and tracing module uses IP tracking and domain name resolution tracking technology to track and trace suspicious network activities, and sends the corresponding tracking and tracing results to the administrator terminal.

[0012] The specific operation process of the behavior tracking and tracing module includes:

[0013] IP tracking: By analyzing network traffic and logs, the IP addresses of suspicious network activities are determined. The geographical location information of the IP addresses is used to preliminarily locate the source of suspicious activities. The changes of IP addresses are further tracked to analyze their attack paths and jump points.

[0014] Domain name resolution tracking: Resolve domain names involved in suspicious network activities, obtain domain name registration information and DNS resolution records, and build the attacker's network architecture and attack path by analyzing the domain name resolution chain and associated domain names, identify and track the registrants and controllers of malicious domain names and the organizations or individuals behind them;

[0015] Multi-dimensional data association: The results of IP tracking and domain name resolution tracking are analyzed in association with other data sources. By mining the associations between different data sources, potential security threats and the true identity of attackers can be discovered.

[0016] Behavioral pattern analysis: In-depth analysis of the behavioral patterns of suspicious network activities, including attack time, frequency, and method, and by comparing with known attack patterns and cases, determine the attacker's intentions and predict the next action they will take.

[0017] Furthermore, the intelligent analysis engine module communicates with the time period risk rating module. The intelligent analysis engine module sends the identified suspicious network activities to the time period risk rating module. The time period risk rating module divides each day into several time periods and marks the corresponding time period as target time period i, and the value of i is greater than 4; the target time period i is marked as a high-risk time period or a low-risk time period through the time period risk rating analysis, and the marking information of the target time period i is sent to the administrator terminal.

[0018] Furthermore, the specific analysis process of period risk rating analysis is as follows:

[0019] Set the detection period, obtain the suspicious day condition value of the target period i in the corresponding date through analysis, compare the suspicious day condition value with the preset suspicious day condition threshold, and if the suspicious day condition value exceeds the preset suspicious day condition threshold, assign the risk symbol FP-1 to the target period i of the corresponding date;

[0020] The number of times the target period i is assigned the risk symbol FP-1 during the detection period is obtained and marked as the risk daily frequency value, and the average of all suspicious daily condition values ​​of the target period i during the detection period is calculated to obtain the suspicious comprehensive inspection value, and the suspicious daily condition value with the largest value corresponding to the target period i during the detection period is marked as the suspicious daily amplitude value;

[0021] The period risk assessment value is obtained through the risk daily frequency value, suspicious comprehensive inspection value and suspicious daily amplitude value, and the period risk assessment value is numerically compared with the preset period risk assessment threshold. If the period risk assessment value exceeds the preset period risk assessment threshold, the target period i is marked as a high-risk period; if the period risk assessment value does not exceed the preset period risk assessment threshold, the target period i is marked as a low-risk period.

[0022] Furthermore, the analysis and acquisition method of the suspicious daily condition value is as follows:

[0023] Obtain all suspicious network activities in the target time period i on the corresponding date, classify all suspicious network activities in the target time period i on the corresponding date, and mark the number of occurrences of the corresponding type of suspicious network activities in the target time period i on the corresponding date as a suspicious class frequency value;

[0024] A set of preset weight values ​​is set in advance for each type of suspicious network activity, and the product of the suspicious class frequency value of the corresponding type of suspicious network activity in the target time period i on the corresponding date and the corresponding preset weight value is marked as the suspicious class detection value, and the suspicious class detection values ​​of all types of suspicious network activities occurring in the target time period i on the corresponding date are summed up to obtain the suspicious day condition value.

[0025] Furthermore, the time period risk rating module is communicatively connected to the supervision analysis output module, the time period risk rating module sends the marking information of the target time period i to the supervision analysis output module, the supervision analysis output module analyzes the network supervision status during the detection period, generates a supervision warning signal or a supervision safety signal through the analysis, and sends the supervision warning signal or the supervision safety signal to the administrator terminal.

