Full-link network security supervision system

Abstract

The invention provides a full-link network security supervision system, and relates to the field of network security, and the system comprises a full-link security technology prevention and control system which is used for building full-link monitoring capability covering cloud, network, end, boundary, data and application; the full-link security data management system is used for integrating, archiving and applying the supervision data and the threat intelligence library data and providing data services; the full-link safety supervision service system is used for providing various service functions which at least comprise asset management, asset governance, real-time monitoring, alarm management, disposal notification, analysis, study and judgment, safety think tank, knowledge base and case library management, authority management, inspection supervision, assessment and evaluation, emergency command and full-link visual display. And the comprehensive network security situation awareness and coordination command capability is provided, and the system has the advantage of realizing all-around network security monitoring and management.

Description

Technical Field

[0001] The present invention relates to the field of network security, and particularly to a full-link network security supervision system. Background Art

[0002] With the rapid development of Internet technology, e-government systems have become important support platforms for management and services. While the widespread application of e-government systems improves administrative efficiency, it also poses higher requirements for network security. However, most existing network security supervision means have the following limitations: 1. Serious data island phenomenon: The security log formats generated by different security devices are diverse, lacking a unified standard for sorting and integration, resulting in security incidents being difficult to be discovered in time and effectively addressed.

[0003] 2. Lack of intelligence sharing mechanism: Resources such as security device feature libraries, threat libraries, and virus libraries of each unit are independent of each other, lacking an efficient intelligence sharing mechanism, which restricts the improvement of security defense capabilities.

[0004] 3. Lag in security risk response: Due to the lack of a unified security management platform, the handling of security incidents often relies on manual intervention, with a slow response speed and difficulty in adapting to the rapidly changing network security situation.

[0005] 4. Great difficulty in cross-departmental collaboration: In the face of major network security incidents, it is difficult for each unit to achieve efficient information sharing and collaborative disposal, affecting the overall security defense effect.

[0006] 5. Inefficient responsibility division and management: E-government systems involve many units and roles. Traditional security management methods are difficult to effectively divide responsible persons, management personnel, and relevant roles, resulting in low security management efficiency.

[0007] Therefore, a full-link network security supervision system is needed to achieve all-round network security monitoring and management. Summary of the Invention

[0008] The present invention provides a full-link network security supervision system, including: a full-link security technology prevention and control system for establishing full-link monitoring capabilities covering cloud, network, terminal, boundary, data, and applications; a full-link security data governance system for integrating, archiving, applying, and providing data services for supervision data and threat intelligence database data; a full-link security supervision service system for providing multiple service functions, where the multiple service functions at least include asset management, asset governance, real-time monitoring, alarm management, disposal notification, analysis and judgment, security think tank, knowledge base and case library management, permission management, inspection and supervision, assessment, emergency command, and full-link visualization display, and providing comprehensive network security situation awareness and coordinated command capabilities.

[0009] Furthermore, the full-link security technology prevention and control system includes: a government cloud instance monitoring module for monitoring government cloud storage, cloud hosts, government cloud networks, and big data platforms; an Internet access terminal monitoring module for identifying Internet access terminals and providing terminal asset information management functions; an application system monitoring module for performing network asset detection, fingerprint recognition, unit and personnel management on government extranet applications with IP addresses; and a database monitoring module for using network asset component recognition technology based on a fingerprint database to send requests to the ports of a host, determine whether the ports are open, and use fingerprint comparison technology and the fingerprint database to identify the host type and the components used, and discover database-related assets.

[0010] Furthermore, the Internet access terminal monitoring module identifies Internet access terminals, including: actively sending detection messages to Internet access terminals in the network through a scanner, and performing pattern recognition on the detection response messages of Internet access terminals based on the terminal fingerprint information returned by the Internet access terminals when responding to the detection messages, so as to identify the characteristic information of Internet access terminals.

[0011] Furthermore, the full-link security technology prevention and control system further includes: an availability monitoring module for using distributed nodes to perform data monitoring, in the form of multi-link and multi-point monitoring, to discover the multi-line access availability of key application systems in different regions, and also for capturing data packets accessing the database system through a traffic proxy for database auditing and sending the data packets accessing the database system to the database auditing system, and continuously sampling the basic information, tablespace, I / O, CPU usage rate, and memory occupancy rate of the database system to determine the basic health indicators of the database system operation.

[0012] Furthermore, the full-link security technology prevention and control system further includes: an event monitoring module for monitoring network attack events, domain name resolution anomalies, broadcast fraud, system intrusion events, harmful program events, domain name resolution anomalies, email threats, virus and trojan horses, Web threats, and vulnerabilities; a scanning monitoring module for monitoring government extranet IP assets, domain name assets, hosts, and applications; and a log monitoring module for collecting logs and performing log monitoring.

