A terminal device security detection system and method based on zero trust network

Abstract

The present invention discloses a terminal device security detection system and method based on a zero-trust network, which relates to the field of security detection technology, and includes a monitoring object determination module, a user baseline analysis module, a terminal device classification module, a zero-trust status assessment model construction module and a device analysis and early warning module; the monitoring object determination module is used to take a system organization that applies a zero-trust network and includes multiple terminal devices as a monitoring object; the user baseline analysis module is used to generate a corresponding user baseline, and the terminal device classification module is used to divide the terminal device where the security monitoring event record is located into a secure terminal device and a suspicious secure terminal device; the zero-trust status assessment model construction module is used to construct a zero-trust status assessment model of the system organization where each suspicious secure terminal device is located; the device analysis and early warning module is used to perform security detection on the suspicious secure terminal device based on the zero-trust status assessment model, and output the terminal device with the highest risk level for early warning.

Description

Technical Field

[0001] The present invention relates to the field of security detection technology, and in particular to a terminal device security detection system and method based on a zero-trust network. Background Art

[0002] Zero Trust Network is a network security design principle that adheres to the concept of "never trust, always verify" and strictly authenticates and controls access to all users, devices, applications, and data, whether inside or outside the network. It is based on the principles of "least privilege" and "on-demand knowledge", and through continuous verification and dynamic access control, it extends security control from the edge of the network to the entire network, breaking the trust boundary of the traditional network security model. When applying zero trust, many organizations do not conduct a comprehensive audit of all terminal devices. Devices such as printers, cameras, and other IoT devices that are outside the traditional network may have potential vulnerabilities, which may lead to abnormal user behavior problems caused by abnormal users at the beginning of user verification; therefore, it is very important to effectively screen out terminal devices that may have zero trust network security risks based on historical data in a system organization with multiple terminal devices and provide early warning response reminders. Summary of the invention

[0003] The purpose of the present invention is to provide a terminal device security detection system and method based on a zero-trust network to solve the problems raised in the prior art.

[0004] To achieve the above object, the present invention provides the following technical solution: a terminal device security detection method based on a zero-trust network, the detection method comprising the following steps: Step S100: Taking a system organization that applies a zero-trust network and includes multiple terminal devices as a monitoring object, extracting historical data recorded by each terminal device in the monitoring object based on each target user implementing a target business, and generating a corresponding user baseline, wherein the target user refers to a user verified by the zero-trust network; Step S200: extracting security monitoring events obtained by dynamic monitoring of the monitoring object based on the user baseline during the historical monitoring period, outputting monitoring results of the security monitoring events, and classifying the terminal devices where the security monitoring event records are located into secure terminal devices and suspicious secure terminal devices based on the monitoring results; Step S300: marking a security monitoring event in which a suspicious security terminal device outputs abnormal monitoring as a first security event, and marking an abnormal target feature in the first security event as a first target feature, and constructing a zero-trust status assessment model for the system organization in which each suspicious security terminal device is located; Step S400: Perform security checks on suspicious security terminal devices based on the zero-trust status assessment model, and output the terminal devices with the highest risk level for early warning.

[0005] Furthermore, generating the corresponding user baseline includes the following process: Step S110: the historical data includes attribute characteristics and attribute information for implementing the target service; the attribute characteristics and attribute information are recorded as one record for the implementation of the target service by the same target user, and all records are extracted to generate an attribute information set for the same target user under the same attribute characteristics; Step S120: Based on the attribute information set, calculate the average value and standard deviation of the attribute information of each target user under each attribute feature; Step S130: Based on the mean value and standard deviation, generate the information identification interval of each attribute feature, information identification interval = [mean value - standard deviation, mean value + standard deviation]; the target user information, attribute features and corresponding information identification interval constitute the user baseline of the user; and when different attribute features of the same target user exist within the time interval threshold, the user baselines corresponding to the different attribute features are connected in series in chronological order to form the user dynamic behavior baseline.