[0026] Furthermore, the specific analysis process of the regulatory analysis output module includes:

[0027] The number of high-risk time periods is obtained and marked as high-risk detection values, and the risk assessment values ​​of all time periods are averaged to obtain suspicious risk assessment values. The high-risk detection values ​​and suspicious risk assessment values ​​are numerically compared with the preset high-risk detection thresholds and the preset suspicious risk assessment thresholds, respectively. If the high-risk detection value or the suspicious risk assessment value exceeds the corresponding preset threshold, a regulatory warning signal is generated.

[0028] Furthermore, if both the high-risk detection value and the suspicious risk detection value do not exceed the corresponding preset threshold value, the timing starts when the corresponding suspicious network activity is identified, and continues until the moment when the threat of the corresponding suspicious network activity is eliminated, thereby obtaining the elimination time, and comparing the elimination time with the corresponding preset elimination time threshold value, if the elimination time exceeds the preset elimination time threshold value, the corresponding elimination time is marked as the elimination time;

[0029] The number of danger elimination durations during the detection period is obtained and marked as the danger elimination detection value, and the excess value of the danger elimination duration compared to the corresponding preset anomaly elimination duration threshold is marked as the danger elimination excess detection value, and the average of all danger elimination excess detection values ​​is calculated to obtain the danger elimination excess table value;

[0030] The optimized management assessment value of the detection period is obtained, and the regulatory risk value is obtained by numerically calculating the optimized management assessment value, high-risk detection value, suspicious risk detection value, risk elimination detection value and risk elimination excess value. The regulatory risk value is numerically compared with the preset regulatory risk threshold. If the regulatory risk value exceeds the preset regulatory risk threshold, a regulatory early warning signal is generated; if the regulatory risk value does not exceed the preset regulatory risk threshold, a regulatory safety signal is generated.

[0031] Furthermore, the supervision analysis output module is communicatively connected to the optimization management evaluation module. The optimization management evaluation module analyzes the optimization management status of the system optimization during the detection period, obtains the optimization management evaluation value through analysis, and sends the optimization management evaluation value of the detection period to the supervision analysis output module.

[0032] Furthermore, the analysis and acquisition method of optimizing the management evaluation value is as follows:

[0033] Collect all optimization moments for system optimization during the detection period, mark the interval duration between two adjacent groups of optimization moments as the optimization interval value, compare the optimization interval value with the preset optimization interval threshold, and mark the corresponding optimization interval value as the optimization isolation value; count the number of isolation values ​​during the detection period and mark them as the optimization abnormal isolation value, calculate the mean of all optimization interval values ​​during the detection period to obtain the optimization condition value, mark the optimization interval value with the largest value during the detection period as the optimization interval value, and numerically calculate the optimization abnormal isolation value, optimization condition value and optimization interval value to obtain the optimization management evaluation value.

[0034] Compared with the prior art, the present invention has the following beneficial effects:

[0035] 1. In the present invention, the network environment is comprehensively monitored through a multi-dimensional network monitoring module, the intelligent analysis engine module deeply mines and analyzes the monitored data and automatically identifies suspicious network activities, the threat warning response module automatically triggers the warning mechanism based on the results of the intelligent analysis engine module and provides emergency response plans and automated disposal processes to deal with corresponding suspicious network activities, and the behavior tracking and tracing module uses network tracking technologies such as IP tracking and domain name resolution tracking to track and trace suspicious network activities, thereby achieving comprehensive monitoring, intelligent analysis, accurate warning and efficient tracking of the network environment, meeting the increasingly complex network supervision needs;

[0036] 2. In the present invention, the time period risk rating module is used to determine the high-risk time periods and low-risk time periods of the day based on the time period risk rating analysis, which is conducive to the subsequent reasonable and scientific formulation of network supervision plans for different time periods, and the network supervision status of the detection period is analyzed through the supervision analysis output module. When the supervision warning signal is generated, the administrator is reminded to continue to strengthen network supervision in the future to ensure the security of network information, which significantly reduces the difficulty of the administrator's work and has a high degree of intelligence. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to facilitate understanding by those skilled in the art, the present invention is further described below in conjunction with the accompanying drawings;

[0038] Figure 1 This is a system block diagram of Embodiment 1 of the present invention;