[0013] Furthermore, the full-link security data governance system includes: a security data middle platform for integrating, archiving, and applying regulatory data and threat intelligence library data and providing data services for the full-link security supervision service system; and a security capability middle platform for service-ifying various security capabilities based on security requirements in various dimensions to form a security service catalog and performing security resource scheduling.

[0014] Furthermore, the security data middle platform includes: a security data integration module for collecting diverse heterogeneous logs, full-flow data, asset information, vulnerability information, and synchronizing data collected from third-party platform interfaces; a data collection management module for managing the data collection of the security data integration module; a data standardization module for standardizing the security data collected by the security data integration module; a threat intelligence data collection module for collecting and accumulating threat intelligence; a data aggregation and processing module for classifying and storing the security data collected by the security data integration module and the threat intelligence collected by the threat intelligence data collection module; and a security data management module for performing metadata management, data standard management, data quality management, data storage management, and data dictionary management.

[0015] Furthermore, the security capability middle platform includes: a security capability center for determining a security capability catalog, including security detection capabilities, intelligent security analysis capabilities, and situation awareness capabilities; and security capability management for determining security capability scheduling and practical capabilities, including capabilities orchestration, capabilities scheduling, policy management, and scenario management functions.

[0016] Furthermore, the full-link security supervision service system conducts full-link visual display, including: displaying the security situation, asset monitoring, hidden danger monitoring, availability monitoring, event monitoring, organizational guarantee, real-time notification content, and basic information of the security operation center in each region.

[0017] Furthermore, the full-link security supervision service system is also used for: conducting security analysis from multiple levels, where the multiple levels include intelligence collision, asset threat analysis, security event analysis, risk and hidden danger, and network attack.

[0018] Compared with the prior art, the full-link network security supervision system provided by the present invention has at least the following beneficial effects: The full-link network security supervision system realizes the ability to detect the state changes and threats of 5 types of assets, such as government affairs clouds, backbone network devices, networked terminals, various application systems / databases, etc., by establishing full-link monitoring capabilities covering clouds, networks, terminals, boundaries, data, applications, etc., and conducts round-the-clock real-time security monitoring for important websites or application systems. It uses a combination of technical means and manual verification to monitor whether the website service is available and whether the service quality is stable, and promptly warns and notifies the discovered information security hidden dangers (such as weak passwords, high-risk vulnerabilities, high-risk ports, security baselines (configuration errors), procedural malicious behaviors, abnormal behaviors, data high-risk operations) or various security events (such as network attack events, system intrusion events, harmful program events, data destruction events, content security events, abnormal situation events), and conducts closed-loop processing of work orders.

[0019] To avoid the information silos of monitoring data, various types of security data required for threat analysis are uniformly collected, processed, and stored to establish a security data middle platform, achieving efficient processing capabilities for security big data. The security data middle platform needs to process the multi-source heterogeneous data collected, including data cleaning, filtering, extraction, standardization, tagging, etc., to improve data quality, standardize data processing processes, optimize data services, build a security resource library, generate data association information, and provide security analysis capabilities such as association rules, statistical modeling, scenario association analysis modeling, intelligence modeling, and machine modeling through the security data scenario analysis module. Brief Description of the Drawings

[0020] This specification will be further described by way of exemplary embodiments, which will be described in detail through the drawings. These embodiments are not restrictive. In these embodiments, the same numbers represent the same structures, where: Figure 1 is a schematic diagram of data interaction of the full-link network security supervision system shown in some embodiments of this specification; Figure 2 is a schematic diagram of the overall architecture of the full-link network security supervision system shown in some embodiments of this specification; Figure 3 is a schematic diagram of the function of the application system monitoring module shown in some embodiments of this specification; Figure 4 is a schematic diagram of the modules of the security capability middle platform shown in some embodiments of this specification; Figure 5 is a business logic design diagram of the asset management module shown in some embodiments of this specification; Figure 6 is a schematic diagram of data interaction of the real-time monitoring module shown in some embodiments of this specification; Figure 7 is a schematic diagram of the process of the disposal notice shown in some embodiments of this specification; Figure 8 is a schematic diagram of the full-link visualization display shown in some embodiments of this specification. Detailed Embodiments

[0021] To more clearly illustrate the technical solutions of the embodiments of this specification, the following will briefly introduce the drawings required for the description of the embodiments. Obviously, the drawings in the following description are only some examples or embodiments of this specification. For those of ordinary skill in the art, without creative efforts, this specification can also be applied to other similar scenarios based on these drawings. Unless obvious from the language context or otherwise stated, the same reference numerals in the drawings represent the same structures or operations.

