A host network security management method based on relationship network

Abstract

The present invention relates to the technical field of network security management, and discloses a host network security management method based on a relational network, comprising the following steps: step one, through topological structure analysis; step two, relational network modeling; step three, network risk assessment; step four, network vulnerability scanning; step five, network access control; step six, network isolation strategy; step seven, real-time monitoring and response to the network. The invention, the host network security management method based on a relational network is a way to detect and prevent network security threats by analyzing the relationship, interaction and communication mode between hosts in the network. Compared with traditional network security management methods, the method based on a relational network can comprehensively monitor all hosts in the network and the communication relationship between them, so as to have a deeper understanding of network traffic and behavior patterns. This helps to detect abnormal behavior and potential threats in a timely manner.

Description

Technical Field

[0001] The present invention relates to the technical field of network security management, in particular to a host network security management method based on a relational network. Background Art

[0002] Network security management refers to a series of measures and practices to effectively protect and manage network systems, network devices and network data. These measures are designed to ensure the availability, integrity and confidentiality of network systems, prevent the network from various threats and attacks, and ensure network security.

[0003] Traditional network security management mainly focuses on static defense, that is, building firewalls, installing anti-virus software, etc. However, as network attack methods continue to evolve and become more complex, relying solely on static defense is often difficult to cope with new threats and cannot detect abnormal behaviors and potential threats in a timely manner. Summary of the invention

[0004] 1. Technical issues to be solved

[0005] In view of the deficiencies in the prior art, the present invention provides a host network security management method based on a relational network, which has the advantages of being able to promptly detect abnormal behaviors and potential threats, and solves the problem that traditional methods cannot promptly detect abnormal behaviors and potential threats.

[0006] (II) Technical solution

[0007] In order to achieve the purpose of timely discovering abnormal behaviors and potential threats mentioned in the above background technology, the present invention provides the following technical solution: a host network security management method based on a relationship network, comprising the following steps:

[0008] Step 1: Analyze the topological structure;

[0009] Step 2: Relationship network modeling;

[0010] Step 3: Assess network risks;

[0011] Step 4: Scan network vulnerabilities;

[0012] Step 5: Control access to the network;

[0013] Step 6: Implement network isolation strategy;

[0014] Step 7: Monitor and respond to the network in real time.

[0015] Preferably, through topology analysis, a detailed analysis of the physical and logical topology of the host network can be achieved, thereby determining the connection mode and hierarchy between the hosts, and physical topology analysis, logical topology analysis, and hierarchy analysis.

[0016] Physical topology analysis: Check the actual physical connection between hosts, including the wiring between devices, device types (such as switches, routers), physical locations, etc. This helps to understand the actual connection paths and network structure between hosts;

[0017] Logical topology analysis: studies the logical connection between hosts, including network protocols, routing information, subnet division, etc. Logical topology analysis can reveal the logical relationship in the network, such as which hosts belong to the same subnet, which hosts have direct communication, etc.

[0018] Hierarchical structure analysis: Determine the hierarchical structure of the host network, including the core layer, distribution layer, and access layer. Understanding the hierarchical structure of the host helps to design effective network security strategies and access control mechanisms.

[0019] Preferably, relational network modeling, which is one of the key steps in the host network security management method based on relational network, includes the definition of nodes and edges, the construction of relational network graph, the determination of relational network attributes, relational network analysis, model verification and update.

[0020] Definition of nodes and edges: Hosts are considered nodes in the network, and the connections between them are considered edges. Nodes can include network devices such as servers, workstations, and routers, while edges represent the communication connections between these devices.

[0021] Construction of a relational network graph: Based on the definition of nodes and edges, a relational network graph of the host network is constructed. This can be a directed graph or an undirected graph, depending on the directionality of communication between hosts. The construction of the relational network graph can adopt graph theory methods or other modeling techniques;

[0022] Determination of the attributes of the relationship network: In addition to the definition of nodes and edges, it is also necessary to determine the attributes of the nodes and edges in the relationship network. Node attributes can include information such as the host's operating system type, installed software, and open ports, while edge attributes can include communication protocols, communication frequency, and communication volume.

[0023] Relationship network analysis: Analyze the constructed relationship network to identify the security risks and potential threats therein, including discovering possible loopholes, weaknesses or abnormal communication patterns, and provide a basis for subsequent security risk assessment and access control strategy formulation;

[0024] Model verification and update: The established relationship network model is verified and continuously updated and improved according to actual conditions. As the network topology and communication mode change, the relationship network model also needs to be updated in a timely manner to maintain its effectiveness and accuracy.