[0006] Further, based on the monitoring result, the terminal device where the security monitoring event record is located is divided into a safe terminal device and a suspicious safe terminal device, including the following specific steps: Step S210: A security monitoring event refers to a user behavior event in which there is user data after responding to the attribute characteristics in the user baseline. The monitoring result refers to extracting user data based on the information of the corresponding attribute characteristics in the user baseline to distinguish and judge whether the interval requirements are met. If the requirements are met, the monitoring result is output as safe, and if not, the monitoring result is output as abnormal. Step S220: Differentiate and mark the security monitoring events with different monitoring results, extract the event response time period Li corresponding to the i-th attribute feature recorded by the same terminal device in the historical monitoring period, Li=T1i-T2i, where T1i represents the recording time of the first security monitoring event corresponding to the i-th attribute feature recorded by the corresponding terminal device, and T2i represents the recording time of the last security monitoring event corresponding to the i-th attribute feature recorded by the corresponding terminal device in the historical monitoring period, and calculate the abnormality rate Vi of the same terminal device in the event response time period corresponding to the i-th attribute feature, Vi=Qi / Li, Qi represents the number of security monitoring events whose monitoring results of the i-th attribute feature output are abnormal in the event response time period; Step S230: Calculate the corresponding change rates for all types of attribute features contained in the same terminal device, and obtain the average change rate V0 of the security monitoring events under each terminal device, V0=(1 / m)(∑Vi), m represents the total number of types of attribute features contained in the corresponding terminal device; traverse the average change rate V0 of all terminal devices in the same system organization, and calculate the change evaluation value U of the system organization, U=(1 / n)(∑V0), n represents the number of terminal devices contained in the system organization; Step S240: extracting terminal devices corresponding to V0>U in the system organization as suspicious safe terminal devices, and terminal devices corresponding to V0≤U as safe terminal devices.

[0007] The purpose of analyzing suspicious security terminal devices is to effectively and quickly extract terminal devices with frequent user changes based on monitoring results from a large amount of user behavior data organized under the same system.

[0008] Furthermore, step S300 includes the following specific steps: Step S310: obtaining security monitoring events with the same first target feature and different target user behaviors in the same suspicious security terminal device, and obtaining the change rate of the corresponding target user, and calculating the user change rate P1 of each different target user behavior with the first target feature, where P1 represents the average change rate of all target users; Step S320: extract other first target features contained in the suspicious security terminal device where the first target feature is located to form a first target feature set; bind each first target feature in the first target feature set to the calculated average of the abnormality rate; use the formula: R={[∑(P1-P0) 2 ] / r} 1 / 2 ; Calculate the abnormal dispersion index R of the suspicious security terminal device where the first target feature is located, where P0 represents the average of the user abnormality rate of all different target user behaviors of the suspicious security terminal device containing the first target feature; r represents the total number of the corresponding suspicious security terminal devices containing the first target feature; calculate the degree of dispersion to determine whether the terminal itself has a high risk of verification vulnerability in the initial stage of verification, that is, zero-trust verification. A small degree of dispersion means that the abnormal rate analyzed by each abnormal target feature is very large, and the possibility of the terminal itself causing the impact will be very high; and the analysis of the abnormal dispersion index does not distinguish the target users from the perspective of attribute features; Step S330: Mark the target user in the first security event in the analysis as the target user to be analyzed, extract other target users except the first target user, and record the change rate P2 of the security monitoring event in other security device terminals containing the same first target feature except the suspicious security device terminal to be analyzed, where the same first target feature refers to the adjacent target features with the same first target feature and a time link relationship based on the construction of the user dynamic behavior baseline; compare the change rate P2 obtained by each target user in other security terminal devices with the change rate P1 calculated in the security monitoring terminal to be analyzed for the same abnormal target feature, calculate the change rate difference P0, P0=P1-P2, and extract the target users whose P0 is greater than the change difference threshold as key users; Step 340: Obtain the number of key users E, and calculate the key user ratio W, where W=E / D, and D represents the number of target users who have successfully accessed the zero-trust network authentication. The higher the ratio, the greater the risk of verification vulnerabilities in the terminal to be analyzed during zero-trust authentication. Bind the key user ratio to the corresponding suspicious security device terminal, and establish a zero-trust status assessment model Z for the system organization where each suspicious security terminal device is located, where Z=k1*(1 / R)+k2*W, and k1 and k2 represent reference coefficients.

[0009] Furthermore, step S400 includes the following specific processes: Security detection refers to obtaining the output value of the zero-trust status assessment model of the system organization where each suspicious security terminal device is located, and sorting the suspicious security terminal devices from large to small based on the size of the output value. The suspicious security terminal device that ranks first in the sequence is the terminal device with the highest risk level.

