A network information security defense detection method and system

Abstract

The application discloses a network information security defense detection method and system, relates to the technical field of network information security, and comprises a website security check module, a download security check module, an access security check module and a display execution module; when surfing the Internet daily, network users often encounter network security problems, such as that a user may receive a phishing email disguised as a bank or download malicious software on an untrusted website, leading to data theft. Identity theft and data leakage increase privacy and financial risks, and a man-in-the-middle attack may intercept sensitive information through an unencrypted Wi-Fi network; the application detects the security of websites, download programs and external access equipment, including domain name checking, certificate verification, content scanning and integrity verification, etc., discovers and handles security risks in time; meanwhile, virtual machine isolation technology and behavior monitoring are adopted, the protection of malicious programs is enhanced, and the security risks of external equipment are evaluated, so that the safety of a network environment and data is ensured.

Description

Technical Field

[0001] This invention relates to the field of network information security technology, specifically to a network information security defense and detection method and system. Background Technology

[0002] Modern network information security defense and detection systems combine advanced technologies such as big data analytics, artificial intelligence, and threat intelligence. By monitoring network traffic, user behavior, and system logs in real time, they establish precise baseline behavioral patterns and can quickly identify abnormal activity. These systems employ a multi-layered defense architecture, forming a comprehensive security barrier from the network boundary to the internal network, and then to terminal devices and application layers. Furthermore, the systems integrate global threat intelligence and update defense strategies in a timely manner to address constantly evolving network threats, ensuring rapid detection and response even to zero-day attacks and advanced persistent threats (APTs), thereby minimizing potential security risks.

[0003] However, during daily internet use, users encounter various cybersecurity issues, including phishing attacks, malware, identity theft, data breaches, and man-in-the-middle attacks. For example, users may receive phishing emails masquerading as banks, requesting account updates, or download malware while browsing untrusted websites, leading to data theft. Identity theft and data breaches further increase privacy and financial risks, while man-in-the-middle attacks can intercept sensitive information over unencrypted public Wi-Fi networks. These threats underscore the importance of modern cybersecurity defense and detection systems. These systems, through advanced technology and real-time response capabilities, provide users with a robust protective barrier, ensuring maximum protection of user data and privacy when facing complex cybersecurity threats. Summary of the Invention

[0004] The purpose of this invention is to solve the above-mentioned problems by proposing a network information security defense and detection method and system.

[0005] The objective of this invention can be achieved through the following technical solutions:

[0006] In a first aspect, the present invention provides a network information security defense detection method, comprising:

[0007] Step 1: Perform a network information security test on the website being browsed to obtain the website security value, and compare it with a preset threshold to display the security percentage;

[0008] Step Two: Perform a network information security check on the downloaded installation program. The specific process is as follows:

[0009] S201: Perform integrity verification on downloaded files: Use digital signatures or hash values ​​to verify whether downloaded files have been tampered with. If the hash values ​​do not match, trigger a tampering alarm.

[0010] S202: Start Virtual Machine Isolation Test: Use virtualization tools to start a securely configured virtual machine, create an initial snapshot, and ensure network isolation from the host.

[0011] S203: Monitor program installation: Install the program in a virtual machine with standard user privileges, monitor file and registry changes in real time, calculate the magnitude of file size changes and registry value changes, calculate the comprehensive magnitude value, and compare it with a preset threshold. If the threshold is exceeded, an installation alarm is triggered.

[0012] S204: Program growth analysis: Calculate the abnormal growth coefficient of the program to analyze the abnormality of resource usage growth. If the abnormal growth coefficient exceeds the preset threshold, trigger an abnormal growth alarm.

[0013] Step 3: Perform network information security testing on externally accessed data. The specific process is as follows:

[0014] When connecting external devices, the security risks of these devices are calculated, and their security risk factors are determined, including device connection type risk factor, operating system vulnerability density risk factor, malware infection probability, data encryption coverage, and network behavior anomaly rate. Each risk factor is then weighted and summed to obtain a security risk value. This security risk value is then matched against a preset range. If the security risk value falls within range one, the current security measures are maintained, and regular monitoring is performed. If the security risk value FXZ falls within range two, the device's security measures are strengthened, and regular updates and testing are conducted.