[0025] Preferably, network risk is assessed, including asset identification, threat identification, vulnerability assessment, risk quantification, risk prioritization, formulation of response strategies, monitoring and feedback.

[0026] Asset identification: Identify all important assets in the network, including hosts, applications, data, etc., which are critical to the operation of the organization and may become targets of attack;

[0027] Threat identification: Analyze possible threats and attack vectors in the network, including malware, internal threats, external attackers, etc. Understanding possible threats can help identify potential attack paths and vulnerabilities;

[0028] Vulnerability assessment: Conduct vulnerability assessments on systems and applications in the network to identify possible security holes and weaknesses. This can be achieved through technical means such as vulnerability scanning and security auditing.

[0029] Risk quantification: Quantitatively evaluate the identified threats and vulnerabilities to determine their potential impact and likelihood on organizational security. This can be done by using risk assessment matrices, risk scoring models, and other methods for quantitative analysis.

[0030] Risk prioritization: Based on the risk quantification results, security risks in the network are prioritized to determine which risks need to be addressed first, which can help the security team allocate resources and develop response strategies;

[0031] Formulate response strategies: Develop corresponding response strategies and measures for the identified high-priority risks, including patching vulnerabilities, strengthening access control, deploying security monitoring and other measures to reduce the possibility and impact of risks;

[0032] Monitoring and feedback: Establish a continuous monitoring mechanism to track security incidents and risk changes in the network and adjust response strategies in a timely manner. Conduct risk assessments regularly and continuously optimize security management measures based on feedback results.

[0033] Preferably, scanning network vulnerabilities includes determining the scanning scope, selecting scanning tools, configuring scanning parameters, executing vulnerability scanning, analyzing scanning results, formulating patching plans, and continuously monitoring and scanning.

[0034] Determine the scanning scope: First, determine the scope of the vulnerability scan, including which hosts, servers, applications, etc. in the network need to be scanned. This can help determine the target and scope of the scan;

[0035] Select scanning tools: Select appropriate vulnerability scanning tools based on the needs and scope of the scan. Choosing the right tool can improve the efficiency and accuracy of the scan.

[0036] Configure scanning parameters: Before performing a vulnerability scan, you need to configure the parameters of the scanning tool, including the target address, port range, scanning strategy, etc. Configuring parameters according to actual conditions can ensure the comprehensiveness and accuracy of the scan;

[0037] Perform vulnerability scanning: According to the pre-configured parameters, the vulnerability scanning operation is performed. The scanning tool will actively scan the target system and application to find possible vulnerabilities and security issues;

[0038] Analyze scan results: After the scan is completed, the scan results are analyzed and evaluated, and the identified vulnerabilities will be classified and rated to determine their severity and scope of impact;

[0039] Develop a patching plan: Based on the vulnerability scanning results, develop a corresponding patching plan. For high-priority vulnerabilities, they should be patched as soon as possible to reduce risks; for medium- and low-priority vulnerabilities, they can be patched gradually or other security measures can be taken;

[0040] Continuous monitoring and scanning: Vulnerability scanning is an ongoing process. The network environment and applications may change at any time, so regular vulnerability scanning and monitoring are required to ensure continuous improvement of the network security status.

[0041] Preferably, access control is performed on the network, including identity authentication, authorized access, access control policies, network isolation, encrypted communications, monitoring and auditing, and regular review and updating.

[0042] Identity authentication: Before a user accesses network resources, identity authentication is first performed to verify whether the user's identity is legal. Common identity authentication methods include username and password verification, two-factor authentication, biometric recognition, etc.

[0043] Authorized access: Once the user's identity is successfully authenticated, they need to be authorized to determine the resources and permissions they can access. Authorization can be based on factors such as user role, department, job responsibilities, etc. to ensure that users can only access the resources they need;

[0044] Access control: Develop and implement access control policies to clearly define which users can access which resources, as well as access permissions and restrictions. Access control policies can include rules based on network addresses, user identities, time limits, etc.

[0045] Network isolation: Divide the network into multiple security areas, implement network isolation measures through firewalls, network devices, etc., limit communication and access between different areas, and prevent lateral attacks and data leakage;

[0046] Encrypted communication: Encrypt network communications to ensure that data is not eavesdropped or tampered with during transmission;

[0047] Monitoring and auditing: Establish a monitoring and auditing mechanism for network access, track user access behavior and record relevant logs, promptly detect abnormal access behavior and security incidents, and investigate and handle them;

[0048] Regular review and update: Regularly review and update access control policies and configurations to ensure that they are consistent with the organization's security needs and actual conditions. As the network environment and security threats change, access control policies also need to be adjusted and updated in a timely manner.