[0010] Analyzing the terminal devices with the highest risk level is to conduct a security assessment of all terminal devices under a system organization based on the application of zero-trust network, avoid the occurrence of user behavior security risks caused by vulnerabilities in the link between the zero-trust network and the terminal devices, and reduce the probability of abnormal security incidents from the source of terminal access.

[0011] A terminal device security detection system based on a zero-trust network, the system includes a monitoring object determination module, a user baseline analysis module, a terminal device classification module, a zero-trust status assessment model construction module and a device analysis and early warning module; The monitoring object determination module is used to take the system organization that applies the zero-trust network and includes multiple terminal devices as the monitoring object; The user baseline analysis module is used to extract the historical data recorded by each terminal device in the monitored object based on the implementation of the target service by each target user, and generate the corresponding user baseline. The terminal device classification module is used to classify the terminal devices where the security monitoring event records are located into safe terminal devices and suspicious safe terminal devices; The zero-trust status assessment model building module is used to build a zero-trust status assessment model of the system organization where each suspicious security terminal device is located; The device analysis and warning module is used to perform security detection on suspicious security terminal devices based on the zero-trust status assessment model, and output the terminal devices with the highest risk level for warning.

[0012] Further, the user baseline analysis module includes a historical data extraction unit, an attribute information analysis unit, an information identification interval generation unit and a user baseline construction unit; The historical data extraction unit is used to extract the attribute characteristics and attribute information of the historical records for implementing the target business function; The attribute information analysis unit is used to calculate the average value and standard deviation of the attribute information of each target user under each attribute feature; The information identification interval generating unit is used to generate the information identification interval of each attribute feature based on the average value and the standard deviation. The user baseline construction unit is used to form the user baseline of the user with the target user information, attribute characteristics and corresponding information identification interval; and when different attribute characteristics of the same target user are recorded within the time interval threshold, the user baselines corresponding to the different attribute characteristics are connected in series in chronological order to form a user dynamic behavior baseline.

[0013] Further, the terminal device classification module includes a monitoring event marking unit, an event response period determination unit, an abnormality rate calculation unit and an abnormality evaluation value analysis unit; The monitoring event marking unit is used to distinguish and mark the safety monitoring events with different monitoring results. The event response period determination unit is used to extract the event response period corresponding to the attribute characteristics recorded by the same terminal device in the historical monitoring period; The change rate calculation unit is used to calculate the change rate of the same terminal device in the event response period corresponding to the i-th attribute feature; The anomaly assessment value analysis unit is used to calculate the corresponding anomaly rates for all types of attribute features contained in the same terminal device, and obtain the average anomaly rate of security monitoring events under each terminal device, traverse the average anomaly rate of all terminal devices in the same system organization, calculate the anomaly assessment value of the system organization; and distinguish terminal devices based on the anomaly assessment value.

[0014] Furthermore, the zero-trust status assessment model construction module includes an abnormal discrete index analysis unit, an abnormal rate difference calculation unit, a key user ratio calculation unit and an assessment model generation unit; The abnormal dispersion index analysis unit is used to calculate the abnormal dispersion index of the suspicious security terminal device where the first target feature is located; The abnormality rate difference calculation unit is used to compare the abnormality rate of each target user obtained from other security terminal devices with the abnormality rate calculated at the security monitoring terminal to be analyzed corresponding to the same abnormal target feature, and calculate the abnormality rate difference; The key user ratio calculation unit is used to obtain the number of key users and calculate the key user ratio; The assessment model generation unit is used to bind the key user ratio with the corresponding suspicious security device terminal to establish a zero-trust status assessment model for the system organization where each suspicious security terminal device is located.

[0015] Compared with the prior art, the present invention has the following beneficial effects: 1. The present invention analyzes the user baseline and finds the abnormal behavior based on the user baseline in the historical state behavior recorded by each terminal device, so that the conceptual analysis of the zero-trust network is transformed from the perspective of behavioral state to the perspective of data analysis on the impact of behavior, which is more visual and logical; 2. The present invention statistically analyzes abnormal behavior data, and compares the risk assessment of each terminal device in the system organization in the application of zero-trust network from multiple perspectives, thereby effectively analyzing the possibility of whether all terminal devices have vulnerabilities on the basis of establishing a zero-trust network. It has practical applicability and can effectively identify terminal devices that may be at risk, thereby improving the application security consistency of the system organization including all terminal devices and the convenience of security detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 This is a structural schematic diagram of a terminal device security detection method based on a zero-trust network in the present invention. DETAILED DESCRIPTION

[0017] Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in the field without making any creative work shall fall within the scope of protection of the present invention.

