Method and system for improving system security protection attack resistance

Abstract

The invention discloses a method and a system for improving system security protection attack resistance, and relates to the technical field of information security. Comprising the steps that block chain nodes are deployed in a plurality of devices, the nodes are connected through a point-to-point protocol to form a block chain, each node stores a complete threat intelligence data copy, and data consistency is ensured through a block chain consensus mechanism; each block in the block chain contains the hash value of the previous block, and the hash value of the previous block can be changed by modifying the content of the previous block, so that the hash reference in the next block is invalid, the data in the block chain is ensured not to be controlled and modified by any single entity, and the integrity and security of the data are ensured. According to the method, a block chain decentralized storage mode is utilized, and data are distributed on a plurality of nodes in the whole network, so that the possibility of single-point failure and data tampering is eliminated, the reliability and the security of the system are improved, and the integrity and the security of the data are ensured.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a method and system for improving system security protection against attacks. Background Art

[0002] Traditional threat intelligence analysis platforms often rely on centralized storage mechanisms in their architectural design. This mechanism may encounter performance bottlenecks when processing large-scale data. At the same time, data access and control often rely on centralized management systems. Once the system is attacked or fails, the operation of the entire platform may be seriously affected.

[0003] In addition, because the permission control mechanism may not be strict enough, users at different levels can access confidential information that should not be disclosed, thereby increasing the risk of data leakage. The existence of these problems makes the threat intelligence analysis platform unable to cope with the increasingly complex network security threats. Therefore, it is necessary to improve the existing platform architecture to improve the security and reliability of the system. Summary of the invention

[0004] The purpose of the present invention is to provide a method and system for improving system security protection against attacks, so as to solve the problems raised in the above background technology.

[0005] To achieve the above object, the present invention provides the following technical solution: a method for improving system security protection against attacks, comprising: Deploy blockchain nodes in several devices. The nodes are connected through a point-to-point protocol to form a blockchain. Each node saves a complete copy of threat intelligence data, and the blockchain consensus mechanism ensures data consistency. Each block in the blockchain contains the hash value of the previous block. Modifications to the content of the previous block will change its hash value, thereby invalidating the hash reference in the next block. This ensures that the data in the blockchain is not controlled or modified by any single entity, ensuring the integrity and security of the data. Control over access to threat intelligence is achieved through smart contracts, so that only users who meet the conditions specified in the contract can perform specific operations; Use blockchain technology to establish a distributed trust network and store the trust relationship between devices on the blockchain; Use quantum secure communication technology to control access and manage permissions for all users connected to the blockchain network; Build a behavior recognition model, and detect and analyze user behavior based on the behavior recognition model and anomaly detection algorithm. When abnormal behavior is detected, the system will immediately take corresponding response measures to ensure the security and stability of the system; Develop intrusion detection and response mechanisms to detect abnormal activities and take appropriate response measures immediately based on predefined response strategies.

[0006] Furthermore, the method for controlling access rights to threat intelligence through the smart contract is: S1. Define user and permission rules to determine which specific users can access and operate threat intelligence; S2. Design the smart contract structure, create a smart contract, and define the contract’s data structure, storage variables, and functional functions; S3. Implement permission control logic to ensure that only authorized users can perform key operations; S4. Deploy and test smart contracts on the blockchain platform; S5, Integration and Use, integrate smart contracts into blockchain applications, and users can submit, approve or access threat intelligence through the interface defined by the contract.

[0007] Furthermore, the implementation method of the quantum secure communication technology is: T1. Establish a quantum secure communication channel: In the network security isolation and information exchange system, the quantum key distribution protocol based on the principles of quantum mechanics is adopted to ensure the absolute security of the key distribution process; T2. Encryption and decryption process: During the communication process, the sender uses quantum bits to encrypt sensitive information, and then transmits the encrypted information to the receiver through the quantum channel. The receiver uses the received quantum bits and the previously agreed quantum key to decrypt and obtain the original sensitive information; T3. Security verification: Before establishing a quantum channel and transmitting sensitive information, a security verification step is performed to ensure the security of communication. Security verification includes checking the integrity of the channel and the identity verification of the sender and receiver.