[0015] In a preferred embodiment of the present invention, the specific process of obtaining a website security value by performing network information security detection on the browsed website is as follows:

[0016] S101: Perform domain name and URL checks on visited websites: Use the threat intelligence database to check the accessed domain name and URL. If they are related to known malicious or phishing websites, issue a warning and record it as a threat value L1. If they are not related, check the URL for suspicious characters or excessively long subdomains. If they are, issue a warning and record it as L1.

[0017] S102: Perform HTTPS certificate verification on the website being browsed: Verify the certificate authority and the validity of the certificate. If the certificate is untrusted or has expired / revoked, issue a warning and record it as authentication value L2 and validity value L3, respectively.

[0018] S103: Perform website content scanning on the website being browsed: Use tools to check if the website contains malicious code or suspicious plugins. If so, issue a warning and record it as content scan value L4; otherwise, run dynamic content in the sandbox. If any abnormality or malice is found, issue a warning and record it as L4.

[0019] S104: Calculate the website security value and compare it with the preset threshold, displaying the security percentage for the user to decide.

[0020] In a preferred embodiment of the present invention, the specific process of calculating the website security value WZZ is as follows:

[0021] Obtain the corresponding values ​​generated by the information security warning, including: threat value L1, authentication value L2, validity value L3, and content scan value L4; calculate the corresponding values ​​comprehensively using the set weighted calculation formula: WZZ=L1k×a1+L2×a2+L3×a3+L4×a4, and output the website security value WZZ, where a1, a2, a3, and a4 are the preset weights for the threat value, authentication value, validity value, and content scan value, respectively, and a1+a2+a3+a4=1; if no corresponding value is generated, the corresponding value is 0; if the browsed website does not contain malicious code, scripts, or suspicious plugins, and there are no abnormalities or malice, then the content scan value L4=0.

[0022] In a preferred embodiment of the present invention, the specific process of monitoring the installation of the program is as follows:

[0023] Run the installer in a virtual machine with standard user privileges, follow the installation wizard provided by the program, and record the installation path, options, and user interactions. After the program is installed, monitor and record files created, modified, or deleted during the installation process in real time, track registry changes during the installation process, compare before and after, and identify newly added or modified registry entries. For file size changes, use a defined formula: Output file size change value ΔF, S 新 S 旧 The file sizes before and after installation are shown respectively; regarding changes in registry values: Output the magnitude of the registry value change, ΔR, V. 新 The latest value of the registry key, V 旧 The original value of the registry key, W F As a weighting factor;

[0024] The file size change magnitude value ΔF is combined with the registry value change magnitude value ΔR, and the comprehensive magnitude value ZFZ is output through the established formula: ZFZ=ΔF×b1+ΔR×b2, where b1 and b2 are the respective preset correction factors.

[0025] As a preferred embodiment of the present invention, the specific process of calculating the abnormal growth coefficient AGC of the calculation program is as follows:

[0026] Calculation formula: Output the abnormal growth coefficient AGC, where ΔR t It is the change in resource usage (such as changes in memory or CPU) within a time interval T, μ R It is the historical average change in resource use, σ R It is the historical standard deviation of resource use changes, used to measure the normal range of fluctuations; ΔR t By regularly monitoring and recording the program's resource usage value R at different points in time. t Calculate the change in resources within each time interval T using the formula: ΔR t =R t+T -R t Then, use historical data to calculate the average value μ of the change in resource usage. R and standard deviation σ R Through formula Where n is the number of historical data samples.

[0027] As a preferred embodiment of the present invention, the specific process for obtaining the device connection type risk factor, operating system vulnerability density risk factor, malware infection probability, data encryption coverage, and network behavior anomaly rate is as follows:

[0028] The risk factor YZ1 for device connection type is calculated, with wired connection risk factor YZ1 set to 0.1 and wireless connection risk factor YZ1 set to 0.3; the risk factor YZ2 for operating system vulnerability density is calculated, where vulnerability density is the ratio of the number of known vulnerabilities in an operating system version to the number of installed versions of that operating system. The malware infection probability YZ3 is calculated to determine whether the device is at risk of malware infection, based on the device's historical data, known malware samples, and security measures. The historical probability of device infection is directly obtained as the malware infection probability YZ3. The data encryption coverage rate YZ4 is calculated to determine the percentage of encrypted data stored on the device. The network behavior anomaly rate YZ5 is calculated by using the device's network traffic data to determine the percentage of abnormal traffic.