[0018] Example: Figure 1 As shown, the present invention provides a terminal device security detection system and method technical solution based on a zero-trust network, a terminal device security detection method based on a zero-trust network, and the detection method comprises the following steps: Step S100: Taking a system organization that applies a zero-trust network and includes multiple terminal devices as a monitoring object, extracting historical data recorded by each terminal device in the monitoring object based on each target user implementing a target business, and generating a corresponding user baseline, wherein the target user refers to a user verified by the zero-trust network; Step S200: extracting security monitoring events obtained by dynamic monitoring of the monitoring object based on the user baseline during the historical monitoring period, outputting monitoring results of the security monitoring events, and classifying the terminal devices where the security monitoring event records are located into secure terminal devices and suspicious secure terminal devices based on the monitoring results; Step S300: marking a security monitoring event in which a suspicious security terminal device outputs abnormal monitoring as a first security event, and marking an abnormal target feature in the first security event as a first target feature, and constructing a zero-trust status assessment model for the system organization in which each suspicious security terminal device is located; Step S400: Perform security checks on suspicious security terminal devices based on the zero-trust status assessment model, and output the terminal devices with the highest risk level for early warning.

[0019] Generating the corresponding user baseline includes the following processes: Step S110: the historical data includes attribute characteristics and attribute information for implementing the target service; the attribute characteristics and attribute information are recorded as one record for the implementation of the target service by the same target user, and all records are extracted to generate an attribute information set for the same target user under the same attribute characteristics; Step S120: Based on the attribute information set, calculate the average value and standard deviation of the attribute information of each target user under each attribute feature; Step S130: Based on the mean value and standard deviation, generate the information identification interval of each attribute feature, information identification interval = [mean value - standard deviation, mean value + standard deviation]; the target user information, attribute features and corresponding information identification interval constitute the user baseline of the user; and when different attribute features of the same target user exist within the time interval threshold, the user baselines corresponding to the different attribute features are connected in series in chronological order to form the user dynamic behavior baseline.

[0020] As shown in the embodiment: in the present invention, the target service can be implemented to query information for the access terminal; then this user behavior includes attribute characteristics: login frequency, system usage time after login, etc. When the login frequency is an attribute feature, the corresponding recorded attribute information may be the login time, and the login time of multiple logins of the user is used to generate an attribute information set; the average value and standard deviation of the attribute feature "login frequency" may be calculated, thereby generating an information identification interval about the "login frequency"; When calculating the average value based on the login time, the login frequency can be calculated by using adjacent login times as a group of data, or by using login times with the same number of intervals as a group of data; The generated user baseline is target user-login frequency-information identification interval.

[0021] Based on the monitoring results, the terminal device where the security monitoring event record is located is divided into a safe terminal device and a suspicious safe terminal device, including the following specific steps: Step S210: A security monitoring event refers to a user behavior event in which there is user data after responding to the attribute characteristics in the user baseline. The monitoring result refers to extracting user data based on the information of the corresponding attribute characteristics in the user baseline to distinguish and judge whether the interval requirements are met. If the requirements are met, the monitoring result is output as safe, and if not, the monitoring result is output as abnormal. Step S220: Differentiate and mark the security monitoring events with different monitoring results, extract the event response time period Li corresponding to the i-th attribute feature recorded by the same terminal device in the historical monitoring period, Li=T1i-T2i, where T1i represents the recording time of the first security monitoring event corresponding to the i-th attribute feature recorded by the corresponding terminal device, and T2i represents the recording time of the last security monitoring event corresponding to the i-th attribute feature recorded by the corresponding terminal device in the historical monitoring period, and calculate the abnormality rate Vi of the same terminal device in the event response time period corresponding to the i-th attribute feature, Vi=Qi / Li, Qi represents the number of security monitoring events whose monitoring results of the i-th attribute feature output are abnormal in the event response time period; Step S230: Calculate the corresponding change rates for all types of attribute features contained in the same terminal device, and obtain the average change rate V0 of the security monitoring events under each terminal device, V0=(1 / m)(∑Vi), m represents the total number of types of attribute features contained in the corresponding terminal device; traverse the average change rate V0 of all terminal devices in the same system organization, and calculate the change evaluation value U of the system organization, U=(1 / n)(∑V0), n represents the number of terminal devices contained in the system organization; Step S240: extracting terminal devices corresponding to V0>U in the system organization as suspicious safe terminal devices, and terminal devices corresponding to V0≤U as safe terminal devices.

