Computer security management system based on artificial intelligence

Abstract

The invention discloses a computer security management system based on artificial intelligence, and particularly relates to the technical field of computer security management, and the system comprises an access state analysis module, a network state analysis module, a terminal state analysis module, a security coefficient analysis module, a terminal display early warning module and a database. According to the method, the influence of each parameter of the computer network hardware and each parameter of the computer network performance on the computer security state is considered, computer security abnormity caused by computer hardware abnormity and substandard network performance is avoided, and the security of the computer network in security management of the computer is improved. According to the method, the influence of each environment parameter and each working parameter of the terminal of the computer on the security state of the computer is considered, the computer security abnormity caused by the environment abnormity and each working parameter abnormity is avoided, and the security of the computer terminal in the security management of the computer is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of computer security management, and in particular to a computer security management system based on artificial intelligence. Background Art

[0002] Computer technology began to develop in the 1940s. It was originally designed as a computing tool to solve scientific research and military problems. In the early stages, computers were mainly used for stand-alone operations, and their security received little attention. As computers are gradually applied to business, education, communications and other fields, especially in the Internet era, computer security issues have gradually emerged. The emergence of the Internet and the rise of networking have expanded computer technology from a stand-alone model to a global information transmission and processing model. The background technology of computer security management technology is extensive and complex, covering all levels from hardware, software, network to management. With the development of technology and the continuous evolution of threats, computer security management technology is also constantly evolving to meet more complex security challenges.

[0003] The computer security management system in the existing technology can meet certain needs, but there are certain potential risks, specifically including: on the one hand, the existing computer security management technology ignores the user's access status for computer security management, the frequency of user login is too high and the number of IP address changes is high, and at the same time ignores the impact of the user's historical access status coefficient on the user's login status, which creates certain risks for the computer security status, causing the risk of information leakage and access resource occupation during the computer's operation, resulting in the computer being unable to work normally.

[0004] On the other hand, the prior art ignores the impact of various environmental parameters and working parameters of computer terminals on the computer during operation, ignores the overall impact of the computer's access status, network status, hardware status and working status on the computer's safety factor, and ignores the comprehensive impact of multiple parameters that affect the computer's safety factor, causing the risk of incomplete computer security analysis, resulting in untimely monitoring during the normal operation of the computer, and increasing computer security risks. Summary of the invention

[0005] The purpose of the present invention is to provide a computer security management system based on artificial intelligence, which solves the problems existing in the background technology.

[0006] In order to solve the above technical problems, the present invention adopts the following technical solutions: The present invention provides a computer security management system based on artificial intelligence, which includes: an access status analysis module, a network status analysis module, a terminal status analysis module, a safety factor analysis module, a terminal display warning module and a database, specifically:

[0007] The access status analysis module obtains the user login parameters within the monitoring period, calculates the user's login status compliance index, obtains the network parameters within the monitoring period, calculates the user's access network status index, calculates the user's access status coefficient based on the user's login status compliance index and access network compliance index, obtains the user's historical access status coefficient, calculates the user's security impact coefficient, sets the user's access status judgment area, and evaluates the user's access status.

[0008] The network status analysis module is used to obtain the computer's historical network hardware status parameters, calculate the computer's network hardware loss index, obtain the computer's network performance parameters within the computer monitoring period, calculate the computer's network performance index, calculate the computer's network status coefficient based on the computer's network hardware loss index and network performance index, and evaluate the computer's network status.

[0009] The terminal status analysis module is used to obtain various environmental parameters of the computer, calculate the computer's environmental compliance index, obtain various working parameters within the computer monitoring cycle, calculate the computer's working compliance index, calculate the computer's terminal status coefficient based on the computer's environmental compliance index and working compliance index, and evaluate the computer's terminal status.

[0010] The safety factor analysis module calculates the safety factor of the computer based on the access status coefficient, network status coefficient and terminal status coefficient, evaluates the security status of the computer, and implements computer security abnormal status response measures.

[0011] The terminal display warning module is used to display the user's abnormal access status, the computer's abnormal network status, the computer's abnormal terminal status and the computer's abnormal security status.

[0012] Specifically, the calculation of the user's login status compliance index is performed by using a network packet capture technology to obtain the number of logins C and the interval between each login in the monitoring period T. k and the IP address of each visit, denoted as D k , where k = 1, 2, ..., C, k represents the number of each login, and C represents the number of logins.