[0049] Preferably, an isolation strategy is implemented for the network, including determining security areas, defining isolation boundaries, access control rules, network service deployment, data isolation, and regular evaluation and updates. Through an effective network isolation strategy, organizations can reduce the threat of internal and external attacks to critical resources and data and improve the security and stability of the network.

[0050] Determine the security zone: First, determine the security zone that needs to be isolated. According to the organization's network topology and security requirements, divide the network into multiple logical areas, such as internal network, DMZ (isolated zone), external network, etc.

[0051] Define isolation boundaries: Determine the isolation boundaries between each security zone, including physical isolation (such as firewalls, routers) and logical isolation (such as VLANs, subnets), to ensure that the communication between different areas is strictly controlled;

[0052] Access control rules: Implement access control rules on the isolation boundary to limit the communication traffic and access rights between different areas. These rules can be defined based on factors such as network address, protocol type, port number, etc. to ensure that only authorized traffic can pass;

[0053] Network service deployment: Deploy network services and applications in different security zones based on security requirements to ensure that key services and data are protected within the security zones;

[0054] Data isolation: Isolate sensitive data to ensure that it can only be accessed by authorized users or systems, and use encryption technology to encrypt data for storage and transmission to prevent data leakage and unauthorized access;

[0055] Regular evaluation and update: Regularly evaluate the effectiveness of the isolation strategy, and adjust and update it according to changes in the network environment and the evolution of security threats to ensure that the isolation strategy remains consistent with the organization's security needs and can respond to new security challenges and threats.

[0056] Preferably, the network is monitored and responded to in real time, including deployment of monitoring tools, setting of alarm rules, real-time monitoring of network traffic, incident response process, implementation of response measures, continuous monitoring and improvement, training and drills.

[0057] Deploy monitoring tools: Select and deploy appropriate network monitoring tools, such as intrusion detection systems (IDS), intrusion prevention systems, network traffic analysis tools, etc. These tools can monitor network traffic in real time, detect abnormal behavior and signs of attacks;

[0058] Set up alert rules: Set up alert rules in the monitoring tool to issue alerts when abnormal activities or security events are detected. These rules can be set based on known attack patterns, abnormal behaviors, security policies, etc.

[0059] Real-time monitoring of network traffic: Continuously monitor network traffic and activities, pay attention to abnormal traffic patterns, unauthorized access and other abnormal behaviors, and detect potential security threats and attacks in a timely manner through real-time monitoring;

[0060] Incident response process: Establish a complete incident response process, including incident detection, confirmation, analysis, response and recovery steps, clarify the responsibilities and operation procedures of each link, and ensure timely and effective response to security incidents;

[0061] Implement response measures: Once a security incident is discovered, necessary response measures should be taken immediately, including isolating the affected system, blocking the attack source, fixing vulnerabilities, recovering data, etc. Timely and effective response can minimize the impact of security incidents on the organization;

[0062] Continuous monitoring and improvement: Continuously monitor network security status, track and analyze security incidents, summarize lessons learned, and continuously improve monitoring and response mechanisms, regularly evaluate the effectiveness of response processes, and make adjustments and improvements based on actual conditions;

[0063] Training and Drills: Regularly organize security training and drills to improve employees' awareness of and ability to respond to security threats, and enhance the team's emergency response capabilities by simulating security incidents and rehearsing response processes.

[0064] Compared with the prior art, the present invention provides a host network security management method based on a relational network, which has the following beneficial effects:

[0065] 1. The present invention, a host network security management method based on a relational network, is a method for detecting and preventing network security threats by analyzing the relationships, interactions, and communication patterns between hosts in a network. Compared with traditional network security management methods, the relational network-based method can comprehensively monitor all hosts in a network and the communication relationships between them, thereby gaining a deeper understanding of network traffic and behavior patterns. This helps to promptly detect abnormal behaviors and potential threats.

[0066] 2. The present invention, by analyzing the communication relationship and mode between hosts, can proactively detect abnormal activities and attack behaviors in the network based on the relationship network method, and take preventive measures in time to avoid security incidents.