[0022] The purpose of analyzing suspicious security terminal devices is to effectively and quickly extract terminal devices with frequent user changes based on monitoring results from a large amount of user behavior data organized under the same system.

[0023] Step S300 includes the following specific steps: Step S310: obtaining security monitoring events with the same first target feature and different target user behaviors in the same suspicious security terminal device, and obtaining the change rate of the corresponding target user, and calculating the user change rate P1 of each different target user behavior with the first target feature, where P1 represents the average change rate of all target users; Step S320: extract other first target features contained in the suspicious security terminal device where the first target feature is located to form a first target feature set; bind each first target feature in the first target feature set to the calculated average of the abnormality rate; use the formula: R={[∑(P1-P0) 2 ] / r} 1 / 2 ; Calculate the abnormal dispersion index R of the suspicious security terminal device where the first target feature is located, where P0 represents the average of the user abnormality rate of all different target user behaviors of the suspicious security terminal device containing the first target feature; r represents the total number of the corresponding suspicious security terminal devices containing the first target feature; calculate the degree of dispersion to determine whether the terminal itself has a high risk of verification vulnerability in the initial stage of verification, that is, zero-trust verification. A small degree of dispersion means that the abnormal rate analyzed by each abnormal target feature is very large, and the possibility of the terminal itself causing the impact will be very high; and the analysis of the abnormal dispersion index does not distinguish the target users from the perspective of attribute features; Step S330: Mark the target user in the first security event in the analysis as the target user to be analyzed, extract other target users except the first target user, and record the change rate P2 of the security monitoring event in other security device terminals containing the same first target feature except the suspicious security device terminal to be analyzed. The same first target feature refers to the adjacent target features with the same first target feature and a time link relationship in the construction of the user dynamic behavior baseline; the difference between the change rate P2 and the change rate P1 is that the change rate P2 is based on the perspective of the target user in the user baseline, and the same target user is recorded in all The security monitoring events with the same attribute characteristics under the security device terminal are taken as an analysis set to calculate the mean. The abnormality rate P1 is the attribute characteristics in the user baseline limited to the same terminal device. The security monitoring events of all target users with the same attribute characteristics are extracted as an analysis set to calculate the mean; the abnormality rate P2 obtained by each target user in other security terminal devices is compared with the abnormality rate P1 calculated at the security monitoring terminal to be analyzed for the same abnormal target characteristics, and the abnormality rate difference P0 is calculated, P0=P1-P2, and the target users whose P0 is greater than the abnormality difference threshold are extracted as key users; Step 340: Obtain the number of key users E, calculate the key user ratio W, W=E / D, D represents the number of target users who have successfully accessed the zero-trust network authentication; the higher the ratio, the greater the risk of verification vulnerabilities in the terminal to be analyzed during zero-trust authentication; bind the key user ratio with the corresponding suspicious security device terminal data, and establish a zero-trust status assessment model Z for the system organization where each suspicious security terminal device is located, Z=k1*(1 / R)+k2*W, k1 and k2 represent reference coefficients. It can be set according to the system.

[0024] Step S400 includes the following specific processes: Security detection refers to obtaining the output value of the zero-trust status assessment model of the system organization where each suspicious security terminal device is located, and sorting the suspicious security terminal devices from large to small based on the size of the output value. The suspicious security terminal device that ranks first in the sequence is the terminal device with the highest risk level.

[0025] Analyzing the terminal devices with the highest risk level is to conduct a security assessment of all terminal devices under a system organization based on the application of zero-trust network, avoid the occurrence of user behavior security risks caused by vulnerabilities in the link between the zero-trust network and the terminal devices, and reduce the probability of abnormal security incidents from the source of terminal access.