[0029] In a preferred embodiment of the present invention, the specific process of obtaining the safety risk value FXZ by weighted summation of various risk factors according to different weights is as follows:

[0030] The risk factors are weighted and summed according to different weights to obtain the preset weight of each factor; using the set formula: Output the safety risk value FXZ, where cj is the preset weight of the j-th factor, and m = 5.

[0031] Secondly, the present invention provides a network information security defense and detection system, comprising: a website security inspection module, a download security inspection module, an access security inspection module, and a display and execution module;

[0032] The website security inspection module performs security checks on websites visited by users. It mainly checks the website's domain name and URL, verifies the trustworthiness of the HTTPS certificate, scans the website for malicious code or suspicious plugins, and finally generates and outputs the website's security assessment results.

[0033] The download security module verifies the integrity of files downloaded by users to ensure that the files have not been tampered with. It uses a virtual machine to run in isolation and monitor the installation process, tracks changes to files and the registry, and calculates potential security risks.

[0034] The security inspection module analyzes the security risks when external devices connect to the system, calculates the device connection type, operating system vulnerabilities, and malware infection risk factors, and comprehensively calculates the security risk value of the device.

[0035] The display execution module is responsible for showing the evaluation results of each security detection module by displaying security alerts and risk values.

[0036] Compared with the prior art, the beneficial effects of the present invention are:

[0037] 1. This invention combines a multi-layered detection mechanism and a comprehensive computing system to effectively identify and respond to various network threats. By conducting security checks on website browsing, downloaded installation programs, and external access devices, this invention employs domain name and URL checks, HTTPS certificate verification, content scanning, and file integrity verification to ensure that different types of security risks are detected and addressed in a timely manner. Simultaneously, by combining virtual machine isolation technology and behavior monitoring, it prevents malicious programs from directly harming the host system, thereby enhancing overall security protection capabilities.

[0038] 2. This invention analyzes the security of external access devices, taking into account various risk factors such as connection type, operating system vulnerabilities, and malware infection probability, to calculate the security risk value of the device and take corresponding protective measures according to different risk levels. Through abnormal behavior analysis and resource usage growth monitoring, this invention enhances the ability to prevent unknown threats and ensures the security of the network environment and the protection of data. Attached Figure Description

[0039] To facilitate understanding by those skilled in the art, the present invention will be further described below with reference to the accompanying drawings.

[0040] Figure 1 This is a diagram illustrating the method steps of the present invention;

[0041] Figure 2 This is a schematic diagram of the principle of the present invention. Detailed Implementation

[0042] The technical solution of the present invention will be clearly and completely described below with reference to the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0043] Example 1

[0044] Please see Figure 1 As shown, a network information security defense detection method includes:

[0045] Step 1: Perform network information security checks on the websites you are browsing. The specific process is as follows:

[0046] S101: Perform domain name and URL checks on visited websites: Use a threat intelligence database to match the accessed domain name and URL to detect whether they are related to known malicious or phishing websites. If they are related to known malicious or phishing websites, issue a security warning directly and match the corresponding preset value one, recorded as threat value L11. If they are not related, use appropriate tools to identify whether the URL contains suspicious characters or excessively long subdomains, indicating characteristics of phishing or malicious websites. If it contains suspicious characters or excessively long subdomains, issue a security warning, and similarly match the corresponding preset value two, recorded as threat value L12.

[0047] S102: Verify the HTTPS certificate of the website being browsed: First, verify the certificate authority to ensure that the HTTPS certificate is issued by a trusted certificate authority (CA); then check the validity of the certificate to see if it has expired or been revoked, and whether the domain name matches the actual domain name accessed; if the verification shows that the HTTPS certificate was issued by an untrusted certificate authority (CA), an information security warning is issued, matching the corresponding preset value three, recorded as the authentication value L2; if the validity check shows that the certificate has expired or been revoked, an information security warning is issued, matching the corresponding preset value four, recorded as the validity value L3.