[0008] Furthermore, the method for constructing the behavior recognition model is: The system collects user activity data in real time by monitoring user logins, file operations, and system call behaviors. User activity data includes user access frequency, access time period, and specific resources or targets accessed. Extract features of user behavior data and build user behavior models.

[0009] Furthermore, the anomaly detection algorithm selects one of a clustering-based method, a frequent pattern mining-based method, or a decision tree-based method.

[0010] Furthermore, the method for improving the security protection and anti-attack of the system also includes performing real-time auditing by setting an audit trigger in the system; The system records and analyzes user access behavior, including user login information, file operation information, and system call information, and stores this information in a secure audit log.

[0011] Furthermore, the intrusion detection and response mechanism is formulated as follows: Traffic monitoring and analysis: monitor network traffic and identify potential intrusion behaviors; Abnormal behavior detection: Use intrusion detection system (IDS) to monitor and analyze network traffic and system logs in real time to detect abnormal activities; Intrusion response: Take response measures to detected intrusion behaviors, including immediate blocking of attack sources, isolation of infected hosts, repair of damaged systems, and forwarding of sent attacks to another virtual device through dedicated traffic forwarding tools; Event recording and analysis: Record detailed information of intrusion events, including attack type and attack path, for subsequent investigation, analysis and security reinforcement.

[0012] Furthermore, the method for improving the security protection and anti-attack of the system also includes vulnerability repair, and the method of vulnerability repair is: Vulnerability scanning and detection: install virus databases in the system, perform vulnerability scans on files transferred by users, and regularly perform vulnerability scans on the entire system and applications; Vulnerability assessment and classification: Evaluate and classify the scan results to determine the severity and impact of the vulnerability; Patch release and installation: Regularly release security patches to fix security vulnerabilities in systems and applications and reduce the risk of attacks.

[0013] A system for improving system security protection and anti-attack, using the method for improving system security protection and anti-attack, comprises: Data collection module, used to collect user activity data and threat intelligence data; Storage module, used to store complete copies of threat intelligence data, user activity data, and audit log data; The computing module is used to detect and analyze user behavior and formulate intrusion detection and response mechanisms based on predefined response strategies or algorithms.

[0014] Compared with the prior art, the present invention has the following beneficial effects: The method and system for improving system security protection and anti-attack utilizes the decentralized storage method of blockchain, and the data is distributed on multiple nodes in the entire network, eliminating the possibility of single point failure and data tampering, improving the reliability and security of the system, ensuring the integrity and security of the data, and preventing the data from being tampered with and manipulated; Smart contracts are set up to implement strict permission control, prevent unauthorized access and operation, and protect the system from malicious intrusion and attack; Through the comprehensive application of quantum secure communication technology, multi-party secure computing technology and smart contract technology, the system is provided with comprehensive security protection to ensure the secure transmission and processing of sensitive information; The user's behavior is detected and analyzed through behavior recognition models and anomaly detection algorithms. Once abnormal behavior is detected, the system will immediately take corresponding response measures to ensure the security and stability of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 Flow chart of the system of the present invention. DETAILED DESCRIPTION

[0016] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0017] like Figure 1 The flowchart of the system of the present invention provides a technical solution: a method and system for improving system security protection and anti-attack, including: Deploy blockchain nodes in several devices. The nodes are connected through a point-to-point protocol to form a blockchain. Each node saves a complete copy of threat intelligence data. When new threat intelligence is generated, the node will package the data into blocks and add the blocks to the blockchain through a consensus mechanism. Compared with traditional centralized storage methods, the decentralized storage of blockchain eliminates the risk of single point failures, improves the reliability and security of the system, and ensures data consistency through the blockchain consensus mechanism. Each block in the blockchain contains the hash value of the previous block. Any modification to the content of the previous block will change its hash value, thereby invalidating the hash reference in the next block, ensuring that the data in the blockchain is not controlled or modified by any single entity. When someone attempts to tamper with a block in the blockchain, the continuity of the entire data chain will be destroyed and it will be rejected by other nodes. This tamper-proof feature ensures that the data in the blockchain is not controlled or modified by any single entity, ensuring the integrity and security of the data.