[0039] Figure 2 This is a system block diagram of Embodiment 2 and Embodiment 3 of the present invention. DETAILED DESCRIPTION

[0040] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0041] Embodiment 1: Figure 1 As shown, the information security tracking system based on network supervision requirements proposed by the present invention includes a multi-dimensional network monitoring module, an intelligent analysis engine module, a threat warning response module, a behavior tracking and tracing module and an administrator terminal;

[0042] The multi-dimensional network monitoring module monitors the multi-dimensional information of network traffic, user behavior and system logs in real time, and uses deep packet inspection and traffic analysis technology to comprehensively monitor the network environment, and sends the monitored data to the intelligent analysis engine module;

[0043] The intelligent analysis engine module integrates machine learning and big data analysis technologies to conduct in-depth mining and analysis of monitored data, automatically identify suspicious network activities, and send the identified suspicious network activities to the threat warning response module and behavior tracking and tracing module;

[0044] The threat warning response module automatically triggers the warning mechanism based on the results of the intelligent analysis engine module, sends alerts to the administrator terminal through emails, text messages, pop-up windows, etc., and provides emergency response plans and automated disposal processes to deal with corresponding suspicious network activities, thereby helping administrators to quickly respond to security incidents and reduce losses;

[0045] The behavior tracking and tracing module uses network tracking technologies such as IP tracking and domain name resolution tracking to track and trace suspicious network activities, and sends the corresponding tracking and tracing results to the administrator terminal; the specific operation process of the behavior tracking and tracing module is as follows:

[0046] IP tracking: By analyzing network traffic and logs, the IP addresses of suspicious network activities are determined. The geographical location information of the IP addresses is used to preliminarily locate the source of the suspicious activities. The changes of IP addresses are further tracked to analyze their possible attack paths and jump points.

[0047] Domain name resolution tracking: Resolve domain names involved in suspicious network activities, obtain domain name registration information and DNS resolution records, and build the attacker's network architecture and attack path by analyzing the domain name resolution chain and associated domain names, identify and track the registrants and controllers of malicious domain names and the organizations or individuals behind them;

[0048] Multi-dimensional data association: The results of IP tracking and domain name resolution tracking are analyzed in association with other data sources (such as social media, emails, payment records, etc.). By mining the associations between different data sources, potential security threats and the true identity of attackers can be discovered.

[0049] Behavioral pattern analysis: In-depth analysis of the behavioral patterns of suspicious network activities, including attack time, frequency, and method, etc., by comparing with known attack patterns and cases, to determine the attacker's intentions and predict the next action they will take.

[0050] The present invention integrates key technologies such as multi-dimensional monitoring, intelligent analysis, threat warning, behavior tracking and data privacy protection to achieve comprehensive monitoring, intelligent analysis, accurate warning and efficient tracking of the network environment, meeting the increasingly complex network supervision needs, and has important practical value and promotion prospects.

[0051] Embodiment 2: Figure 2As shown, the difference between this embodiment and the first embodiment is that the intelligent analysis engine module is connected to the time period risk rating module in communication, and the intelligent analysis engine module sends the identified suspicious network activities to the time period risk rating module. The time period risk rating module divides each day into several time periods, each of which has the same duration, and marks the corresponding time period as the target time period i, and the value of i is greater than 4;

[0052] Through the period risk rating analysis, the target period i is marked as a high-risk period or a low-risk period, and the marking information of the target period i is sent to the administrator terminal, so as to remind the administrator to strengthen the network supervision of the high-risk period in the future, which is conducive to the subsequent reasonable and scientific formulation of network supervision plans for different periods, reducing the difficulty of the administrator's work and having a high degree of intelligence; the specific analysis process of the period risk rating analysis is as follows:

[0053] Set a detection period, preferably, the detection period is twenty-five days; obtain all suspicious network activities in the target period i on the corresponding date, classify all suspicious network activities in the target period i on the corresponding date (such as DDoS attacks, phishing, malware propagation, illegal access attempts, data theft and leakage, etc.), and mark the number of occurrences of the corresponding type of suspicious network activities in the target period i on the corresponding date as a suspicious class frequency value;