[0048] S103: Perform website content scanning on the browsed website: Use security scanning tools to detect whether the website contains malicious code, scripts, or suspicious plugins; if the browsed website contains malicious code, scripts, or suspicious plugins, issue an information security warning, match the corresponding preset value five, and record it as the content scan value L4; otherwise, run the website's dynamic content in a sandbox environment to observe whether its behavior is abnormal or malicious; if abnormality or malice is found, issue an information security warning, and similarly record it as the content scan value L4;

[0049] S104: When an information security warning is received, the generated corresponding values ​​include: threat value L1, authentication value L2, validity value L3, and content scan value L4. These values ​​are then comprehensively calculated using the set weighting formula: WZZ = L1k×a1 + L2×a2 + L3×a3 + L4×a4 to output the website security value WZZ. Here, a1, a2, a3, and a4 are the preset weights for the threat value, authentication value, validity value, and content scan value, respectively, and a1 + a2 + a3 + a4 = 1, k = 1 or 2. If no corresponding value is generated, the corresponding value is 0. For example, if the website does not contain malicious code, scripts, or suspicious plugins, and there are no abnormalities or malice, then the content scan value L4 = 0. The website security value WZZ is then compared with a preset website security threshold to obtain the percentage of the website security value WZZ to the preset website security threshold, which is recorded as the website security percentage. This percentage is then displayed in a pop-up window in the display unit for the user to make a decision.

[0050] Step Two: Perform a network information security check on the downloaded installation program. The specific process is as follows:

[0051] S201: Verify the integrity of the downloaded file using the provided digital signature or hash value to ensure it has not been tampered with: Obtain the digital signature or hash value (such as SHA-256 or MD5) associated with the downloaded file from a trusted source; the hash value is usually provided on the file download page or in the official documentation; perform a hash calculation on the downloaded file using a hashing tool or command line (such as shasum, md5sum) to generate the file's hash value; compare the calculated hash value with the original hash value obtained from the trusted source; if the two hash values ​​match, the file is intact and has not been tampered with; otherwise, if the two hash values ​​do not match, the file has been tampered with or an error occurred during the download process, triggering a network security tampering alert and display; if the user insists on downloading, proceed to the next step.

[0052] S202: Start an isolated virtual machine: First, choose a reliable virtualization tool, such as VMware, VirtualBox, or Hyper-V, and install a securely configured operating system. At the same time, ensure network isolation between the virtual machine and the host through NAT mode or disconnecting the network. Before running any programs, create an initial snapshot to record the initial state of the virtual machine and save the snapshot properly to provide a guarantee for subsequent system recovery.

[0053] S203: Run the installer in a virtual machine with standard user privileges, follow the installation wizard provided by the program, and record the installation path, options, and user interactions;

[0054] After program installation, it monitors and records files created, modified, or deleted during the installation process in real time, tracks registry changes during installation, compares before and after installation, and identifies newly added or modified registry entries; it also uses a defined formula to account for changes in file size: Output the magnitude of the file size change ΔF, where S 新 S 旧 The file sizes before and after installation are shown respectively; regarding changes in registry values: Output the magnitude of the registry value change, ΔR, where V 新 The latest value of the registry key, V 旧 The original value of the registry key, W F W represents the weighting factors, reflecting the degree of influence of different factors on the change. F It is a weight set according to different factors, denoted as W. F =W 安装 +W 设置 +W 驱动 +W 恶意软件 +W 用户操作 +W 崩溃 +W 自动化 +W 配置 +W 清理 Each weight represents the degree of influence of the corresponding factor, with a value ranging from 0 to 1, reflecting the importance of the factor to the change of the registry entry. The specific value shall be set by those skilled in the art.