[0018] Through smart contracts, access rights to threat intelligence can be controlled. Only users who meet the conditions specified in the contract can perform specific operations. It should be noted that smart contracts are programmable codes executed on the blockchain, which can be automatically executed according to pre-set rules. By writing smart contracts, access rights to threat intelligence can be controlled. Only participants who meet the conditions specified in the contract can perform specific operations, such as submitting new intelligence data, reviewing existing data, or requesting access to specific data. This smart contract mechanism effectively protects the security of sensitive information and prevents unauthorized access and operation. The method of controlling access rights to threat intelligence through smart contracts is as follows: S1. Define user and permission rules to determine which specific users can access and operate threat intelligence; S2. Design the smart contract structure, create a smart contract, and define the contract’s data structure, storage variables, and functional functions; S3. Implement permission control logic to ensure that only authorized users can perform key operations; S4. Deploy and test smart contracts on the blockchain platform; S5, Integration and Use, integrate smart contracts into blockchain applications, and users can submit, approve or access threat intelligence through the interface defined by the contract.

[0019] Use blockchain technology to establish a distributed trust network, and store the trust relationship between devices on the blockchain. Specifically, establish a blockchain trust network: use blockchain technology to establish a distributed trust network, and store the trust relationship between devices on the blockchain; device identity authentication: each device has a unique identity on the blockchain, and the identity of the device is verified to be authentic through an authentication mechanism based on usb_Key encryption; during the signature verification process, the program will generate a string of 32-bit random numbers, encrypt the generated random numbers with a private key, read the public key from usb_Key, and verify the encrypted random numbers; trust evaluation rules: define the trust evaluation rules in the smart contract, and evaluate the trustworthiness of the device based on its historical behavior, reputation score and other information.

[0020] Quantum secure communication technology is used to control access and manage permissions for all users connected to the blockchain network. The implementation method of quantum secure communication technology is as follows: T1. Establishing quantum secure communication channels: In network security isolation and information exchange systems, quantum key distribution protocols based on quantum mechanics principles, such as BB84 or E91 protocols, are used. These protocols utilize the characteristics of quantum states, such as ultra-density coding and non-cloning, to ensure the absolute security of the key distribution process. It should be understood that traditional key exchange algorithms may be threatened by quantum computing attacks, but quantum key distribution protocols provide keys that cannot be cracked. Even future quantum computing attacks cannot steal or destroy these keys. T2. Encryption and decryption process: During the communication process, the sender uses quantum bits to encrypt sensitive information, and then transmits the encrypted information to the receiver through the quantum channel. The receiver uses the received quantum bits and the previously agreed quantum key to decrypt and obtain the original sensitive information; T3. Security verification: Before establishing a quantum channel and transmitting sensitive information, a security verification step is performed to ensure the security of communication. Security verification includes checking the integrity of the channel and the identity verification of the sender and receiver.

[0021] Through the above measures, the network security isolation and information exchange system can effectively prevent various network attacks and protect the security and privacy of the system. The comprehensive application of quantum secure communication technology, multi-party secure computing technology and smart contract technology provides a full range of security protection for the system, ensuring the safe transmission and processing of sensitive information.

[0022] Build a behavior recognition model, and detect and analyze user behavior based on the behavior recognition model and anomaly detection algorithm. When abnormal behavior is detected, the system will immediately take corresponding response measures to ensure the security and stability of the system; The construction method of the behavior recognition model is: The system collects user activity data in real time by monitoring user logins, file operations, and system call behaviors. The user activity data includes user access frequency, the time period when access occurs, and the specific resources or targets accessed. The collected user access frequency includes the number of times a user accesses the system or specific resources, and the access time. The time period when access occurs is the time period when user activities occur, such as the access time during the day or at night, and the target of the access. The specific resources or targets accessed, such as file paths and system call types, are then extracted from the user behavior data and a user behavior model is established.