[0054] A set of preset weight values ​​is set in advance for each type of suspicious network activity, wherein the preset weight values ​​are all positive numbers, and the greater the security threat level brought by the corresponding type of suspicious network activity, the greater the value of the preset weight value matching it;

[0055] The product of the suspicious class frequency value of the corresponding type of suspicious network activity in the target time period i on the corresponding date and the corresponding preset weight value is marked as the suspicious class inspection value, and the suspicious class inspection values ​​of all types of suspicious network activities occurring in the target time period i on the corresponding date are summed up to obtain the suspicious day condition value, and the suspicious day condition value is numerically compared with the preset suspicious day condition threshold. If the suspicious day condition value exceeds the preset suspicious day condition threshold, it indicates that the network risk of the target time period i on the corresponding date is relatively large, and the target time period i on the corresponding date is assigned a risk symbol FP-1;

[0056] The number of times the target period i is assigned the risk symbol FP-1 during the detection period is obtained and marked as the risk daily frequency value, and the average of all suspicious daily condition values ​​of the target period i during the detection period is calculated to obtain the suspicious comprehensive inspection value, and the suspicious daily condition value with the largest value corresponding to the target period i during the detection period is marked as the suspicious daily amplitude value;

[0057] The risk daily frequency value LWi, the suspicious comprehensive inspection value LPi and the suspicious daily amplitude value LMi are numerically calculated by the formula LSi=hg1*LWi+(hg2*LPi+hg3*LMi) / 2 to obtain the period risk assessment value LSi; wherein hg1, hg2, hg3 are preset proportional coefficients with values ​​greater than zero, and the larger the value of the period risk assessment value LSi, the greater the overall network risk suffered in the target period i every day;

[0058] The time period risk assessment value LSi is numerically compared with the preset time period risk assessment threshold. If the time period risk assessment value LSi exceeds the preset time period risk assessment threshold, it indicates that the overall network risk in the target time period i is relatively large every day, and the target time period i is marked as a high-risk time period; if the time period risk assessment value LSi does not exceed the preset time period risk assessment threshold, it indicates that the overall network risk in the target time period i is relatively small every day, and the target time period i is marked as a low-risk time period.

[0059] Embodiment 3: Figure 2 As shown, the difference between this embodiment and the first and second embodiments is that the period risk rating module is connected to the supervision analysis output module in communication, the period risk rating module sends the marking information of the target period i to the supervision analysis output module, and the supervision analysis output module analyzes the network supervision status during the detection period and generates a supervision warning signal or a supervision safety signal through analysis;

[0060] And send the supervision warning signal or supervision safety signal to the administrator terminal. When the administrator terminal receives the supervision warning signal, it reminds the administrator to continue to strengthen network supervision in the future and adjust the network supervision plan in time to ensure the security of network information. The specific analysis process of the supervision analysis output module is as follows:

[0061] The number of high-risk time periods is obtained and marked as high-risk detection values, and the risk assessment values ​​of all time periods are averaged to obtain suspicious risk assessment values. The high-risk detection values ​​and suspicious risk assessment values ​​are numerically compared with the preset high-risk detection thresholds and the preset suspicious risk assessment thresholds. If the high-risk detection value or the suspicious risk assessment value exceeds the corresponding preset threshold, it indicates that the network threat during the detection period is relatively large and subsequent network supervision needs to be strengthened, and a supervision warning signal is generated;

[0062] If both the high-risk detection value and the suspicious risk detection value do not exceed the corresponding preset threshold, the timing starts when the corresponding suspicious network activity is identified, and continues until the moment when the threat of the corresponding suspicious network activity is eliminated. The elimination time is obtained based on this, and the elimination time is compared with the corresponding preset elimination time threshold. If the elimination time exceeds the preset elimination time threshold, it indicates that the response efficiency to the corresponding suspicious network activity is slow, and the corresponding elimination time is marked as the risk elimination time;