[0022] Figure 1 is a schematic diagram of data interaction of the full-link network security supervision system shown in some embodiments of this specification. As Figure 1 shown, the full-link network security supervision system builds a full-link network security supervision platform that covers cloud, network, endpoint, boundary, data, and applications. By combining the security data of the existing e-government networks at the municipal and district / county levels, it standardizes and integrates the security logs generated by various devices in the existing network to form a security situation covering "cloud, network, endpoint, data, application, and boundary". At the same time, it provides services to each unit through the public interface service. The security device feature libraries, threat libraries, virus libraries, and other related assets of each unit can also obtain public threat intelligence services through authorization to empower local security products. After data governance by aggregating and mining network security risk data, multi-source threat intelligence data, etc., it is uniformly synchronized to the full-link network platform for security management, and vertical linkages at the provincial, municipal, and county levels and horizontal linkages of security risk data with the municipal Internet Information Office and public security departments are formed. At the same time, the full-link network security supervision platform is connected to the Zhejiang Government Affairs Ding system to effectively divide the responsible persons, management personnel, and relevant roles of each unit related to e-government. Security incidents and intelligence are quickly conveyed to the relevant units for handling.

[0023] Figure 2 is a schematic diagram of the overall architecture of the full-link network security supervision system shown in some embodiments of this specification. As Figure 2 shown, the full-link network security supervision system includes a full-link security technology prevention and control system, a full-link security data governance system, and a full-link security supervision service system. By establishing full-link monitoring capabilities covering cloud, network, endpoint, boundary, data, applications, etc., it realizes the ability to detect changes in the status and threats of 5 types of assets, namely government clouds, backbone network devices, networked endpoints, various application systems / databases, etc. It conducts round-the-clock real-time security monitoring of important websites or application systems, and uses a combination of technical means and manual verification to monitor whether the website services are available and whether the service quality is stable. It promptly warns and notifies the information security hazards (such as weak passwords, high-risk vulnerabilities, high-risk ports, security baselines (configuration errors), procedural malicious behaviors, abnormal behaviors, high-risk data operations) or various security incidents (such as network attack incidents, system intrusion incidents, harmful program incidents, data destruction incidents, content security incidents, abnormal situation incidents) found during the monitoring and conducts closed-loop handling of work orders.

[0024] To avoid the information silos of monitoring data, various types of security data required for threat analysis are uniformly collected, processed, and stored to establish a security data center, achieving efficient processing capabilities for security big data. The security data center needs to process the multi-source heterogeneous data collected, including data cleaning, filtering, extraction, standardization, tagging, etc., to improve data quality, standardize data processing processes, optimize data services, build a security resource library, generate data association information, and provide security analysis capabilities such as association rules, statistical modeling, scenario association analysis modeling, intelligence modeling, and machine modeling through the security data scenario analysis module.

[0025] Establish a full-link network security supervision service system covering cloud, network, endpoint, boundary, data, and application, providing business functions including asset management, asset governance, real-time monitoring, alarm management, disposal notification, analysis and judgment, security think tank, knowledge base and case base management, permission management, inspection and supervision, assessment, emergency command, and full-link visual display, and supporting corresponding on-site operation services.

[0026] The following is a detailed description of each part.

[0027] In some embodiments, the full-link security technology prevention and control system includes: A government cloud instance monitoring module for monitoring government cloud storage, cloud hosts, government cloud networks, and big data platforms; An internet-connected terminal monitoring module for identifying internet-connected terminals and providing terminal asset information management functions; An application system monitoring module for network asset detection, fingerprint recognition, unit and personnel management of government extranet applications with IP addresses; A database monitoring module for identifying network asset components based on fingerprint library technology, sending requests to the ports of the host to determine whether the ports are open, and using fingerprint comparison technology and fingerprint library to identify the host type and components used according to the port return information to discover database-related assets.

[0028] Specifically, for government cloud storage, through the terminal security management device, monitor the cloud host CPU, memory, disk, and network inbound and outbound traffic, and send an alarm in a timely manner when the user-configured threshold is reached to prevent system resource exhaustion.