[0055] The file size change magnitude value ΔF is combined with the registry value modification magnitude value ΔR, and a comprehensive magnitude value ZFZ is output using the established formula: ZFZ = ΔF × b1 + ΔR × b2, where b1 and b2 are their respective preset correction factors. The comprehensive magnitude value ZFZ is then compared with a preset magnitude threshold. If the comprehensive magnitude value ZFZ is greater than the preset magnitude threshold, it indicates that files have been created, modified, or deleted after the program was installed, resulting in registry changes, and a network security installation alert is triggered and displayed; then proceed to the next step.

[0056] S204: Perform growth analysis (including potential growth analysis) on the downloaded or installed program. The specific process is as follows:

[0057] The abnormal growth coefficient (AGC) of the calculation program is used to assess whether the growth in resource usage is abnormal. It is calculated using the following formula: Output the abnormal growth coefficient AGC, where ΔR t It is the change in resource usage (such as changes in memory or CPU) within a time interval T, μ R It is the historical average change in resource use, σ R It is the historical standard deviation of resource use changes, used to measure the normal range of fluctuations; ΔR t By regularly monitoring and recording the program's resource usage value R at different points in time. t Calculate the change in resources within each time interval T using the formula: ΔR t =R t+T -R t Then, use historical data to calculate the average value μ of the change in resource usage. R and standard deviation σ R Through formula Where n is the number of historical data samples;

[0058] The abnormal growth coefficient AGC is compared with the preset constant growth threshold. If the abnormal growth coefficient AGC is greater than the preset constant growth threshold, it is determined to be abnormal growth, and an abnormal growth alarm is triggered and displayed.

[0059] Step 3: Perform network information security testing on externally accessed data. The specific process is as follows:

[0060] External access data includes: external network access data and external device access data;

[0061] When connected to an external network, the corresponding alarms are obtained through analysis using steps one and two above.

[0062] When connecting external devices, the security risks of these devices are calculated, specifically:

[0063] S301: Determine the security risk factors of external access devices; the security risk factors of each external access device consist of multiple different technical indicators, including: device connection type risk factor YZ1, operating system vulnerability density risk factor YZ2, malware infection probability YZ3, data encryption coverage rate YZ4, and network behavior anomaly rate YZ5.

[0064] The risk factor YZ1 for device connection type is calculated, and the risk factor YZ1 for wired connection is set to 0.1 and the risk factor YZ1 for wireless connection is set to 0.3. If device 3 uses other connection methods, the risk factor is defined according to the actual situation.

[0065] The vulnerability density risk factor YZ2 for operating systems is calculated. Vulnerability density is the ratio of the number of known vulnerabilities in an operating system version to the number of installations of that operating system version. The higher the vulnerability density, the higher the risk factor of the device.

[0066] The probability of malware infection YZ3 is calculated to determine whether a device is at risk of malware infection. This is mainly based on the device's historical records, known malware samples, and security protection measures. The historical probability of the device being infected is directly obtained as the malware infection probability YZ3.

[0067] The data encryption coverage rate YZ4 is calculated to determine the percentage of encrypted data stored on the device. Low encryption coverage indicates a higher security risk for the device.

[0068] The network behavior anomaly rate YZ5 is calculated (whether the device exhibits abnormal network behavior, such as frequent communication with unauthorized external IP addresses, access to unknown or sensitive resources, etc.). The percentage of abnormal traffic is calculated using the device's network traffic data.

[0069] S302: Weight each risk factor according to its own weight and sum them to obtain the preset weight for each factor; using the defined formula: Output the safety risk value FXZ, where cj is the preset weight of the j-th factor, j = 1, 2, 3, 4, 5; then match the obtained safety risk value FXZ with preset intervals, which include interval 1, interval 2, and interval 3; if the safety risk value FXZ belongs to interval 1, maintain the current safety measures and monitor regularly; if the safety risk value FXZ belongs to interval 2, strengthen the equipment's safety measures and update and inspect regularly.

[0070] If the security risk value FXZ falls within range three, immediate measures such as isolation and in-depth inspection should be taken to prevent potential threats, and an alert and display should be issued indicating abnormal data.

[0071] Example 2

[0072] Please see Figure 2 As shown, a network information security defense and detection system includes: a website security inspection module, a download security inspection module, an access security inspection module, and a display and execution module;

[0073] The website security inspection module performs security checks on websites visited by users. It mainly checks the website's domain name and URL, verifies the trustworthiness of the HTTPS certificate, scans the website for malicious code or suspicious plugins, and finally generates and outputs the website's security assessment results.