[0013] Based on the IP address of each user's visit during the monitoring period D k , count the number of IP addresses that changed during the monitoring period R, based on the interval between each user login during the monitoring period T k , if T k <τ, then the interval duration of the kth login is recorded as the abnormal duration, and the number of abnormal durations L is increased by 1 to obtain the number of abnormal durations L of user logins within the monitoring period, where τ represents the judgment threshold of the login interval duration extracted from the database.

[0014] Based on the number of IP addresses that changed during the monitoring period, R, and the number of abnormal login durations, L, the formula is: The user's login status conformity index η1 is calculated, where λ1 represents the impact factor of the unit number of IP address changes extracted from the database, and λ2 represents the impact factor of the unit number of login abnormal duration extracted from the database.

[0015] Specifically, the calculation of the user's access network status index is performed by: obtaining the network bandwidth B of each collection point within the user monitoring period through network packet capture technology. i , Network packet loss rate P i and network delay Y i , where i = 1, 2, …, m, i represents the number of each collection point in the monitoring period, and m represents the total number of collection points in the monitoring period.

[0016] By formula: The user's access network status index η2 is calculated, where B represents the minimum required network bandwidth for normal user access extracted from the database, P represents the allowed network packet loss rate for normal user access extracted from the database, and Y represents the allowed network delay for normal user access extracted from the database.

[0017] Specifically, the calculation of the user's access status coefficient is performed by a specific analysis method: based on the user's login status compliance index η1 and the user's access network status index η2, the user's access status coefficient α is calculated by the formula: α=ln(1+η1+η2).

[0018] Specifically, the user's access status judgment area is set to evaluate the user's access status, and the specific analysis method is: based on the user's historical access status coefficient α extracted from the database j , j = 1, 2, ..., n, where j represents the number of times the access state coefficient of each user history is extracted, and n represents the total number of extractions.

[0019] By formula: Calculate the average access status coefficient of the user's history like If the user is in the first interval of the average access state coefficient extracted from the database, the judgment scale of the user's access state is set to δ=δ1.

[0020] like If the user is in the second interval of the average access state coefficient extracted from the database, the judgment scale δ of the user's access state is set to δ=δ2, and the judgment scale δ of the user's access state is obtained.

[0021] Based on the judgment scale δ of the user's access status and the user's access status coefficient α, if α∈(α1′-δ,α1′+δ), the user's access status is judged to be normal, where (α1′-δ,α1′+δ) represents the user's access status judgment interval extracted from the database.

[0022] like The user's access status is determined to be abnormal.

[0023] Specifically, the network hardware loss index of the computer is calculated, and the specific analysis method is: extracting the number of network hardware failures Q, the total working time A of the network hardware, and the magnetic field strength H around the network hardware collected at each time in history from the database. x , x=1,2,…,g, where x represents the number of each historical collection of magnetic field strength around the network hardware, and g represents the total number of historical collections of magnetic field strength around the network hardware.

[0024] By formula: The network hardware loss index ρ1 of the computer is calculated, where H′ represents the magnetic field strength around the network hardware extracted from the database that works normally.

[0025] Specifically, the network performance index of the computing computer is analyzed by: obtaining the network bandwidth B′ of each collection point within the computer monitoring period by network packet capture technology f , Network packet loss rate P f ′、Network delay Y f ′, throughput U′ f , f=1,2,…,s, where f represents the number of each collection point in the computer monitoring cycle, and s represents the total number of collection points in the computer monitoring cycle.

[0026] By formula: The network performance index ρ2 of the computer is calculated, where B′ represents the minimum required network bandwidth for the normal operation of the computer extracted from the database, P′ represents the allowable network packet loss rate for the normal operation of the computer extracted from the database, Y′ represents the allowable network delay for the normal operation of the computer extracted from the database, and U′ represents the allowable network delay for the normal operation of the computer extracted from the database.

[0027] Specifically, the network status coefficient of the computer is calculated to evaluate the network status of the computer. The specific analysis method is: based on the computer's network hardware loss index ρ1 and the computer's network performance index ρ2, the computer's network status coefficient β is calculated through the formula: β=ln(1+ρ1+ρ2).

[0028] If β is in the first interval of the computer network status extracted from the database, it is determined that the computer network status is normal.

[0029] If β is in the second interval of the computer network status extracted from the database, it is determined that the computer network status is abnormal.