[0026] A terminal device security detection system based on a zero-trust network, the system includes a monitoring object determination module, a user baseline analysis module, a terminal device classification module, a zero-trust status assessment model construction module and a device analysis and early warning module; The monitoring object determination module is used to take the system organization that applies the zero-trust network and includes multiple terminal devices as the monitoring object; The user baseline analysis module is used to extract the historical data recorded by each terminal device in the monitored object based on the implementation of the target service by each target user, and generate the corresponding user baseline. The terminal device classification module is used to classify the terminal devices where the security monitoring event records are located into safe terminal devices and suspicious safe terminal devices; The zero-trust status assessment model building module is used to build a zero-trust status assessment model of the system organization where each suspicious security terminal device is located; The device analysis and warning module is used to perform security detection on suspicious security terminal devices based on the zero-trust status assessment model, and output the terminal devices with the highest risk level for warning.

[0027] The user baseline analysis module includes a historical data extraction unit, an attribute information analysis unit, an information identification interval generation unit and a user baseline construction unit; The historical data extraction unit is used to extract the attribute characteristics and attribute information of the historical records for implementing the target business function; The attribute information analysis unit is used to calculate the average value and standard deviation of the attribute information of each target user under each attribute feature; The information identification interval generating unit is used to generate the information identification interval of each attribute feature based on the average value and the standard deviation. The user baseline construction unit is used to form the user baseline of the user with the target user information, attribute characteristics and corresponding information identification interval; and when different attribute characteristics of the same target user are recorded within the time interval threshold, the user baselines corresponding to the different attribute characteristics are connected in series in chronological order to form a user dynamic behavior baseline.

[0028] The terminal device classification module includes a monitoring event marking unit, an event response period determination unit, an abnormality rate calculation unit and an abnormality evaluation value analysis unit; The monitoring event marking unit is used to distinguish and mark the safety monitoring events with different monitoring results. The event response period determination unit is used to extract the event response period corresponding to the attribute characteristics recorded by the same terminal device in the historical monitoring period; The change rate calculation unit is used to calculate the change rate of the same terminal device in the event response period corresponding to the i-th attribute feature; The anomaly assessment value analysis unit is used to calculate the corresponding anomaly rates for all types of attribute features contained in the same terminal device, and obtain the average anomaly rate of security monitoring events under each terminal device, traverse the average anomaly rate of all terminal devices in the same system organization, calculate the anomaly assessment value of the system organization; and distinguish terminal devices based on the anomaly assessment value.

[0029] The zero-trust status assessment model construction module includes an abnormal discrete index analysis unit, an abnormal rate difference calculation unit, a key user ratio calculation unit and an assessment model generation unit; The abnormal dispersion index analysis unit is used to calculate the abnormal dispersion index of the suspicious security terminal device where the first target feature is located; The abnormality rate difference calculation unit is used to compare the abnormality rate of each target user obtained from other security terminal devices with the abnormality rate calculated at the security monitoring terminal to be analyzed corresponding to the same abnormal target feature, and calculate the abnormality rate difference; The key user ratio calculation unit is used to obtain the number of key users and calculate the key user ratio; The assessment model generation unit is used to bind the key user ratio with the corresponding suspicious security device terminal to establish a zero-trust status assessment model for the system organization where each suspicious security terminal device is located.

[0030] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art can still modify the technical solutions described in the aforementioned embodiments or replace some of the technical features therein by equivalents. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A terminal device security detection method based on a zero-trust network, characterized in that: The detection method comprises the following steps: Step S100: Taking a system organization that applies a zero-trust network and includes multiple terminal devices as a monitoring object, extracting historical data recorded by each terminal device in the monitoring object based on each target user implementing a target business, and generating a corresponding user baseline, wherein the target user refers to a user verified by the zero-trust network; Step S200: extracting security monitoring events obtained by dynamic monitoring of the monitoring object based on the user baseline during the historical monitoring period, outputting monitoring results of the security monitoring events, and classifying the terminal devices where the security monitoring event records are located into secure terminal devices and suspicious secure terminal devices based on the monitoring results; Step S300: marking a security monitoring event in which a suspicious security terminal device outputs abnormal monitoring as a first security event, and marking an abnormal target feature in the first security event as a first target feature, and constructing a zero-trust status assessment model for the system organization in which each suspicious security terminal device is located; Step S400: Perform security checks on suspicious security terminal devices based on the zero-trust status assessment model, and output the terminal devices with the highest risk level for early warning.