[0074] The download security module verifies the integrity of files downloaded by users to ensure that the files have not been tampered with. It uses a virtual machine to run in isolation and monitor the installation process, tracks changes to files and the registry, calculates potential security risks, and ensures that the program installation process does not pose a threat to the system.

[0075] The security inspection module analyzes the security risks when external devices connect to the system, calculates multiple risk factors such as device connection type, operating system vulnerabilities, and malware infection, and comprehensively calculates the security risk value of the device to determine whether security protection measures need to be taken.

[0076] The display execution module is responsible for showing the evaluation results of each security detection module. By displaying security alerts and risk values, it helps users understand the system's security status in a timely manner and make corresponding decisions and countermeasures based on the displayed security information.

[0077] The preferred embodiments of the present invention disclosed above are merely illustrative of the invention. These preferred embodiments do not exhaustively describe all details, nor do they limit the invention to specific implementations. Clearly, many modifications and variations can be made based on the content of this specification. This specification selects and specifically describes these embodiments to better explain the principles and practical applications of the invention, thereby enabling those skilled in the art to better understand and utilize the invention. The invention is limited only by the claims and their full scope and equivalents.

Claims

1. A network information security defense and detection method, characterized in that, include: Step 1: Perform a network information security test on the website being browsed to obtain the website security value, and compare it with a preset threshold to display the security percentage; Step Two: Perform a network information security check on the downloaded installation program. The specific process is as follows: S201: Perform integrity verification on downloaded files: Use digital signatures or hash values ​​to verify whether downloaded files have been tampered with. If the hash values ​​do not match, trigger a tampering alarm. S202: Start Virtual Machine Isolation Test: Use virtualization tools to start a securely configured virtual machine, create an initial snapshot, and ensure network isolation from the host. S203: Monitor program installation: Install the program in a virtual machine with standard user privileges, monitor file and registry changes in real time, calculate the magnitude of file size changes and registry value changes, calculate the comprehensive magnitude value, and compare it with a preset threshold. If the threshold is exceeded, an installation alarm is triggered. S204: Program growth analysis: Calculate the abnormal growth coefficient of the program to analyze the abnormality of resource usage growth. If the abnormal growth coefficient exceeds the preset threshold, trigger an abnormal growth alarm. Step 3: Perform network information security testing on externally accessed data. The specific process is as follows: When connecting external devices, the security risks of the external access devices are calculated, and the security risk factors of the external access devices are determined, resulting in device connection type risk factor, operating system vulnerability density risk factor, malware infection probability, data encryption coverage, and network behavior anomaly rate; each risk factor is weighted and summed according to different weights to obtain the security risk value. Next, match the safety risk value with the preset range; if the safety risk value belongs to range one, maintain the current safety measures and monitor regularly; if the safety risk value FXZ belongs to range two, strengthen the equipment's safety measures and update and test regularly.

2. The network information security defense detection method according to claim 1, characterized in that, The specific process of obtaining a website security value by performing network information security detection on the browsed website is as follows: S101: Perform domain name and URL checks on visited websites: Use the threat intelligence database to check the accessed domain name and URL. If they are related to known malicious or phishing websites, issue a warning and record it as a threat value L1. If there is no relevance, check the URL for suspicious characters or excessively long subdomains. If found, issue a warning and record it as L1. S102: Perform HTTPS certificate verification on the website being browsed: Verify the certificate authority and the validity of the certificate. If the certificate is untrusted or has expired / revoked, issue a warning and record it as authentication value L2 and validity value L3, respectively. S103: Perform website content scanning on the website being browsed: Use tools to check if the website contains malicious code or suspicious plugins. If so, issue a warning and record it as content scan value L4; otherwise, run dynamic content in the sandbox. If any abnormality or malice is found, issue a warning and record it as L4. S104: Calculate the website security value and compare it with the preset threshold, displaying the security percentage for the user to decide.