[0063] The number of danger elimination durations during the detection period is obtained and marked as the danger elimination detection value, and the excess value of the danger elimination duration compared to the corresponding preset anomaly elimination duration threshold is marked as the danger elimination over-detection value, and the average of all danger elimination over-detection values ​​is calculated to obtain the danger elimination over-table value, and the optimized management evaluation value TN of the detection period is obtained;

[0064] By formula The optimized management evaluation value TN, the high-risk detection value TX, the suspicious risk detection value TF, the risk elimination detection value TW and the risk elimination over-table value TS are numerically calculated to obtain the regulatory risk value TL; wherein c1, c2, c3, c4, c5 are preset proportional coefficients with values ​​greater than zero, and the larger the value of the regulatory risk value TL is, the greater the overall network regulatory risk during the detection period is;

[0065] The regulatory risk value TL is numerically compared with the preset regulatory risk threshold. If the regulatory risk value TL exceeds the preset regulatory risk threshold, it indicates that the overall network regulatory risk during the detection period is large, and a regulatory warning signal is generated; if the regulatory risk value TL does not exceed the preset regulatory risk threshold, it indicates that the overall network regulatory risk during the detection period is small, and a regulatory safety signal is generated.

[0066] Furthermore, the supervision analysis output module is connected to the optimization management evaluation module in communication. The optimization management evaluation module analyzes the optimization management status of the system optimization during the detection period, obtains the optimization management evaluation value TN through analysis, and sends the optimization management evaluation value TN of the detection period to the supervision analysis output module, which can not only accurately feedback the optimization management status of the system optimization during the detection period, but also provide data support for the analysis process of the supervision analysis output module to ensure the accuracy of its analysis results; the analysis and acquisition method of the optimization management evaluation value is as follows:

[0067] Collect all optimization moments for system optimization during the detection period, mark the interval between two adjacent groups of optimization moments as the optimization interval value, compare the optimization interval value with the preset optimization interval threshold, and if the optimization interval value exceeds the preset optimization interval threshold, mark the corresponding optimization interval value as the optimization interval excess value;

[0068] The number of interval excess values ​​in the detection period is counted and marked as the optimized abnormal interval value, and the average of all optimized interval values ​​in the detection period is calculated to obtain the optimized interval value, and the optimized interval value with the largest value in the detection period is marked as the optimized interval value;

[0069] And the optimized isolation value XF, the optimized isolation value XL and the optimized isolation value XP are numerically calculated through the formula TN=ny1*XF+(ny2*XL+ny3*XP) / 2 to obtain the optimized management value TN; wherein, ny1, ny2, ny3 are preset proportional coefficients, ny1>ny2>ny3>0; and, the larger the value of the optimized management value TN, the worse the overall system optimization management performance during the detection period is, and the more unfavorable it is to ensure network information security.

[0070] The working principle of the present invention is as follows: when in use, the network environment is comprehensively monitored through the multi-dimensional network monitoring module, the intelligent analysis engine module deeply mines and analyzes the monitored data and automatically identifies suspicious network activities, the threat warning response module automatically triggers the warning mechanism based on the results of the intelligent analysis engine module and provides an emergency response plan and an automated disposal process to deal with the corresponding suspicious network activities, the behavior tracking and tracing module uses network tracking technologies such as IP tracking and domain name resolution tracking to track and trace suspicious network activities, integrates multi-dimensional monitoring, intelligent analysis, threat warning, behavior tracking and data privacy protection and other key technologies, realizes comprehensive monitoring, intelligent analysis, accurate warning and efficient tracking of the network environment, meets the increasingly complex network supervision needs, has important practical value and promotion prospects, and divides each day into several time periods through the time period risk rating module, determines high-risk time periods and low-risk time periods based on time period risk rating analysis, which is conducive to the subsequent reasonable and scientific formulation of network supervision plans for different time periods, and analyzes the network supervision status of the detection period through the supervision analysis output module, and reminds the administrator to continue to strengthen network supervision in the future when generating a supervision warning signal to ensure the security of network information, significantly reduces the difficulty of the administrator's work, and has a high degree of intelligence.