2. According to claim 1, a terminal device security detection method based on zero-trust network is characterized in that: Generating the corresponding user baseline includes the following process: Step S110: the historical data includes attribute characteristics and attribute information for implementing the target service; the attribute characteristics and attribute information are recorded as one record for the implementation of the target service by the same target user, and all records are extracted to generate an attribute information set for the same target user under the same attribute characteristics; Step S120: Based on the attribute information set, calculate the average value and standard deviation of the attribute information of each target user under each attribute feature; Step S130: Based on the mean value and standard deviation, generate the information identification interval of each attribute feature, information identification interval = [mean value - standard deviation, mean value + standard deviation]; the target user information, attribute features and corresponding information identification interval constitute the user baseline of the user; and when different attribute features of the same target user exist within the time interval threshold, the user baselines corresponding to the different attribute features are connected in series in chronological order to form the user dynamic behavior baseline.

3. According to claim 2, a terminal device security detection method based on a zero-trust network is characterized in that: The method of classifying the terminal device where the security monitoring event record is located into a safe terminal device and a suspicious safe terminal device based on the monitoring result includes the following specific steps: Step S210: The security monitoring event refers to a user behavior event in which there is user data after responding to the attribute characteristics in the user baseline, and the monitoring result refers to extracting user data based on the information of the corresponding attribute characteristics in the user baseline to distinguish and judge whether the interval requirements are met, and outputting the monitoring result as safe if the requirements are met, and outputting the monitoring result as abnormal if the requirements are not met; Step S220: Differentiate and mark the security monitoring events with different monitoring results, extract the event response time period Li corresponding to the i-th attribute feature recorded by the same terminal device in the historical monitoring period, Li=T1i-T2i, where T1i represents the recording time of the first security monitoring event corresponding to the i-th attribute feature recorded by the corresponding terminal device, and T2i represents the recording time of the last security monitoring event corresponding to the i-th attribute feature recorded by the corresponding terminal device in the historical monitoring period, and calculate the abnormality rate Vi of the same terminal device in the event response time period corresponding to the i-th attribute feature, Vi=Qi / Li, Qi represents the number of security monitoring events whose monitoring results of the i-th attribute feature output are abnormal in the event response time period; Step S230: Calculate the corresponding change rates for all types of attribute features contained in the same terminal device, and obtain the average change rate V0 of the security monitoring events under each terminal device, V0=(1 / m)(∑Vi), m represents the total number of types of attribute features contained in the corresponding terminal device; traverse the average change rate V0 of all terminal devices in the same system organization, and calculate the change evaluation value U of the system organization, U=(1 / n)(∑V0), n represents the number of terminal devices contained in the system organization; Step S240: extracting terminal devices corresponding to V0>U in the system organization as suspicious safe terminal devices, and terminal devices corresponding to V0≤U as safe terminal devices.

4. According to claim 3, a terminal device security detection method based on a zero-trust network is characterized in that: The step S300 includes the following specific steps: Step S310: obtaining security monitoring events with the same first target feature and different target user behaviors in the same suspicious security terminal device, and obtaining the change rate of the corresponding target user, and calculating the user change rate P1 of each different target user behavior with the first target feature, where P1 represents the average change rate of all target users; Step S320: extract other first target features contained in the suspicious security terminal device where the first target feature is located to form a first target feature set; bind each first target feature in the first target feature set to the calculated average of the abnormality rate; use the formula: R={[∑(P1-P0) 2 ] / r} 1 / 2 ; Calculate the abnormal discrete index R of the suspicious security terminal device where the first target feature is located, where P0 represents the average of the user abnormality rates of the suspicious security terminal device containing all different target user behaviors where the first target feature is located; r represents the total number of the corresponding suspicious security terminal devices containing the first target feature; Step S330: Mark the target user in the first security event in the analysis as the target user to be analyzed, extract other target users except the first target user, and record the change rate P2 of the security monitoring event for other security device terminals containing the same first target feature except the suspicious security device terminal to be analyzed, where the same first target feature refers to the first target feature being the same and adjacent target features having a time link relationship based on the construction of the user dynamic behavior baseline; Compare the abnormality rate P2 of each target user obtained from other security terminal devices with the abnormality rate P1 calculated at the security monitoring terminal to be analyzed corresponding to the same abnormal target feature, calculate the abnormality rate difference P0, P0=P1-P2, and extract the target users whose P0 is greater than the abnormality difference threshold as key users; Step 340: Obtain the number of key users E, calculate the key user ratio W, W=E / D, D represents the number of target users who have successfully accessed the zero-trust network verification; bind the key user ratio to the corresponding suspicious security device terminal, and establish a zero-trust status assessment model Z for the system organization where each suspicious security terminal device is located, Z=k1*(1 / R)+k2*W, k1 and k2 represent reference coefficients.