[0030] Specifically, the terminal state coefficient of the computer is calculated to evaluate the terminal state of the computer. The specific analysis method is: collect the ambient temperature W and ambient humidity S around the computer through the temperature and humidity sensor, collect the dust concentration F around the computer through the dust detection sensor, and obtain the computer's environmental parameters. Based on the formula: The calculated ambient temperature around the computer meets the judgment value QW, where (W - ,W + ) represents the standard ambient temperature range around the computer extracted from the database, The calculated ambient humidity around the computer meets the judgment value QS, where (S - ,S + ) represents the standard ambient humidity range around the computer extracted from the database, The dust concentration around the computer is calculated to meet the judgment value QF, where (F - ,F + ) represents the standard dust concentration range around the computer extracted from the database.

[0031] By formula: γ1=e QW+QS+QF , the computer’s environmental compliance index γ1 is calculated.

[0032] The vibration frequency K of the computer at each collection point during the monitoring period is obtained through the vibration sensor h The sound sensor obtains the working noise G of the computer at each collection point during the monitoring period h , the voltage sensor obtains the charging voltage E of the computer at each collection point during the monitoring period h , constituting the working parameters of each collection point within the monitoring period, h = 1, 2, ..., z, where h represents the number of each collection point of the computer working parameters within the monitoring period, and z represents the total number of collection points of the computer working parameters within the monitoring period.

[0033] The charging voltage E of the computer based on each collection point during the monitoring cycle h , through the formula: The fluctuation value E′ of the charging voltage calculated during the monitoring period is calculated.

[0034] By formula: The computer's working compliance index γ2 is calculated, where K′ represents the maximum allowable working frequency for the computer to work normally, and G′ represents the maximum allowable working noise for the computer to work normally.

[0035] The terminal state coefficient θ of the computer is calculated by the formula: θ=ln(1+γ1+γ2).

[0036] If θ is in the first interval of the terminal state of the computer extracted from the database, it is determined that the terminal state of the computer is normal.

[0037] If θ is in the second interval of the terminal state of the computer extracted from the database, it is determined that the terminal state of the computer is abnormal.

[0038] Specifically, the security status of the computer is evaluated and the computer security abnormal status response measures are implemented. The specific analysis method is: based on the user's access status coefficient α, the computer's network status coefficient β and the computer's terminal status coefficient θ, through the formula: ξ=e α+β+θ , calculate the safety factor ξ of the computer.

[0039] If ξ is in the first interval of the computer's safety factor extracted from the database, the computer's safety status is determined to be normal.

[0040] If ξ is in the second interval of the computer's safety factor extracted from the database, the computer's safety status is determined to be abnormal, and abnormal response measures are executed.

[0041] The abnormal response measures are: shutting down the computer, having a technician inspect and repair the computer, and re-evaluating the computer's security status until the computer's security status is normal.

[0042] Compared with the prior art, the present invention has the following advantages: First, the present invention takes into account the impact of various login parameters of the user and various network parameters of the user's login on the computer security status, avoids the impact of malicious access by accessing users and network anomalies on computer security work, and improves the security of accessing users in computer security management.

[0043] 2. The present invention takes into account the impact of various parameters of computer network hardware and computer network performance on the computer security status, avoids computer security anomalies caused by computer hardware anomalies and substandard network performance, and improves the security of computer networks in computer security management.

[0044] 3. The present invention takes into account the impact of various environmental parameters and working parameters of the computer terminal on the computer security status, avoids computer security anomalies caused by environmental anomalies and working parameter anomalies, and improves the security of computer terminals in computer security management.

[0045] 4. The present invention comprehensively considers the impact of the computer's access status, network status and terminal equipment on computer security management. The multi-parameter comprehensive analysis ensures the comprehensiveness of computer security management and improves the accuracy, reliability and scientificity of computer security management. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0047] Figure 1 It is a system structure connection diagram of the present invention. DETAILED DESCRIPTION

[0048] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0049] Reference Figure 1 As shown, the present invention provides a computer security management system based on artificial intelligence, which includes: an access status analysis module, a network status analysis module, a terminal status analysis module, a safety factor analysis module, a terminal display warning module and a database, specifically:

[0050] The access status analysis module obtains the user login parameters within the monitoring period, calculates the user's login status compliance index, obtains the network parameters within the monitoring period, calculates the user's access network status index, calculates the user's access status coefficient based on the user's login status compliance index and access network compliance index, obtains the user's historical access status coefficient, calculates the user's security impact coefficient, sets the user's access status judgment area, and evaluates the user's access status.