[0071] The above formulas are all dimensionless and numerical calculations. The formula is a formula obtained by collecting a large amount of data and performing software simulation to obtain the most recent real situation. The preset parameters in the formula are set by technicians in this field according to actual conditions. The preferred embodiments of the present invention disclosed above are only used to help explain the present invention. The preferred embodiments do not describe all the details in detail, nor do they limit the invention to only specific implementation methods. Obviously, many modifications and changes can be made according to the contents of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the present invention, so that technicians in the relevant technical field can understand and use the present invention well. The present invention is only limited by the claims and their full scope and equivalents.

Claims

1. Information security tracking system based on network supervision needs, characterized by: It includes multi-dimensional network monitoring module, intelligent analysis engine module, threat warning response module, behavior tracking and tracing module and administrator terminal; The multi-dimensional network monitoring module monitors the multi-dimensional information of network traffic, user behavior and system logs in real time, and uses deep packet inspection and traffic analysis technology to comprehensively monitor the network environment, and sends the monitored data to the intelligent analysis engine module; The intelligent analysis engine module conducts in-depth mining and analysis of the monitored data, automatically identifies suspicious network activities, and sends the identified suspicious network activities to the threat warning response module and the behavior tracking and tracing module; The threat warning response module automatically triggers the warning mechanism based on the results of the intelligent analysis engine module, and sends alerts to the administrator terminal via email, SMS or pop-up windows, and provides emergency response plans and automated disposal processes to deal with corresponding suspicious network activities; The behavior tracking and tracing module uses IP tracking and domain name resolution tracking technology to track and trace suspicious network activities, and sends the corresponding tracking and tracing results to the administrator terminal; The intelligent analysis engine module is connected to the time period risk rating module in communication. The intelligent analysis engine module sends the identified suspicious network activities to the time period risk rating module. The time period risk rating module divides each day into several time periods and marks the corresponding time period as a target time period i, and the value of i is greater than 4; The target period i is marked as a high-risk period or a low-risk period through period risk rating analysis, and the marking information of the target period i is sent to the administrator terminal.

2. The information security tracking system based on network supervision requirements according to claim 1 is characterized in that: The specific operation process of the behavior tracking and tracing module includes: IP tracking: By analyzing network traffic and logs, the IP addresses of suspicious network activities are determined. The geographical location information of the IP addresses is used to preliminarily locate the source of suspicious activities. The changes of IP addresses are further tracked to analyze their attack paths and jump points. Domain name resolution tracking: Resolve domain names involved in suspicious network activities, obtain domain name registration information and DNS resolution records, and build the attacker's network architecture and attack path by analyzing the domain name resolution chain and associated domain names, identify and track the registrants and controllers of malicious domain names and the organizations or individuals behind them; Multi-dimensional data association: The results of IP tracking and domain name resolution tracking are analyzed in association with other data sources. By mining the associations between different data sources, potential security threats and the true identity of attackers can be discovered. Behavioral pattern analysis: In-depth analysis of the behavioral patterns of suspicious network activities, including attack time, frequency, and method, and by comparing with known attack patterns and cases, determine the attacker's intentions and predict the next action they will take.

3. The information security tracking system based on network supervision requirements according to claim 1 is characterized in that: The specific analysis process of period risk rating analysis is as follows: Set the detection period, obtain the suspicious day condition value of the target period i in the corresponding date through analysis, compare the suspicious day condition value with the preset suspicious day condition threshold, and if the suspicious day condition value exceeds the preset suspicious day condition threshold, assign the risk symbol FP-1 to the target period i of the corresponding date; The number of times the target period i is assigned the risk symbol FP-1 during the detection period is obtained and marked as the risk daily frequency value, and the average of all suspicious daily condition values ​​of the target period i during the detection period is calculated to obtain the suspicious comprehensive inspection value, and the suspicious daily condition value with the largest value corresponding to the target period i during the detection period is marked as the suspicious daily amplitude value; The period risk assessment value is obtained through the risk daily frequency value, suspicious comprehensive inspection value and suspicious daily amplitude value. If the period risk assessment value exceeds the preset period risk assessment threshold, the target period i is marked as a high-risk period; If the period risk assessment value does not exceed the preset period risk assessment threshold, the target period i is marked as a low-risk period.