[0067] 3. The present invention, this method can use the relationship and behavior patterns between hosts to conduct in-depth analysis and identify possible malicious behaviors, such as lateral movement, data leakage, etc., thereby providing more accurate security protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0068] Figure 1 It is a schematic diagram of the process of the present invention. DETAILED DESCRIPTION

[0069] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0070] See also Figure 1 , a host network security management method based on a relationship network, comprising the following steps:

[0071] Step 1: Analyze the topological structure;

[0072] Step 2: Relationship network modeling;

[0073] Step 3: Assess network risks;

[0074] Step 4: Scan network vulnerabilities;

[0075] Step 5: Control access to the network;

[0076] Step 6: Implement network isolation strategy;

[0077] Step 7: Monitor and respond to the network in real time.

[0078] Specifically, Figure 1As shown, through topology analysis, the physical and logical topology of the host network can be analyzed in detail, so as to determine the connection mode and hierarchy between hosts, and physical topology analysis, logical topology analysis, and hierarchical analysis.

[0079] Through the above technical solutions, physical topology analysis: Check the physical connection between the actual hosts, including the wiring between devices, device types (such as switches, routers), physical locations, etc., which helps to understand the actual connection paths and network structures between hosts;

[0080] Logical topology analysis: studies the logical connection between hosts, including network protocols, routing information, subnet division, etc. Logical topology analysis can reveal the logical relationship in the network, such as which hosts belong to the same subnet, which hosts have direct communication, etc.

[0081] Hierarchical structure analysis: Determine the hierarchical structure of the host network, including the core layer, distribution layer, and access layer. Understanding the hierarchical structure of the host helps to design effective network security strategies and access control mechanisms.

[0082] Specifically, Figure 1 As shown, relational network modeling, relational network modeling is one of the key steps in the host network security management method based on relational network, and includes the definition of nodes and edges, the construction of relational network graph, the determination of relational network attributes, relational network analysis, model verification and update.

[0083] Through the above technical solution, the definition of nodes and edges is: the host is regarded as a node in the network, and the connection relationship between them is regarded as an edge. The node can include network devices such as servers, workstations, routers, etc., and the edge represents the communication connection between these devices;

[0084] Construction of a relational network graph: Based on the definition of nodes and edges, a relational network graph of the host network is constructed. This can be a directed graph or an undirected graph, depending on the directionality of communication between hosts. The construction of the relational network graph can adopt graph theory methods or other modeling techniques;

[0085] Determination of the attributes of the relationship network: In addition to the definition of nodes and edges, it is also necessary to determine the attributes of the nodes and edges in the relationship network. Node attributes can include information such as the host's operating system type, installed software, and open ports, while edge attributes can include communication protocols, communication frequency, and communication volume.

[0086] Relationship network analysis: Analyze the constructed relationship network to identify the security risks and potential threats therein, including discovering possible vulnerabilities, weaknesses or abnormal communication patterns, and provide a basis for subsequent security risk assessment and access control strategy formulation;

[0087] Model verification and update: The established relationship network model is verified and continuously updated and improved according to actual conditions. As the network topology and communication mode change, the relationship network model also needs to be updated in a timely manner to maintain its effectiveness and accuracy.

[0088] Specifically, Figure 1 As shown, network risk assessment includes asset identification, threat identification, vulnerability assessment, risk quantification, risk prioritization, response strategy formulation, monitoring and feedback.

[0089] Through the above technical solutions, asset identification: identify all important assets in the network, including hosts, applications, data, etc., which are critical to the operation of the organization and may become targets of attack;

[0090] Threat identification: Analyze possible threats and attack vectors in the network, including malware, internal threats, external attackers, etc. Understanding possible threats can help identify potential attack paths and vulnerabilities;

[0091] Vulnerability assessment: Conduct vulnerability assessments on systems and applications in the network to identify possible security holes and weaknesses. This can be achieved through technical means such as vulnerability scanning and security auditing.

[0092] Risk quantification: Quantitatively evaluate the identified threats and vulnerabilities to determine their potential impact and likelihood on organizational security. This can be done by using risk assessment matrices, risk scoring models, and other methods for quantitative analysis.

[0093] Risk prioritization: Based on the risk quantification results, security risks in the network are prioritized to determine which risks need to be addressed first, which can help the security team allocate resources and develop response strategies;

[0094] Formulate response strategies: Develop corresponding response strategies and measures for the identified high-priority risks, including patching vulnerabilities, strengthening access control, deploying security monitoring and other measures to reduce the possibility and impact of risks;

[0095] Monitoring and feedback: Establish a continuous monitoring mechanism to track security incidents and risk changes in the network and adjust response strategies in a timely manner. Conduct risk assessments regularly and continuously optimize security management measures based on feedback results.