[0029] For example only, the CPU usage threshold is set to 80%, and an alarm is triggered when the CPU usage continuously exceeds this threshold. The memory usage threshold is set to 90%, and an alarm notification is sent when the memory usage approaches or exceeds this threshold. The disk space usage threshold is set to 85%, and an alarm is triggered when the disk space usage exceeds this threshold, prompting the administrator to expand the capacity or clean up useless data. The network inbound and outbound traffic thresholds are set according to business requirements, such as being set to 1 Gbps, and a traffic alarm is sent when the traffic exceeds this threshold. When the monitored metrics reach or exceed the preset thresholds, the terminal security management device automatically sends an alarm notification to the administrator's email or mobile phone text message. The alarm information includes detailed information such as the name of the cloud host that triggered the alarm, the alarm type, the current value, the threshold, and the alarm time. After receiving the alarm, the administrator takes corresponding countermeasures according to the alarm type, such as increasing CPU resources, expanding the memory capacity, cleaning up the disk space, or adjusting the network traffic policy, etc.

[0030] For cloud hosts with IP addresses, through the custom IP segment detection function, a full-port scan detection is performed on all cloud hosts with IP addresses to discover the open ports, provided services, protocols, etc., and supports custom scanning of port and IP information.

[0031] For example only, define the scanned IP segment, such as 192.168.1.0 / 24. Set the scanned port range, such as 1 - 65535. Configure the scanning speed to avoid imposing too much load on the target cloud host. Automatically perform a full-port scan on the cloud hosts in the specified IP segment to detect the open ports and the services and protocols they provide. The scan results are displayed in a list, including information such as the IP address, port number, service name, and protocol type. Analyze the security status of the cloud host based on the scan results to identify potential security vulnerabilities and risk points. For the discovered open ports and services, take corresponding security measures, such as closing unnecessary ports, strengthening service configurations, or deploying security devices, etc.

[0032] For the e-government cloud network and the big data platform, through docking with the Alibaba Cloud platform, the monitoring of this part of the e-government cloud instances is realized.

[0033] For example, configure API access permissions on the Alibaba Cloud platform to allow the government cloud platform to access the monitoring data of cloud instances. Set monitoring rules and data collection frequencies on the government cloud platform to ensure real-time acquisition of the running status of cloud instances. Automatically collect key metrics such as CPU usage, memory usage, disk I / O, and network traffic of cloud instances. Compare the collected data with preset thresholds and trigger an alarm when the metrics exceed the thresholds. Store the monitoring data in a big data platform for in-depth analysis and visual display. Present the running trends and anomalies of cloud instances in the form of charts and reports to help administrators quickly locate problems and take corresponding measures. When a serious failure or security event occurs in a monitored cloud instance, the system automatically triggers an emergency response process. The administrator conducts fault troubleshooting, restores services, or initiates a security event handling process according to the emergency response plan.

[0034] In some embodiments, the network access terminal monitoring module identifies network access terminals, including: The scanner actively sends probe messages to network access terminals in the network, and based on the terminal fingerprint information returned by the network access terminals when responding to the probe messages, performs pattern recognition on the probe response messages of the network access terminals to identify the characteristic information of the network access terminals.

[0035] Specifically, network access terminal identification is a basic function of network access terminal access management. By adopting an active identification method, the scanner actively sends probe messages to network access terminals in the network, and based on the terminal fingerprint information, performs pattern recognition on the probe response messages, so as to accurately identify information such as the type, manufacturer, operating system, IP address, and MAC address of network access terminals, and form an information management baseline for each network access terminal.

[0036] For the terminal information reported by the scanner, the EPS configuration management console provides a terminal asset information management function, supporting functions such as addition, change auditing, illegal scanning, alarm, isolation, or blocking of vacant terminals. The status of network access terminals is divided into two types: 1. Online status. Based on the regular polling results of the scanner, the online status of the terminal is divided into online and offline. 2. Compliance status. Whether a network access terminal is compliant includes three statuses: legal, illegal, and newly discovered. For network access terminals newly discovered and reported by the scanner, the terminal compliance status is newly discovered. After the user approves the terminal and baselineizes the terminal information, the status of the terminal changes from newly discovered to legal.

[0037] Figure 3 It is a functional schematic diagram of the application system monitoring module shown in some embodiments of this specification, such as Figure 3As shown in the figure, the application system monitoring module can detect and discover government extranet applications with IP addresses, including the local area networks and business private network applications of each unit accessing the government extranet. It mainly includes three functions: network asset detection, fingerprint recognition, and unit and personnel management, realizing strict file management for each asset, establishing the association relationship among assets, units, and personnel, and being able to quickly locate the person in case of risks or problems, facilitating subsequent notification, rapid response, and problem-solving.

[0038] The database monitoring module can implement the scanning and monitoring of database assets. By monitoring and scanning the IP segments of the whole city, it can identify the resources of each IP address. Through the network asset component recognition technology based on the fingerprint database, it sends requests to specific ports of the host to judge whether the ports are open, and according to the port return information, and uses the fingerprint comparison technology, combined with the independently developed fingerprint database, to identify the host type and the components used, and discover database-related assets.