[0051] The network status analysis module is used to obtain the computer's historical network hardware status parameters, calculate the computer's network hardware loss index, obtain the computer's network performance parameters within the computer monitoring period, calculate the computer's network performance index, calculate the computer's network status coefficient based on the computer's network hardware loss index and network performance index, and evaluate the computer's network status.

[0052] The terminal status analysis module is used to obtain various environmental parameters of the computer, calculate the computer's environmental compliance index, obtain various working parameters within the computer monitoring cycle, calculate the computer's working compliance index, calculate the computer's terminal status coefficient based on the computer's environmental compliance index and working compliance index, and evaluate the computer's terminal status.

[0053] The safety factor analysis module calculates the safety factor of the computer based on the access status coefficient, network status coefficient and terminal status coefficient, evaluates the security status of the computer, and implements computer security abnormal status response measures.

[0054] The terminal display warning module is used to display the user's abnormal access status, the computer's abnormal network status, the computer's abnormal terminal status and the computer's abnormal security status.

[0055] The database is used to store the influencing factors of IP address changes per unit number of times, the influencing factors of abnormal login duration per unit number of times, the minimum required network bandwidth for normal user access and normal computer operation, the allowed network packet loss rate for normal user access and normal computer operation, the allowed network delay for normal user access and normal computer operation, the coefficients of each historical access status of the user, the access status judgment interval of the user, the magnetic field strength around the normal operation of the network hardware, the various intervals of the computer network status, and the various intervals of the computer's safety factor.

[0056] It should be noted that in a specific embodiment, the access status analysis module is connected to the network status analysis module, the network status analysis module is connected to the device terminal analysis module, the device terminal analysis module is connected to the safety factor analysis module, the safety factor analysis module is connected to the terminal display warning module, and the database is connected to the access status analysis module, the network status analysis module, the device terminal analysis module and the safety factor analysis module.

[0057] In a specific embodiment of the present invention, the calculation of the user's login status compliance index is performed by: obtaining the number of logins C and the interval between each login in the monitoring period through network packet capture technology. k and the IP address of each visit, denoted as D k , where k = 1, 2, ..., C, k represents the number of each login, and C represents the number of logins.

[0058] Based on the IP address of each user's visit during the monitoring period D k , count the number of IP addresses that changed during the monitoring period R, based on the interval between each user login during the monitoring period T k , if T k<τ, then the interval duration of the kth login is recorded as the abnormal duration, and the number of abnormal durations L is increased by 1 to obtain the number of abnormal durations L of user logins within the monitoring period, where τ represents the judgment threshold of the login interval duration extracted from the database.

[0059] It should be noted that, in a specific embodiment, the number of IP addresses that have changed during the monitoring period is counted. First, the IP address D1 of the first visit during the monitoring period is selected, and a text comparison is performed with the IP addresses of the remaining visits. If it is different from the IP addresses of the remaining visits, the number R of IP addresses that have changed during the monitoring period is increased by 1. Then, the IP address D2 of the second visit during the monitoring period is selected, and a text comparison is performed with the IP addresses of the remaining visits. If it is different from the IP addresses of the remaining visits, the number R of IP addresses that have changed during the monitoring period is increased by 1, and so on, to obtain the number R of IP addresses that have changed during the monitoring period.

[0060] Based on the number of IP addresses that changed during the monitoring period, R, and the number of abnormal login durations, L, the formula is: The user's login status conformity index η1 is calculated, where λ1 represents the impact factor of the unit number of IP address changes extracted from the database, and λ2 represents the impact factor of the unit number of login abnormal duration extracted from the database.

[0061] In a specific embodiment of the present invention, the specific analysis method for calculating the user's access network status index is: using network packet capture technology to obtain the network bandwidth B of each collection point within the user monitoring period i , Network packet loss rate P i and network delay Y i , where i = 1, 2, …, m, i represents the number of each collection point in the monitoring period, and m represents the total number of collection points in the monitoring period.

[0062] By formula: The user's access network status index η2 is calculated, where B represents the minimum required network bandwidth for normal user access extracted from the database, P represents the allowed network packet loss rate for normal user access extracted from the database, and Y represents the allowed network delay for normal user access extracted from the database.