[0023] The anomaly detection algorithm uses one of the clustering-based method, the frequent pattern mining-based method, or the decision tree-based method. Specifically, The clustering method is to cluster user behavior data. Normal behaviors tend to cluster together to form clusters, while abnormal behaviors may become outliers. Commonly used clustering algorithms include K-Means and DBSCAN. The method based on frequent pattern mining is to discover frequent patterns in user behavior, such as frequent item sets or sequence patterns. When behaviors that do not match the frequent patterns appear, they may be abnormal. Common frequent pattern mining algorithms include Apriori algorithm and FP-Growth algorithm. The decision tree-based method uses a decision tree algorithm to detect anomalies, and builds a decision tree model to determine whether new behaviors are consistent with known normal behaviors. Common algorithms include Isolation Forest.

[0024] Develop intrusion detection and response mechanisms to detect abnormal activities and take appropriate response measures immediately based on predefined response strategies.

[0025] Specifically, the method for formulating the intrusion detection and response mechanism is as follows: Traffic monitoring and analysis: monitor network traffic and identify potential intrusion behaviors, including port scanning, abnormal data packets, etc. Abnormal behavior detection: Use intrusion detection system (IDS) to monitor and analyze network traffic and system logs in real time to detect abnormal activities; Intrusion response: Take response measures to detected intrusion behaviors, including immediate blocking of attack sources, isolation of infected hosts, repair of damaged systems, and forwarding of sent attacks to another virtual device through dedicated traffic forwarding tools; Event recording and analysis: Record detailed information of intrusion events, including attack type and attack path, for subsequent investigation, analysis and security reinforcement.

[0026] Specifically, the principle of the intrusion detection and response mechanism is to identify potential intrusion behaviors by monitoring network traffic and system logs, and take corresponding response measures to prevent attacks and reduce damage. The system monitors network traffic and logs in real time, identifies abnormal activities, and then immediately takes corresponding response measures based on predefined response strategies or algorithms. At the same time, the system records detailed information about the intrusion event and analyzes it for subsequent investigation and security reinforcement.

[0027] In another specific embodiment of the present solution, the method for improving system security protection against attacks also includes performing real-time auditing by setting an audit trigger in the system; The system records and analyzes user access behavior, including user login information, file operation information, and system call information, and stores this information in a secure audit log.

[0028] In another specific embodiment of the present solution, the method for improving system security protection against attacks also includes vulnerability repair, and the vulnerability repair method is: Vulnerability scanning and detection: install virus databases in the system, perform vulnerability scans on files transferred by users, and regularly perform vulnerability scans on the entire system and applications; Vulnerability assessment and classification: Evaluate and classify the scan results to determine the severity and impact of the vulnerability; Patch release and installation: Regularly release security patches to fix security vulnerabilities in systems and applications and reduce the risk of attacks.

[0029] The principle of vulnerability repair is based on vulnerability scanning and assessment of systems and applications, as well as timely release and installation of security patches to reduce the risk of system attacks. The system discovers vulnerabilities in systems and applications by installing virus databases and regularly scanning files. Then, the scan results are evaluated and classified to determine the severity and scope of the vulnerabilities. Finally, manufacturers regularly release security patches, and system administrators install these security patches to patch known vulnerabilities, thereby improving system security and reducing the risk of attacks.

[0030] In addition, this solution also proposes a system to improve system security and anti-attack, including: Data collection module, used to collect user activity data and threat intelligence data; Storage module, used to store complete copies of threat intelligence data, user activity data, and audit log data; The computing module is used to detect and analyze user behavior and formulate intrusion detection and response mechanisms based on predefined response strategies or algorithms.

[0031] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is limited by the attached embodiments and their equivalents.

Claims

1. A method for improving system security protection against attacks, characterized in that: include: Deploy blockchain nodes in several devices. The nodes are connected through a point-to-point protocol to form a blockchain. Each node saves a complete copy of threat intelligence data, and the blockchain consensus mechanism ensures data consistency. Each block in the blockchain contains the hash value of the previous block. Modifications to the content of the previous block will change its hash value, thereby invalidating the hash reference in the next block. This ensures that the data in the blockchain is not controlled or modified by any single entity, ensuring the integrity and security of the data. Control over access to threat intelligence is achieved through smart contracts, so that only users who meet the conditions specified in the contract can perform specific operations; Use blockchain technology to establish a distributed trust network and store the trust relationship between devices on the blockchain; Use quantum secure communication technology to control access and manage permissions for all users connected to the blockchain network; Build a behavior recognition model, and detect and analyze user behavior based on the behavior recognition model and anomaly detection algorithm. When abnormal behavior is detected, the system will immediately take corresponding response measures to ensure the security and stability of the system; Develop intrusion detection and response mechanisms to detect abnormal activities and take appropriate response measures immediately based on predefined response strategies.