[0039] Only as an example, the process by which the database monitoring module discovers database-related assets can include the following: S11. IP segment scanning: The database monitoring module first scans the IP segments within the whole city. For example, the scanning range can be set to 192.168.0.0 / 16, covering the public and private networks of the whole city. During the scanning process, the module sends specific network requests to each IP address to detect the online status and response of the host.

[0040] S12. Port detection: For the responding hosts, the monitoring module further sends requests to their specific ports to judge whether these ports are open. Common database ports include port 3306 for MySQL, port 1521 for Oracle, port 1433 for SQL Server, etc. The module sends TCP SYN or ACK packets for detection to these ports.

[0041] S13. Fingerprint comparison: When a certain port is detected to be open, the monitoring module performs fingerprint comparison according to the information returned by the port. The fingerprint comparison technology uses a fingerprint database, which contains the characteristic information of various database software, such as version, service name, response format, etc. By matching the detected information with the characteristics in the fingerprint database, the module can determine the host type and the database components used.

[0042] S14. Asset identification: Once the database type and components of the host are determined, the monitoring module will mark the asset as a database-related asset. Meanwhile, the database monitoring module will also collect other information about the asset, such as IP address, host name, operating system type, list of open ports, etc., for subsequent management and analysis.

[0043] Suppose during the scanning process, the monitoring module detects that a host with the IP address 192.168.1.100 responds on port 3306. After fingerprint comparison, the module determines that the host is running MySQL database software with version 5.7.31. At this time, the monitoring module will mark the asset as a MySQL database asset and record the following information: IP address: 192.168.1.100 Host name: (Suppose it is) dbserver1 Operating system type: (Suppose it is) Linux Open port: 3306 (MySQL) Database type: MySQL Database version: 5.7.31.

[0044] In some embodiments, the full-link security technology prevention and control system further includes: An availability monitoring module, which is used to perform data monitoring using distributed nodes, in the form of multi-link and multi-point monitoring, to discover the multi-line access availability of key application systems in different regions. It is also used to capture data packets accessing the database system through the traffic proxy of database auditing and send the data packets accessing the database system to the database auditing system. At the same time, it continuously samples the basic information, tablespace, I / O, CPU usage rate, and memory occupancy rate of the database system to determine the basic health indicators of the database system running.

[0045] Specifically, for key applications with relatively high real-time requirements, distributed nodes are used for data monitoring, in the form of multi-link and multi-point monitoring, to discover the multi-line access availability of key application systems in different regions. Real-time monitoring of the quality of key application services provides domain name resolution availability, website service availability, and website content availability monitoring of the target site, and can comprehensively understand the website availability status in real time. The monitoring period can be customized, supporting minute-level monitoring. The availability monitoring is divided into the following three categories: (1) Domain name resolution availability (2) Website service availability (3) Website content availability For the monitoring of the availability of critical databases, packets accessing the database system are captured through the traffic agent (Agent) of database auditing, and the database is sent to the database auditing system. It supports directly controlling the traffic agent software on the page, including starting, suspending, and stopping, etc., and can also monitor the running status of each traffic agent in real time.

[0046] At the same time, by continuously sampling the basic information of the database, such as tablespaces, I / O, CPU usage rate, memory occupancy rate, etc., the basic health indicators of the database operation are mastered. And continuously monitor the SQL sessions, active transactions, blocking activities, lock information, etc. of the database, so as to monitor the availability of critical databases.

[0047] In some embodiments, the full-link security technology prevention and control system further includes: An event monitoring module for monitoring network attack events, domain name resolution anomalies, broadcast fraud, system intrusion events, harmful program events, domain name resolution anomalies, email threats, virus trojans, Web threats, and vulnerability monitoring; A scanning and monitoring module for monitoring the IP assets, domain name assets, hosts, and applications of the e-government external network; A log monitoring module for collecting logs and performing log monitoring.

[0048] Specifically, event monitoring is implemented mainly from multiple aspects such as network attack event monitoring, domain name resolution anomaly monitoring, broadcast fraud monitoring, system intrusion event monitoring, harmful program event monitoring, domain name resolution anomaly monitoring, in-depth email threat monitoring, in-depth virus trojan (including worms, mining, ransomware, etc.) monitoring, in-depth Web threat monitoring, and high-risk vulnerability monitoring.