[0063] In a specific embodiment of the present invention, the specific analysis method for calculating the user's access status coefficient is: based on the user's login status compliance index η1 and the user's access network status index η2, the user's access status coefficient α is calculated by the formula: α=ln(1+η1+η2).

[0064] The present invention takes into account the impact of various user login parameters and various network parameters of the user login on the computer security status, avoids the impact of malicious access by accessing users and network anomalies on computer security work, and improves the security of accessing users in computer security management.

[0065] In a specific embodiment of the present invention, the user's access status judgment area is set to evaluate the user's access status. The specific analysis method is: based on the user's historical access status coefficient α extracted from the database j , j = 1, 2, ..., n, where j represents the number of times the access state coefficient of each user history is extracted, and n represents the total number of extractions.

[0066] By formula: Calculate the average access status coefficient of the user's history like If the user is in the first interval of the average access state coefficient extracted from the database, the judgment scale of the user's access state is set to δ=δ1.

[0067] like If the user is in the second interval of the average access state coefficient extracted from the database, the judgment scale δ of the user's access state is set to δ=δ2, and the judgment scale δ of the user's access state is obtained.

[0068] It should be noted that, in a specific embodiment, each interval of the average access state coefficient is manually set by a technician based on the impact of each historical average access coefficient on the access state, to match the judgment scale of the user's access state.

[0069] Based on the judgment scale δ of the user's access status and the user's access status coefficient α, if α∈(α1′-δ,α1′+δ), the user's access status is judged to be normal, where (α1′-δ,α1′+δ) represents the user's access status judgment interval extracted from the database.

[0070] like The user's access status is determined to be abnormal.

[0071] In a specific embodiment of the present invention, the network hardware loss index of the computer is calculated, and the specific analysis method is: extracting the number of network hardware failures Q, the total working time A of the network hardware, and the magnetic field strength H around the network hardware collected at each time in history from the database. x , x=1,2,…,g, where x represents the number of each historical collection of magnetic field strength around the network hardware, and g represents the total number of historical collections of magnetic field strength around the network hardware.

[0072] By formula: The network hardware loss index ρ1 of the computer is calculated, where H′ represents the magnetic field strength around the network hardware extracted from the database that works normally.

[0073] In a specific embodiment of the present invention, the network performance index of the computer is calculated, and the specific analysis method is: obtaining the network bandwidth B' of each collection point within the computer monitoring period by network packet capture technology f , Network packet loss rate P f ′、Network delay Y f ′, throughput U′ f , f=1,2,…,s, where f represents the number of each collection point in the computer monitoring cycle, and s represents the total number of collection points in the computer monitoring cycle.

[0074] By formula: The network performance index ρ2 of the computer is calculated, where B′ represents the minimum required network bandwidth for the normal operation of the computer extracted from the database, P′ represents the allowable network packet loss rate for the normal operation of the computer extracted from the database, Y′ represents the allowable network delay for the normal operation of the computer extracted from the database, and U′ represents the allowable network delay for the normal operation of the computer extracted from the database.

[0075] In a specific embodiment of the present invention, the network status coefficient of the computer is calculated to evaluate the network status of the computer. The specific analysis method is: based on the computer's network hardware loss index ρ1 and the computer's network performance index ρ2, the network status coefficient β of the computer is calculated by the formula: β=ln(1+ρ1+ρ2).

[0076] If β is in the first interval of the computer network status extracted from the database, it is determined that the computer network status is normal.

[0077] If β is in the second interval of the computer network status extracted from the database, it is determined that the computer network status is abnormal.

[0078] It should be noted that, in a specific embodiment, each interval of the computer network status is manually set by a technician based on a comprehensive analysis of the impact of each historical computer network status on the computer's network status, and is stored in a database.

[0079] The present invention takes into account the influence of various parameters of computer network hardware and various parameters of computer network performance on the computer security status, avoids computer security anomalies caused by computer hardware anomalies and substandard network performance, and improves the security of computer networks in computer security management.