[0096] Specifically, Figure 1 As shown, scanning network vulnerabilities includes determining the scanning scope, selecting scanning tools, configuring scanning parameters, executing vulnerability scanning, analyzing scanning results, developing patching plans, and continuous monitoring and scanning.

[0097] Through the above technical solution, the scanning scope is determined: first determine the scope of vulnerability scanning, including which hosts, servers, applications, etc. in the network need to be scanned, which can help determine the target and scope of the scan;

[0098] Select scanning tools: Select appropriate vulnerability scanning tools based on the needs and scope of the scan. Choosing the right tool can improve the efficiency and accuracy of the scan.

[0099] Configure scanning parameters: Before performing a vulnerability scan, you need to configure the parameters of the scanning tool, including the target address, port range, scanning strategy, etc. Configuring parameters according to actual conditions can ensure the comprehensiveness and accuracy of the scan;

[0100] Perform vulnerability scanning: According to the pre-configured parameters, the vulnerability scanning operation is performed. The scanning tool will actively scan the target system and application to find possible vulnerabilities and security issues;

[0101] Analyze scan results: After the scan is completed, the scan results are analyzed and evaluated, and the identified vulnerabilities will be classified and rated to determine their severity and scope of impact;

[0102] Develop a patching plan: Based on the vulnerability scanning results, develop a corresponding patching plan. For high-priority vulnerabilities, they should be patched as soon as possible to reduce risks; for medium- and low-priority vulnerabilities, they can be patched gradually or other security measures can be taken;

[0103] Continuous monitoring and scanning: Vulnerability scanning is an ongoing process. The network environment and applications may change at any time, so regular vulnerability scanning and monitoring are required to ensure continuous improvement of the network security status.

[0104] Specifically, Figure 1 As shown, network access control is performed, including identity authentication, authorized access, access control policies, network isolation, encrypted communications, monitoring and auditing, and regular review and updates.

[0105] Through the above technical solution, identity authentication: Before a user accesses network resources, identity authentication is first performed to verify whether the user's identity is legal. Common identity authentication methods include username and password verification, two-factor authentication, biometric recognition, etc.;

[0106] Authorized access: Once the user's identity is successfully authenticated, they need to be authorized to determine the resources and permissions they can access. Authorization can be based on factors such as user role, department, job responsibilities, etc. to ensure that users can only access the resources they need;

[0107] Access control: Develop and implement access control policies to clearly define which users can access which resources, as well as access permissions and restrictions. Access control policies can include rules based on network addresses, user identities, time limits, etc.

[0108] Network isolation: Divide the network into multiple security areas, implement network isolation measures through firewalls, network devices, etc., limit communication and access between different areas, and prevent lateral attacks and data leakage;

[0109] Encrypted communication: Encrypt network communications to ensure that data is not eavesdropped or tampered with during transmission;

[0110] Monitoring and auditing: Establish a monitoring and auditing mechanism for network access, track user access behavior and record relevant logs, promptly detect abnormal access behavior and security incidents, and investigate and handle them;

[0111] Regular review and update: Regularly review and update access control policies and configurations to ensure that they are consistent with the organization's security needs and actual conditions. As the network environment and security threats change, access control policies also need to be adjusted and updated in a timely manner.

[0112] Specifically, Figure 1 As shown, the network isolation strategy includes determining security areas, defining isolation boundaries, access control rules, network service deployment, data isolation, regular evaluation and updates. Through an effective network isolation strategy, organizations can reduce the threat of internal and external attacks to critical resources and data, and improve the security and stability of the network.

[0113] Through the above technical solution, the security area is determined: first, the security area that needs to be isolated is determined, and the network is divided into multiple logical areas, such as internal network, DMZ (isolation zone), external network, etc. according to the network topology and security requirements of the organization;

[0114] Define isolation boundaries: Determine the isolation boundaries between each security zone, including physical isolation (such as firewalls, routers) and logical isolation (such as VLANs, subnets), to ensure that the communication between different areas is strictly controlled;

[0115] Access control rules: Implement access control rules on the isolation boundary to limit the communication traffic and access rights between different areas. These rules can be defined based on factors such as network address, protocol type, port number, etc. to ensure that only authorized traffic can pass;

[0116] Network service deployment: Deploy network services and applications in different security zones based on security requirements to ensure that key services and data are protected within the security zones;

[0117] Data isolation: Isolate sensitive data to ensure that it can only be accessed by authorized users or systems, and use encryption technology to encrypt data for storage and transmission to prevent data leakage and unauthorized access;

[0118] Regular evaluation and update: Regularly evaluate the effectiveness of the isolation strategy, and adjust and update it according to changes in the network environment and the evolution of security threats to ensure that the isolation strategy remains consistent with the organization's security needs and can respond to new security challenges and threats.