[0049] Use active scanning and monitoring devices to monitor the IP assets, domain name assets, hosts, and Web applications (covering e-government clouds, networks, terminals, applications, and databases) of the e-government external network, and avoid the occurrence of security events such as high-risk vulnerabilities, weak passwords, dark links, malware injection, black pages, and mining scripts.

[0050] The collector collects logs through Syslog, SNMP, FTP, plugin agents, etc. After pattern matching by parsing rules, these rules are usually formulated based on the format and content of the logs to identify and extract key information from the logs. This information includes both direct information (such as timestamps, event types, error codes, etc.) and indirect information (such as system status and user behavior inferred from the log content). The aggregated information will be transmitted to a specified storage system (such as a database, file system, or cloud storage, etc.) via a specific communication protocol (such as TCP / IP) for storage. At the same time, the collector also ensures the integrity and security of data during communication and storage to prevent information loss or leakage.

[0051] In some embodiments, the full-link security data governance system includes: A security data middle platform for integrating, archiving, applying regulatory data and threat intelligence database data, and providing data services for the full-link security supervision service system; A security capability middle platform for servitizing various security capabilities based on security requirements in various dimensions, forming a security service catalog, and scheduling security resources.

[0052] In some embodiments, the security data middle platform includes: A security data integration module for collecting multi-source heterogeneous logs, full-flow data, asset information, vulnerability information, and synchronizing data collection from third-party platform interfaces; A data collection management module for managing data collection of the security data integration module; A data standardization module for standardizing the security data collected by the security data integration module; A threat intelligence data collection module for collecting and accumulating threat intelligence; A data aggregation and processing module for classifying and storing the security data collected by the security data integration module and the threat intelligence collected by the threat intelligence data collection module; A security data management module for metadata management, data standard management, data quality management, data storage management, and data dictionary management.

[0053] Specifically, the security data middle platform realizes the integration, archiving, application of all regulatory data and threat intelligence database data, and the ability to provide data services to the upper layer; it includes two parts: a security big data center and a security big data analysis engine. Among them, the security big data center mainly provides functions such as data integration, data management, and data catalog, and provides data services to the upper layer through a unified data interface. The security big data analysis includes real-time analysis and offline analysis, and provides unified security big data analysis capabilities to the upper layer.

[0054] The security data integration module mainly includes various collection solutions such as multi-source heterogeneous log collection, full-traffic data collection, asset information collection, vulnerability information collection, and third-party platform interface synchronized data collection.

[0055] The data collection management module mainly includes data collection for critical infrastructure monitoring capabilities and traffic collection management, including collection probe deployment methods, collection protocols, frequencies, and extension management.

[0056] The data standardization module mainly standardizes data through means such as data extraction, cleaning, complementation, association, comparison, and tagging.

[0057] The threat intelligence function provides four methods for threat intelligence collection and accumulation, namely cloud collection, interface collection, local accumulation, and local import.

[0058] Data aggregation and storage is used to classify and store different types of collected data to meet the requirements of data analysis.

[0059] Security data management is the overall management of the availability, effectiveness, integrity, and security of data used in an organization. It improves data quality, standardizes data processing processes, and optimizes data services to continuously enhance the value of data assets. Data management includes metadata management, data standard management, data quality management, data storage management, and data dictionary management.

[0060] Figure 4 It is a schematic diagram of the modules of the security capability center platform shown in some embodiments of this specification. As Figure 4 shown, in some embodiments, the security capability center platform includes: The security capability center is used to determine the security capability catalog, including security detection capabilities, intelligent security analysis capabilities, and situation awareness capabilities; Security capability management is used to determine security capability scheduling and practical capabilities, including capabilities orchestration, capabilities scheduling, policy management, and scenario management functions.

[0061] Specifically, the security capability center platform focuses on security requirements in various dimensions, services various security capabilities, forms a security service catalog, realizes flexible scheduling of security resources, and has remarkable characteristics such as security visibility, controllability, manageability, automation of security resources, elastic expansion, and open compatibility.

[0062] The full-link security supervision service system provides comprehensive network security situation awareness and coordinated command capabilities by implementing business functions such as asset management, asset governance, real-time monitoring, alarm management, disposal notification, analysis and judgment, security think tank, knowledge base and case base management, permission management, inspection and supervision, assessment, emergency command, and full-link visual display, combined with the concept of dual-drive of technology and management.