[0080] In a specific embodiment of the present invention, the terminal state coefficient of the computer is calculated to evaluate the terminal state of the computer. The specific analysis method is: collect the ambient temperature W and ambient humidity S around the computer through a temperature and humidity sensor, collect the dust concentration F around the computer through a dust detection sensor, and obtain the environmental parameters of the computer. Based on the formula: The calculated ambient temperature around the computer meets the judgment value QW, where (W - ,W + ) represents the standard ambient temperature range around the computer extracted from the database, The calculated ambient humidity around the computer meets the judgment value QS, where (S - ,S + ) represents the standard ambient humidity range around the computer extracted from the database, The dust concentration around the computer is calculated to meet the judgment value QF, where (F - ,F + ) represents the standard dust concentration range around the computer extracted from the database.

[0081] By formula: γ1=e QW+QS+QF , the computer’s environmental compliance index γ1 is calculated.

[0082] The vibration frequency K of the computer at each collection point during the monitoring period is obtained through the vibration sensor h The sound sensor obtains the working noise G of the computer at each collection point during the monitoring period h , the voltage sensor obtains the charging voltage E of the computer at each collection point during the monitoring period h , constituting the working parameters of each collection point within the monitoring period, h = 1, 2, ..., z, where h represents the number of each collection point of the computer working parameters within the monitoring period, and z represents the total number of collection points of the computer working parameters within the monitoring period.

[0083] The charging voltage E of the computer based on each collection point during the monitoring cycle h , through the formula: The fluctuation value E′ of the charging voltage calculated during the monitoring period is calculated.

[0084] By formula: The computer's working compliance index γ2 is calculated, where K′ represents the maximum allowable working frequency for the computer to work normally, and G′ represents the maximum allowable working noise for the computer to work normally.

[0085] The terminal state coefficient θ of the computer is calculated by the formula: θ=ln(1+γ1+γ2).

[0086] If θ is in the first interval of the terminal state of the computer extracted from the database, it is determined that the terminal state of the computer is normal.

[0087] If θ is in the second interval of the terminal state of the computer extracted from the database, it is determined that the terminal state of the computer is abnormal.

[0088] It should be noted that, in a specific embodiment, each interval of the terminal state of the computer is manually set by a technician based on a comprehensive analysis of the impact of each historical terminal state coefficient of the computer on the terminal state of the computer, and is stored in a database.

[0089] The present invention takes into account the influence of various environmental parameters and various working parameters of the computer terminal on the computer security state, avoids computer security anomalies caused by environmental anomalies and various working parameter anomalies, and improves the security of computer terminals in computer security management.

[0090] In a specific embodiment of the present invention, the security status of the computer is evaluated and the computer security abnormal status response measures are implemented. The specific analysis method is: based on the user's access status coefficient α, the computer's network status coefficient β and the computer's terminal status coefficient θ, the formula: ξ = e α+β+θ , calculate the safety factor ξ of the computer.

[0091] If ξ is in the first interval of the computer's safety factor extracted from the database, the computer's safety status is determined to be normal.

[0092] If ξ is in the second interval of the computer's safety factor extracted from the database, the computer's safety status is determined to be abnormal, and abnormal response measures are executed.

[0093] It should be noted that, in a specific embodiment, each interval of the computer's safety factor is manually set by a technician based on a comprehensive analysis of the impact of the computer's safety factor on the computer's safety status at various historical times, and is stored in a database.

[0094] The abnormal response measures are: shutting down the computer, having a technician inspect and repair the computer, and re-evaluating the computer's security status until the computer's security status is normal.

[0095] The present invention comprehensively considers the influence of the computer's access status, network status and terminal equipment on computer security management, and the multi-parameter comprehensive analysis ensures the comprehensiveness of computer security management and improves the accuracy, reliability and scientificity of computer security management.

[0096] The above contents are merely examples and explanations of the concept of the present invention. Those skilled in the art may make various modifications or additions to the specific embodiments described or replace them in a similar manner. As long as they do not deviate from the concept of the invention or exceed the scope defined by the present invention, they shall all fall within the protection scope of the present invention.