3. The network information security defense detection method according to claim 2, characterized in that, The specific process for calculating the website security value WZZ is as follows: Obtain the corresponding values ​​generated by the information security warning, including: threat value L1, authentication value L2, validity value L3, and content scan value L4; calculate the weighted value of the corresponding values ​​and output the website security value. If no corresponding value is generated, the corresponding value is zero.

4. The network information security defense and detection method according to claim 1, characterized in that, The specific process for monitoring the installation of the program is as follows: Run the installer in a virtual machine with standard user privileges, follow the installation wizard provided by the program, and record the installation path, options, and user interactions. After the program is installed, monitor and record files created, modified, or deleted during the installation process in real time, track registry changes during the installation process, compare before and after, and identify newly added or modified registry entries. Regarding changes in file size: Output file size change value ΔF, S 新 S 旧 The file sizes before and after installation are shown respectively; regarding changes in registry values: Output the magnitude of the registry value change, ΔR, V. 新 The latest value of the registry key, V 旧 The original value of the registry key, W F As a weighting factor; The combined magnitude value ZFZ is output by combining the file size change magnitude value ΔF and the registry value change magnitude value ΔR using the established formula: ZFZ=ΔF×b1+ΔR×b2, where b1 and b2 are their respective preset correction factors.

5. The network information security defense detection method according to claim 1, characterized in that, The specific process for calculating the abnormal growth coefficient AGC in the aforementioned program is as follows: Calculation formula: Output the abnormal growth coefficient AGC, where ΔR t The change in resource usage within a time interval T, μ R It is the historical average change in resource use, σ R It is the historical standard deviation of resource use changes, used to measure the normal range of fluctuations; ΔR t By regularly monitoring and recording the program's resource usage value R at different points in time. t Calculate the change in resources within each time interval T using the formula: ΔR t =R t+T -R t Then, use historical data to calculate the average value μ of the change in resource usage. R and standard deviation σ R Through formula Where n is the number of historical data samples.

6. The network information security defense detection method according to claim 1, characterized in that, The specific process for obtaining the device connection type risk factor, operating system vulnerability density risk factor, malware infection probability, data encryption coverage, and network behavior anomaly rate is as follows: The risk factor YZ1 for device connection type is calculated, with wired connection risk factor YZ1 set to 0.1 and wireless connection risk factor YZ1 set to 0.3; the risk factor YZ2 for operating system vulnerability density is calculated, where vulnerability density is the ratio of the number of known vulnerabilities in an operating system version to the number of installed versions of that operating system. The malware infection probability YZ3 is calculated to determine whether the device is at risk of malware infection, based on the device's historical data, known malware samples, and security measures. The historical probability of device infection is directly obtained as the malware infection probability YZ3. The data encryption coverage rate YZ4 is calculated to determine the percentage of encrypted data stored on the device. The network behavior anomaly rate YZ5 is calculated by using the device's network traffic data to determine the percentage of abnormal traffic.

7. The network information security defense detection method according to claim 1, characterized in that, The specific process of obtaining the safety risk value FXZ by weighted summation of various risk factors according to different weights is as follows: The risk factors are weighted and summed according to different weights to obtain the preset weight of each factor; using the set formula: Output the safety risk value FXZ, where cj is the preset weight of the j-th factor, and m = 5.

8. A network information security defense and detection system, characterized in that, The system is designed to implement any one of the network information security defense and detection methods according to claims 1-7, and includes: a website security inspection module, a download security inspection module, an access security inspection module, and a display and execution module. The website security inspection module performs security checks on websites visited by users. It mainly checks the website's domain name and URL, verifies the trustworthiness of the HTTPS certificate, scans the website for malicious code or suspicious plugins, and finally generates and outputs the website's security assessment results. The download security module verifies the integrity of files downloaded by users to ensure that the files have not been tampered with. It uses a virtual machine to run in isolation and monitor the installation process, tracks changes to files and the registry, and calculates potential security risks. The security inspection module analyzes the security risks when external devices connect to the system, calculates the device connection type, operating system vulnerabilities, and malware infection risk factors, and comprehensively calculates the security risk value of the device. The display execution module is responsible for showing the evaluation results of each security detection module by displaying security alerts and risk values.

Images