4. The information security tracking system based on network supervision requirements according to claim 3 is characterized in that: The analysis and acquisition method of suspicious daily condition values ​​is as follows: Obtain all suspicious network activities in the target time period i on the corresponding date, classify all suspicious network activities in the target time period i on the corresponding date, and mark the number of occurrences of the corresponding type of suspicious network activities in the target time period i on the corresponding date as a suspicious class frequency value; A set of preset weight values ​​is set in advance for each type of suspicious network activity, and the product of the suspicious class frequency value of the corresponding type of suspicious network activity in the target time period i on the corresponding date and the corresponding preset weight value is marked as the suspicious class detection value, and the suspicious class detection values ​​of all types of suspicious network activities occurring in the target time period i on the corresponding date are summed up to obtain the suspicious day condition value.

5. The information security tracking system based on network supervision requirements according to claim 2 is characterized in that: The time period risk rating module is communicated with the supervision analysis output module. The time period risk rating module sends the marking information of the target time period i to the supervision analysis output module. The supervision analysis output module analyzes the network supervision status during the detection period, generates a supervision warning signal or a supervision safety signal through analysis, and sends the supervision warning signal or the supervision safety signal to the administrator terminal.

6. The information security tracking system based on network supervision requirements according to claim 5 is characterized in that: The specific analysis process of the regulatory analysis output module includes: The number of high-risk time periods is obtained and marked as high-risk detection values, and the average of the period risk assessment values ​​of all time periods is calculated to obtain the suspicious risk assessment value. If the high-risk detection value or the suspicious risk assessment value exceeds the corresponding preset threshold, a regulatory warning signal is generated.

7. The information security tracking system based on network supervision requirements according to claim 6 is characterized in that: If both the high-risk detection value and the suspicious risk detection value do not exceed the corresponding preset threshold, the timing starts when the corresponding suspicious network activity is identified, and continues until the moment when the threat of the corresponding suspicious network activity is eliminated. The elimination time is obtained based on this, and the elimination time is compared with the corresponding preset elimination time threshold. If the elimination time exceeds the preset elimination time threshold, the corresponding elimination time is marked as the risk elimination time; The number of danger elimination durations during the detection period is obtained and marked as the danger elimination detection value, and the excess value of the danger elimination duration compared to the corresponding preset anomaly elimination duration threshold is marked as the danger elimination excess detection value, and the average of all danger elimination excess detection values ​​is calculated to obtain the danger elimination excess table value; Obtain the optimized management evaluation value during the detection period, and obtain the regulatory risk value by numerically calculating the optimized management evaluation value, high-risk detection value, suspicious risk detection value, risk elimination detection value, and risk elimination over-table value. If the regulatory risk value exceeds the preset regulatory risk threshold, a regulatory warning signal is generated; If the regulatory risk value does not exceed the preset regulatory risk threshold, a regulatory safety signal is generated.

8. The information security tracking system based on network supervision requirements according to claim 5 is characterized in that: The supervision analysis output module is communicatively connected to the optimization management evaluation module. The optimization management evaluation module analyzes the optimization management status of the system optimization during the detection period, obtains the optimization management evaluation value through analysis, and sends the optimization management evaluation value of the detection period to the supervision analysis output module.

9. The information security tracking system based on network supervision requirements according to claim 8 is characterized in that: The specific analysis and acquisition method of the optimized pipe evaluation value is as follows: Collect all optimization moments for system optimization during the detection period, mark the interval duration between two adjacent groups of optimization moments as the optimization interval value, if the optimization interval value exceeds the preset optimization interval threshold, mark the corresponding optimization interval value as the optimization isolation value; count the number of isolation values ​​during the detection period and mark them as the optimization abnormal isolation value, and calculate the mean of all optimization interval values ​​during the detection period to obtain the optimization condition value, and mark the optimization interval value with the largest value during the detection period as the optimization interval value, and numerically calculate the optimization abnormal isolation value, optimization condition value and optimization interval value to obtain the optimization management evaluation value.

Images