5. According to claim 4, a terminal device security detection method based on zero-trust network is characterized in that: The step S400 includes the following specific processes: The security detection refers to obtaining the output value of the zero-trust status assessment model of the system organization where each suspicious security terminal device is located, and sorting the suspicious security terminal devices in order from large to small based on the size of the output value, and obtaining the suspicious security terminal device first in the sequence as the terminal device with the highest risk level.

6. A terminal device security detection system based on a zero-trust network, such as using a terminal device security detection method based on a zero-trust network according to any one of claims 1 to 5, characterized in that: The system includes a monitoring object determination module, a user baseline analysis module, a terminal device classification module, a zero-trust status assessment model construction module and a device analysis and early warning module; The monitoring object determination module is used to take a system organization that applies a zero-trust network and includes multiple terminal devices as a monitoring object; The user baseline analysis module is used to extract the historical data recorded by each terminal device in the monitored object based on the implementation of the target service by each target user, and generate the corresponding user baseline. The terminal device classification module is used to classify the terminal devices where the security monitoring event records are located into safe terminal devices and suspicious safe terminal devices; The zero-trust status assessment model building module is used to build a zero-trust status assessment model of the system organization where each suspicious security terminal device is located; The device analysis and early warning module is used to perform security detection on suspicious security terminal devices based on the zero-trust status assessment model, and output the terminal devices with the highest risk level for early warning.

7. A terminal device security detection system based on zero-trust network according to claim 6, characterized in that: The user baseline analysis module includes a historical data extraction unit, an attribute information analysis unit, an information identification interval generation unit and a user baseline construction unit; The historical data extraction unit is used to extract the attribute characteristics and attribute information of the historical records for implementing the target business function; The attribute information analysis unit is used to calculate the average value and standard deviation of the attribute information of each target user under each attribute feature; The information identification interval generating unit is used to generate the information identification interval of each attribute feature based on the average value and the standard deviation. The user baseline construction unit is used to form a user baseline for the user by combining target user information, attribute features, and corresponding information identification intervals; and when different attribute features of the same target user are recorded within a time interval threshold, the user baselines corresponding to the different attribute features are concatenated in chronological order to form a user dynamic behavior baseline.

8. A terminal device security detection system based on zero-trust network according to claim 6, characterized in that: The terminal device classification module includes a monitoring event marking unit, an event response period determination unit, an abnormality rate calculation unit and an abnormality evaluation value analysis unit; The monitoring event marking unit is used to distinguish and mark the safety monitoring events with different monitoring results. The event response period determination unit is used to extract the event response period corresponding to the attribute characteristics recorded by the same terminal device in the historical monitoring period; The change rate calculation unit is used to calculate the change rate of the same terminal device in the event response period corresponding to the i-th attribute feature; The change evaluation value analysis unit is used to calculate the corresponding change rates for all types of attribute features contained in the same terminal device, and obtain the average change rate of security monitoring events under each terminal device, traverse the average change rate of all terminal devices in the same system organization, and calculate the change evaluation value of the system organization; And differentiate terminal devices based on abnormal evaluation values.

9. A terminal device security detection system based on zero-trust network according to claim 6, characterized in that: The zero-trust status assessment model building module includes an abnormal discrete index analysis unit, an abnormal rate difference calculation unit, a key user ratio calculation unit and an assessment model generation unit; The abnormal dispersion index analysis unit is used to calculate the abnormal dispersion index of the suspicious security terminal device where the first target feature is located; The abnormality rate difference calculation unit is used to compare the abnormality rate of each target user obtained in other security terminal devices with the abnormality rate calculated in the security monitoring terminal to be analyzed corresponding to the same abnormal target feature, and calculate the abnormality rate difference; The key user ratio calculation unit is used to obtain the number of key users and calculate the key user ratio; The evaluation model generation unit is used to bind the key user ratio with the corresponding suspicious security device terminal to establish a zero-trust status evaluation model of the system organization where each suspicious security terminal device is located.

Images