Claims

1. Computer security management system based on artificial intelligence, characterized by: The system includes an access status analysis module, a network status analysis module, a terminal status analysis module, a safety factor analysis module, a terminal display warning module and a database, specifically: The access status analysis module obtains the user login parameters within the monitoring period, calculates the user's login status compliance index, obtains the network parameters within the monitoring period, calculates the user's access network status index, calculates the user's access status coefficient based on the user's login status compliance index and access network compliance index, obtains the user's historical access status coefficient, calculates the user's security impact coefficient, sets the user's access status judgment area, and evaluates the user's access status; The network status analysis module is used to obtain various parameters of the computer's historical network hardware status, calculate the computer's network hardware loss index, obtain various network performance parameters within the computer monitoring period, calculate the computer's network performance index, calculate the computer's network status coefficient based on the computer's network hardware loss index and network performance index, and evaluate the computer's network status; The terminal status analysis module is used to obtain various environmental parameters of the computer, calculate the environmental compliance index of the computer, obtain various working parameters within the computer monitoring period, calculate the working compliance index of the computer, calculate the terminal status coefficient of the computer based on the environmental compliance index and working compliance index of the computer, and evaluate the terminal status of the computer; The safety factor analysis module calculates the safety factor of the computer based on the access status coefficient, network status coefficient and terminal status coefficient, evaluates the computer's security status, and implements computer security abnormal status response measures; The terminal display warning module is used to display the user's abnormal access status, the computer's abnormal network status, the computer's abnormal terminal status and the computer's abnormal security status.

2. The computer security management system based on artificial intelligence according to claim 1 is characterized in that: The calculation of the user's login status compliance index is performed by the following specific analysis method: Use network packet capture technology to obtain the number of logins C and the interval between each login within the monitoring period T k and the IP address of each visit, denoted as D k , where k = 1, 2, ..., C, k represents the number of each login, and C represents the number of logins; Based on the IP address of each user's visit during the monitoring period D k , count the number of IP addresses that changed during the monitoring period R, based on the interval between each user login during the monitoring period T k , if T k <τ, the interval duration of the kth login is recorded as the abnormal duration, and the number of abnormal durations L is increased by 1 to obtain the number of abnormal durations L of user logins within the monitoring period, where τ represents the judgment threshold of the interval duration of logins extracted from the database; Based on the number of IP addresses that changed during the monitoring period, R, and the number of abnormal login durations, L, the formula is: The user's login status conformity index η1 is calculated, where λ1 represents the impact factor of the unit number of IP address changes extracted from the database, and λ2 represents the impact factor of the unit number of login abnormal duration extracted from the database.

3. The computer security management system based on artificial intelligence according to claim 2 is characterized in that: The specific analysis method of calculating the user's access network status index is as follows: Through network packet capture technology, the network bandwidth B of each collection point in the user monitoring cycle is obtained i , Network packet loss rate P i and network delay Y i , where i = 1, 2, …, m, i represents the number of each collection point in the monitoring period, and m represents the total number of collection points in the monitoring period; By formula: The user's access network status index η2 is calculated, where B represents the minimum required network bandwidth for normal user access extracted from the database, P represents the allowed network packet loss rate for normal user access extracted from the database, and Y represents the allowed network delay for normal user access extracted from the database.

4. The computer security management system based on artificial intelligence according to claim 3 is characterized in that: The specific analysis method for calculating the user's access status coefficient is as follows: Based on the user's login status compliance index η1 and the user's access network status index η2, the user's access status coefficient α is calculated through the formula: α=ln(1+η1+η2).

5. The computer security management system based on artificial intelligence according to claim 4 is characterized in that: The user's access status judgment area is set to evaluate the user's access status, and the specific analysis method is as follows: Based on the access state coefficient α of each user history extracted from the database j , j = 1, 2, ..., n, where j represents the number of times the user's historical access state coefficients are extracted, and n represents the total number of times extracted; By formula: Calculate the average access status coefficient of the user's history like If the user is in the first interval of the average access state coefficient extracted from the database, the judgment scale of the user's access state is set to δ=δ1; like If the user is in the second interval of the average access state coefficient extracted from the database, the judgment scale of the user's access state is set to δ=δ2, and the judgment scale of the user's access state is obtained; Based on the judgment scale δ of the user's access status and the user's access status coefficient α, if α∈(α1′-δ,α1′+δ), the user's access status is judged to be normal, where (α1′-δ,α1′+δ) represents the user's access status judgment interval extracted from the database; like The user's access status is determined to be abnormal.

6. The computer security management system based on artificial intelligence according to claim 5 is characterized in that: The specific analysis method of the network hardware loss index of the computing computer is as follows: Extract the number of network hardware failures Q, the total working time A of the network hardware, and the magnetic field strength H around the network hardware collected at each time in the history of the computer from the database x , x=1,2,…,g, where x represents the number of each historical collection of magnetic field strength around network hardware, and g represents the total number of historical collections of magnetic field strength around network hardware; By formula: The network hardware loss index ρ1 of the computer is calculated, where H′ represents the magnetic field strength around the network hardware extracted from the database that works normally.