2. A method for improving system security protection against attacks according to claim 1, characterized in that: The method for controlling access rights to threat intelligence through the smart contract is as follows: S1. Define user and permission rules to determine which specific users can access and operate threat intelligence; S2. Design the smart contract structure, create a smart contract, and define the contract’s data structure, storage variables, and functional functions; S3. Implement permission control logic to ensure that only authorized users can perform key operations; S4. Deploy and test smart contracts on the blockchain platform; S5, Integration and Use, integrate smart contracts into blockchain applications, and users can submit, approve or access threat intelligence through the interface defined by the contract.

3. A method for improving system security and anti-attack according to claim 1, characterized in that: The implementation method of the quantum secure communication technology is: T1. Establish a quantum secure communication channel: In the network security isolation and information exchange system, the quantum key distribution protocol based on the principles of quantum mechanics is adopted to ensure the absolute security of the key distribution process; T2. Encryption and decryption process: During the communication process, the sender uses quantum bits to encrypt sensitive information, and then transmits the encrypted information to the receiver through the quantum channel. The receiver uses the received quantum bits and the previously agreed quantum key to decrypt and obtain the original sensitive information; T3. Security verification: Before establishing a quantum channel and transmitting sensitive information, a security verification step is performed to ensure the security of communication. Security verification includes checking the integrity of the channel and the identity verification of the sender and receiver.

4. A method for improving system security and anti-attack according to claim 1, characterized in that: The method for constructing the behavior recognition model is: The system collects user activity data in real time by monitoring user logins, file operations, and system call behaviors. User activity data includes user access frequency, access time period, and specific resources or targets accessed. Extract features of user behavior data and build user behavior models.

5. A method for improving system security and anti-attack according to claim 1, characterized in that: The anomaly detection algorithm selects one of a clustering-based method, a frequent pattern mining-based method or a decision tree-based method.

6. A method for improving system security and anti-attack according to claim 1, characterized in that: The method for improving the security protection and anti-attack of the system also includes performing real-time auditing by setting an audit trigger in the system; The system records and analyzes user access behavior, including user login information, file operation information, and system call information, and stores this information in a secure audit log.

7. A method for improving system security and anti-attack according to claim 1, characterized in that: The intrusion detection and response mechanism is formulated as follows: Traffic monitoring and analysis: monitor network traffic and identify potential intrusion behaviors; Abnormal behavior detection: Use intrusion detection system (IDS) to monitor and analyze network traffic and system logs in real time to detect abnormal activities; Intrusion response: Take response measures to detected intrusion behaviors, including immediate blocking of attack sources, isolation of infected hosts, repair of damaged systems, and forwarding of sent attacks to another virtual device through dedicated traffic forwarding tools; Event recording and analysis: Record detailed information of intrusion events, including attack type and attack path, for subsequent investigation, analysis and security reinforcement.

8. A method for improving system security and anti-attack according to claim 1, characterized in that: The method for improving the security protection and anti-attack of the system also includes vulnerability repair, and the method of vulnerability repair is: Vulnerability scanning and detection: install virus databases in the system, perform vulnerability scans on files transferred by users, and regularly perform vulnerability scans on the entire system and applications; Vulnerability assessment and classification: Evaluate and classify the scan results to determine the severity and impact of the vulnerability; Patch release and installation: Regularly release security patches to fix security vulnerabilities in systems and applications and reduce the risk of attacks.

9. A system for improving system security and anti-attack protection, characterized in that: The method for improving system security protection and anti-attack according to any one of claims 1 to 8 comprises: Data collection module, used to collect user activity data and threat intelligence data; Storage module, used to store complete copies of threat intelligence data, user activity data, and audit log data; The computing module is used to detect and analyze user behavior and formulate intrusion detection and response mechanisms based on predefined response strategies or algorithms.

Images