[0063] Figure 5 It is a business logic design diagram of the asset management module shown in some embodiments of this specification. As Figure 5 shown, network assets and data assets, as the core assets of unit informatization, need to clarify the types, quantities, and locations of the assets in order to clarify the objects of security protection and the formulation of subsequent security policies. Network asset management forms a unit organizational structure tree according to specifications, and obtains data including hosts, cloud platform infrastructures, security devices, network devices, etc. through docking to form a network asset catalog for unified management. Data resource management can synchronize users' databases, tables, and fields by docking with the data security control platform, establish a global data resource catalog, effectively identify the distribution of sensitive data within the system, and simultaneously obtain relevant information such as the unit to which the asset belongs and the person in charge.

[0064] Asset governance provides a unit information database formed by uniformly governing the unit information and network and data asset information collected by asset management. It includes unit data governance, system data governance, and asset IP data governance, and at the same time provides an asset governance model. Business information such as potential risks, security incidents, and notification warnings existing on the assets will be automatically associated with specific units through asset governance, and finally form a unit portrait. At the same time, the unit is judged automatically through data, and the risk units are highlighted in different colors to facilitate clearly grasping the security status of the unit.

[0065] Figure 6 It is a data interaction schematic diagram of the real-time monitoring module shown in some embodiments of this specification. As Figure 6 shown, it scans and detects and uniformly manages the asset distribution, vulnerabilities, and fingerprint information of key websites, systems, network devices, terminals, Internet of Things devices, etc. online network assets, and finds out the inventory of regional assets. It conducts security monitoring on the e-government extranet, e-government cloud export traffic, and IDC computer room traffic, and promptly discovers various network attacks, potential risks, security incidents, and network assets.

[0066] Figure 7 It is a process schematic diagram of the disposal and notification shown in some embodiments of this specification. As Figure 7 shown, according to the obtained situations such as attacks, vulnerabilities, risks, and potential hazards, the disposal and notification module is used for summarization, and the situations are reported, notified, and issued in a timely manner for early warning and rapid disposal. The system needs to have various methods of notification, including APP, web pages, etc.

[0067] Figure 8 It is a schematic diagram of the full-link visualization display shown in some embodiments of this specification. As Figure 8 shown, in some embodiments, the full-link security supervision service system conducts full-link visualization display, including: Show the security situation of each region, asset monitoring, hidden danger monitoring, availability monitoring, event monitoring, organizational guarantee, real-time notification content, and basic information of the security operation center.

[0068] In some embodiments, the full-link security supervision service system is also used for: Conduct security analysis from multiple levels, where the multiple levels include intelligence collision, asset threat analysis, security event analysis, risk hidden dangers, and cyber attacks.

[0069] Intelligence collision refers to the process of integrating, comparing, and analyzing security intelligence information from different channels and sources. Through intelligence collision, potential security threats, vulnerabilities, and risk points can be discovered, providing strong support for subsequent security protection and emergency response. For example, in the field of network security, by collecting and analyzing intelligence information such as hacker attack techniques and malware characteristics, attacks on specific systems can be detected and prevented in a timely manner.

[0070] Asset threat analysis refers to the process of conducting security assessment and risk analysis on important assets within an organization (such as information systems, databases, network devices, etc.). By analyzing factors such as the vulnerability of assets, the threats they face, and the possible losses, the security level and protection requirements of the assets can be determined. Based on the results of asset threat analysis, corresponding security protection measures and emergency plans can be formulated to ensure the safe and stable operation of the assets.

[0071] Security event analysis refers to the process of conducting in-depth investigation and analysis of security events that have occurred. By analyzing factors such as the cause, process, result, and impact of the event, the root cause and vulnerabilities of the event can be identified. Based on the results of security event analysis, lessons can be learned, security protection measures and emergency plans can be improved, and the security protection ability of the organization can be enhanced.

[0072] Risk and hidden danger identification refers to the process of discovering potential security risks and hidden dangers in an organization through systematic methods and technical means. These risks and hidden dangers may come from factors such as management loopholes, technical defects within the organization, or external threats. Through risk and hidden danger identification, potential security threats can be discovered and eliminated in a timely manner, reducing the security risks faced by the organization.

[0073] Cyber attack defense refers to the process of preventing and responding to attack behaviors from external networks through a series of technical means and management measures. These attack behaviors may include hacker intrusion, malware propagation, phishing, etc. By strengthening network protection, raising security awareness, and improving emergency plans, cyber attacks can be effectively resisted, protecting the network security of the organization.

[0074] Finally, it should be understood that the embodiments in this specification are only used to illustrate the principles of the embodiments of this specification. Other variations may also fall within the scope of this specification. Therefore, by way of example and not limitation, alternative configurations of the embodiments of this specification may be regarded as consistent with the teachings of this specification. Accordingly, the embodiments of this specification are not limited to the embodiments explicitly presented and described in this specification.