7. The computer security management system based on artificial intelligence according to claim 6 is characterized in that: The network performance index of the computing computer is specifically analyzed by: Obtain the network bandwidth B′ of each collection point during the computer monitoring cycle through network packet capture technology f , Network packet loss rate P f ′、Network delay Y f ′, throughput U′ f , f=1,2,…,s, where f represents the number of each collection point in the computer monitoring cycle, and s represents the total number of collection points in the computer monitoring cycle; By formula: The network performance index ρ2 of the computer is calculated, where B′ represents the minimum required network bandwidth for the normal operation of the computer extracted from the database, P′ represents the allowable network packet loss rate for the normal operation of the computer extracted from the database, Y′ represents the allowable network delay for the normal operation of the computer extracted from the database, and U′ represents the allowable network delay for the normal operation of the computer extracted from the database.

8. The computer security management system based on artificial intelligence according to claim 7 is characterized in that: The network status coefficient of the computer is calculated to evaluate the network status of the computer, and the specific analysis method is as follows: Based on the computer's network hardware loss index ρ1 and the computer's network performance index ρ2, the computer's network status coefficient β is calculated by the formula: β=ln(1+ρ1+ρ2); If β is in the first interval of the computer network status extracted from the database, the network status of the computer is determined to be normal; If β is in the second interval of the computer network status extracted from the database, it is determined that the computer network status is abnormal.

9. The computer security management system based on artificial intelligence according to claim 8 is characterized in that: The terminal state coefficient of the computer is calculated to evaluate the terminal state of the computer, and the specific analysis method is as follows: The ambient temperature W and humidity S around the computer are collected by the temperature and humidity sensor, and the dust concentration F around the computer is collected by the dust detection sensor to obtain the environmental parameters of the computer; Based on the formula: The calculated ambient temperature around the computer meets the judgment value QW, where (W - ,W + ) represents the standard ambient temperature range around the computer extracted from the database, The calculated ambient humidity around the computer meets the judgment value QS, where (S - ,S + ) represents the standard ambient humidity range around the computer extracted from the database, The dust concentration around the computer is calculated to meet the judgment value QF, where (F - ,F + ) represents the standard dust concentration range around the computer extracted from the database; By formula: γ1=e QW+QS+QF , calculate the computer's environmental compliance index γ1; The vibration frequency K of the computer at each collection point during the monitoring period is obtained through the vibration sensor h The sound sensor obtains the working noise G of the computer at each collection point during the monitoring period h , the voltage sensor obtains the charging voltage E of the computer at each collection point during the monitoring period h , constitute the working parameters of each collection point in the monitoring period, h = 1, 2, ..., z, where h represents the number of each collection point of the computer working parameters in the monitoring period, and z represents the total number of collection points of the computer working parameters in the monitoring period; The charging voltage E of the computer based on each collection point during the monitoring cycle h , through the formula: Calculate the fluctuation value E' of the charging voltage calculated during the monitoring period; By formula: The computer's working compliance index γ2 is calculated, where K' represents the maximum allowable working frequency of the computer for normal operation, and G' represents the maximum allowable working noise of the computer for normal operation; The terminal state coefficient θ of the computer is calculated by the formula: θ = ln(1 + γ1 + γ2); If θ is in the first interval of the terminal state of the computer extracted from the database, the terminal state of the computer is determined to be normal; If θ is in the second interval of the terminal state of the computer extracted from the database, it is determined that the terminal state of the computer is abnormal.

10. The computer security management system based on artificial intelligence according to claim 9 is characterized in that: The specific analysis method of evaluating the computer's security status and implementing computer security abnormality status response measures is as follows: Based on the user's access state coefficient α, the computer's network state coefficient β and the computer's terminal state coefficient θ, the formula: ξ=e α+β+θ , calculate the safety factor ξ of the computer; If ξ is in the first interval of the computer's safety factor extracted from the database, the computer's safety status is determined to be normal; If ξ is in the second interval of the computer's safety factor extracted from the database, the computer's safety status is determined to be abnormal, and abnormal response measures are executed; The abnormal response measures are: shutting down the computer, having a technician inspect and repair the computer, and re-evaluating the computer's security status until the computer's security status is normal.

Images