[0119] Specifically, Figure 1 As shown, real-time monitoring and response of the network is carried out, including deployment of monitoring tools, setting alarm rules, real-time monitoring of network traffic, incident response process, implementation of response measures, continuous monitoring and improvement, training and drills.

[0120] Deploy monitoring tools through the above technical solutions: select and deploy appropriate network monitoring tools, such as intrusion detection systems (IDS), intrusion prevention systems, network traffic analysis tools, etc. These tools can monitor network traffic in real time, detect abnormal behavior and signs of attacks;

[0121] Set up alert rules: Set up alert rules in the monitoring tool to issue alerts when abnormal activities or security events are detected. These rules can be set based on known attack patterns, abnormal behaviors, security policies, etc.

[0122] Real-time monitoring of network traffic: Continuously monitor network traffic and activities, pay attention to abnormal traffic patterns, unauthorized access and other abnormal behaviors, and detect potential security threats and attacks in a timely manner through real-time monitoring;

[0123] Incident response process: Establish a complete incident response process, including incident detection, confirmation, analysis, response and recovery steps, clarify the responsibilities and operation procedures of each link, and ensure timely and effective response to security incidents;

[0124] Implement response measures: Once a security incident is discovered, necessary response measures should be taken immediately, including isolating the affected system, blocking the attack source, fixing vulnerabilities, recovering data, etc. Timely and effective response can minimize the impact of security incidents on the organization;

[0125] Continuous monitoring and improvement: Continuously monitor network security status, track and analyze security incidents, summarize lessons learned, and continuously improve monitoring and response mechanisms, regularly evaluate the effectiveness of response processes, and make adjustments and improvements based on actual conditions;

[0126] Training and Drills: Regularly organize security training and drills to improve employees' awareness of and ability to respond to security threats, and enhance the team's emergency response capabilities by simulating security incidents and rehearsing response processes.

[0127] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A host network security management method based on a relational network, characterized in that: The following steps are involved: Step 1: Analyze the topological structure; Step 2: Relationship network modeling; Step 3: Assess network risks; Step 4: Scan network vulnerabilities; Step 5: Control access to the network; Step 6: Implement network isolation strategy; Step 7: Monitor and respond to the network in real time.

2. A host network security management method based on a relational network according to claim 1, characterized in that: The topology analysis can be used to analyze the physical and logical topologies of the host network in detail, thereby determining the connection mode and hierarchy between hosts, and physical topology analysis, logical topology analysis, and hierarchy analysis.

3. The host network security management method based on a relational network according to claim 1 is characterized in that: The relational network modeling is one of the key steps in the host network security management method based on the relational network, and includes the definition of nodes and edges, the construction of the relational network graph, the determination of the relational network attributes, the relational network analysis, and the model verification and update.

4. The host network security management method based on a relational network according to claim 1 is characterized in that: The network risk assessment includes asset identification, threat identification, vulnerability assessment, risk quantification, risk prioritization, formulation of response strategies, monitoring and feedback.

5. The host network security management method based on a relational network according to claim 1, characterized in that: The network vulnerability scanning includes determining the scanning scope, selecting scanning tools, configuring scanning parameters, executing vulnerability scanning, analyzing scanning results, formulating patching plans, and continuous monitoring and scanning.

6. The host network security management method based on a relational network according to claim 1, characterized in that: The access control to the network includes identity authentication, authorized access, access control policies, network isolation, encrypted communications, monitoring and auditing, regular review and updates.

7. The host network security management method based on a relational network according to claim 1, characterized in that: The network isolation strategy includes determining security areas, defining isolation boundaries, access control rules, network service deployment, data isolation, and regular evaluation and updates. Through an effective network isolation strategy, organizations can reduce the threat of internal and external attacks to critical resources and data and improve the security and stability of the network.

8. The host network security management method based on a relational network according to claim 1, characterized in that: The real-time monitoring and response of the network includes deploying monitoring tools, setting alarm rules, real-time monitoring of network traffic, incident response process, implementation of response measures, continuous monitoring and improvement, training and drills.

Images