Claims

1. The full-link network security supervision system is characterized by: include: A full-link security technology prevention and control system is used to establish full-link monitoring capabilities covering cloud, network, terminal, border, data and application; A full-link security data governance system is used to integrate, archive, apply and provide data services for regulatory data and threat intelligence library data; The full-link security supervision service system is used to provide multiple business functions, among which the multiple business functions include at least asset management, asset governance, real-time monitoring, alarm management, disposal notification, analysis and judgment, security think tank, knowledge base and case base management, authority management, inspection and supervision, assessment and evaluation, emergency command and full-link visualization display, and provide comprehensive network security situation awareness and coordination and command capabilities.

2. The full-link network security supervision system according to claim 1 is characterized in that: The full-link safety technology prevention and control system includes: The government cloud instance monitoring module is used to monitor government cloud storage, cloud hosts, government cloud networks and big data platforms; The network access terminal monitoring module is used to identify the network access terminals and provide terminal asset information management functions; Application system monitoring module, used for network asset detection, fingerprint identification, unit and personnel management of government extranet applications with IP addresses; The database monitoring module is used to identify network asset components based on fingerprint library. It requests the host port to determine whether the port is open. Based on the information returned by the port, it uses fingerprint matching technology and fingerprint library to identify the host type and components used, and discover database-related assets.

3. The full-link network security supervision system according to claim 2 is characterized in that: The network access terminal monitoring module identifies the network access terminal, including: The scanner actively sends a detection message to the network-access terminal in the network. Based on the terminal fingerprint information returned by the network-access terminal when responding to the detection message, the detection response message of the network-access terminal is pattern recognized to identify the characteristic information of the network-access terminal.

4. The full-link network security supervision system according to claim 3 is characterized in that: The full-link safety technology prevention and control system also includes: The availability monitoring module is used to monitor data using distributed nodes. It uses multi-link and multi-point monitoring to discover the multi-line access availability of key application systems in different areas. It is also used to capture data packets accessing the database system through the database audit traffic agent and send the data packets accessing the database system to the database audit system. At the same time, it continuously samples the basic information, table space, I / O, CPU usage, and memory occupancy of the database system to determine the basic health indicators of the database system operation.

5. The full-link network security supervision system according to claim 3 is characterized in that: The full-link safety technology prevention and control system also includes: Event monitoring module, used for network attack event monitoring, domain name resolution anomaly monitoring, broadcast fraud monitoring, system intrusion event monitoring, harmful program event monitoring, domain name resolution anomaly monitoring, email threat monitoring, virus and Trojan horse monitoring, Web threat monitoring and vulnerability monitoring; Scanning and monitoring module, used to monitor government extranet IP assets, domain name assets, hosts, and applications; The log monitoring module is used to collect logs and perform log monitoring.

6. The full-link network security supervision system according to any one of claims 1 to 5, characterized in that: The full-link security data governance system includes: The security data center is used to integrate, archive, and apply regulatory data and threat intelligence database data, and to provide data services for the full-link security regulatory service system; The security capability middle platform is used to service various security capabilities based on security needs in various dimensions, form a security service catalog, and schedule security resources.

7. The full-link network security supervision system according to claim 6 is characterized in that: The security data center includes: Security data integration module, used for multi-heterogeneous log collection, full-flow data collection, asset information collection, vulnerability information collection and third-party platform interface synchronization data collection; Data collection management module, used for data collection and management of the security data integration module; A data standardization module is used to standardize the security data collected by the security data integration module; Threat intelligence data collection module, used for threat intelligence collection and accumulation; The data aggregation and processing module is used to classify and store the security data collected by the security data integration module and the threat intelligence collected by the threat intelligence data collection module; The security data management module is used for metadata management, data standard management, data quality management, data storage management and data dictionary management.

8. The full-link network security supervision system according to claim 6 is characterized in that: The security capability center includes: The Security Capability Center is used to determine the security capability catalog, including security detection capabilities, intelligent security analysis capabilities, and situational awareness capabilities; Security capability management is used to determine security capability scheduling and practical capabilities, including capability orchestration, capability scheduling, policy management, and scenario management functions.

9. The full-link network security supervision system according to any one of claims 1 to 5, characterized in that: The full-link safety supervision service system provides a full-link visual display, including: Displays the security situation of each area, asset monitoring, hidden danger monitoring, availability monitoring, event monitoring, organizational support, real-time notification content and basic information of the security operation center.

10. The full-link network security supervision system according to any one of claims 1 to 5, characterized in that: The full-link safety supervision service system is also used for: Security analysis is performed from multiple levels, including intelligence collision, asset threat analysis, security incident analysis, risk hazards and network attacks.

Images