Enterprise information security management system

Abstract

The invention relates to the technical field of information security, in particular to an enterprise information security management system, which comprises a data acquisition module used for acquiring employee behavior data, equipment data and network data; the access analysis module is used for judging the behavior state of the employee; the equipment analysis module is used for evaluating the safety state of the equipment; the network analysis module is used for analyzing the network state; the flow monitoring module is used for judging the abnormity of the network flow according to the acquired network flow historical data and the network flow data acquired in the monitoring period, and analyzing the abnormity of the information entropy in the monitoring period according to the source I P address of the network data packet acquired in the monitoring period; and the safety alarm module is used for giving an information safety risk alarm to an administrator according to the judgment result of the employee behavior state, the evaluation result of the equipment safety state and the analysis result of the network state in the management period. The enterprise information security management efficiency is improved.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to an enterprise information security management system. Background Art

[0002] In the information age, businesses face increasing information security threats. This is especially true for medium- and large-sized enterprises, financial institutions, manufacturing industries, and healthcare systems, which have stricter information security requirements. With the widespread adoption of internet technology, various cyberattacks, virus transmissions, and data leaks are commonplace. These threats not only directly impact business operations but also pose serious risks to customer information and trade secrets. Therefore, establishing an effective information security management system has become a top priority.

[0003] Chinese Patent Publication No. CN117369850A discloses a big data-based enterprise information security management method and system, belonging to the field of information security technology. The method specifically includes: identifying employees with abnormal access based on the enterprise's employee historical access data and real-time access data, and determining an access risk assessment value based on the abnormal access employee's permissions; determining an employee security risk assessment value based on the employee's account security and the data of problematic employees; determining the enterprise's module access risk assessment value based on the data of problematic employees and employees with access permissions in different information modules; determining a comprehensive security risk assessment value based on the enterprise's module access risk assessment value, employee security risk assessment value, access risk assessment value, and firewall settings; and outputting information security management measures based on the comprehensive security risk assessment value, thereby avoiding information security issues caused by low internal employee account security. It can be seen that the risk assessment dimension of this solution is relatively limited. Although the solution considers several dimensions such as access behavior, account complexity and similarity, it does not address multi-level and multi-angle factors at the hardware or software level, such as internal enterprise equipment security, operating system security patch status, and employee terminal device security, resulting in low enterprise information security management efficiency. Summary of the Invention

[0004] The purpose of the present invention is to provide an enterprise information security management system to solve the problem of low efficiency of enterprise information security management in the prior art.

[0005] To achieve the above object, the present invention adopts the following technical solutions:

[0006] An enterprise information security management system, comprising:

[0007] The device analysis module is used to evaluate the security status of the device based on the device security patch score, device unauthorized program score, and device health status score collected during the monitoring period;

[0008] The traffic monitoring module is used to determine the abnormality of network traffic based on the acquired historical network traffic data and the network traffic data collected during the monitoring period, and to analyze the abnormality of information entropy during the monitoring period based on the source IP addresses of the network data packets collected during the monitoring period;

[0009] The security alarm module is used to evaluate the enterprise information security status based on the judgment results of employee behavior status within the management cycle, the assessment results of equipment security status and the analysis results of network status.

[0010] Furthermore, it also includes: a data collection module for collecting employee behavior data, device data and network data;

[0011] An access analysis module is configured to determine an employee's behavior based on the number of employee visits and the duration of visits collected during a monitoring period. The access analysis module comprises a behavior analysis unit and a judgment unit. The behavior analysis unit is configured to compare the number of employee visits a0 collected during the monitoring period with a preset access number threshold a1 to construct a first behavior coefficient.

[0012] The behavior analysis unit compares the employee access duration s0 collected during the monitoring period with the preset duration s1 to construct a second behavior coefficient; if s0≤s1, the behavior analysis unit determines that the employee access duration in the current monitoring period is normal, and sets the second behavior coefficient to X1, setting X1=0; if s0>s1, the behavior analysis unit determines that the employee access duration in the current monitoring period is abnormal, and sets the second behavior coefficient to X2, setting X2=[e 3(s0-s1) / (s0+s1) -1] / [e 3 -1], e is the natural logarithm.

[0013] Furthermore, the judgment unit is used to judge the employee's behavior status according to the construction results of the first behavior coefficient and the construction results of the second behavior coefficient of the employee during the monitoring period, and the employee's behavior status includes normal and abnormal.

[0014] Furthermore, the device analysis module constructs a device security index L0 based on the device security patch score U1, the device unauthorized program score U2 and the device health status score U3 collected during the monitoring period, and compares the device security index L0 with the preset safety factor L to evaluate the security status of the device. If L0≤L, the device analysis module determines that the device security status of the current monitoring period is abnormal; if L0>L, the device analysis module determines that the device security status of the current monitoring period is normal.

[0015] Furthermore, it also includes: a network analysis module, which is used to analyze the network status based on the average network delay time and the number of network connections collected during the monitoring period; the network analysis module is provided with a delay analysis unit, a network connection analysis unit and a status analysis unit, and the delay analysis unit is used to compare the average network delay time t0 collected during the monitoring period with the preset network delay time t1 to analyze the network delay status, and the network delay status includes normal and abnormal.

[0016] Furthermore, the network connection analysis unit is used to compare the number of network connections c0 collected during the monitoring period with the preset number of connections c1, and analyze the abnormality of the number of network connections based on the comparison result. The abnormality of the number of network connections includes normal and abnormal.

[0017] Furthermore, the state analysis unit is used to analyze the network state index according to the analysis results of the abnormality of the network delay state and the number of network connections within the monitoring period. When the network delay state is normal and the number of network connections is normal, the state analysis unit sets the network state index to Z1, setting Z1=0; when the network delay state is normal and the number of network connections is abnormal, the state analysis unit sets the network state index to Z2, setting Z2=q2×ln[(c0-c1) / (c0+c1)+1]; when the network delay state is abnormal and the number of network connections is normal, the state analysis unit sets the network state index to Z3, setting Z3=q1×{3×[(t0-t1) / t1] 2 +2×[(t0-t1) / t1] 3 When the network delay state is abnormal and the number of network connections is abnormal, the state analysis unit sets the network state index to Z4, setting Z4 = q1 × {3 × [(t0-t1) / t1] 2 +2×[(t0-t1) / t1] 3}+q2×ln[(c0-c1) / (c0+c1)+1];

[0018] The state analysis unit compares the network state index with a preset state index z0 to evaluate the network state within the monitoring period. If the network state index is less than z0, the state analysis unit determines that the network state of the current monitoring period is normal. If the network state index is greater than or equal to z0, the state analysis unit determines that the network state of the current monitoring period is abnormal.

[0019] Among them, q1 is the network delay weight, and q2 is the network connection weight.

[0020] Furthermore, the traffic monitoring module is provided with an abnormality determination unit and an information entropy analysis unit. The abnormality determination unit is used to analyze the network traffic data threshold value Y based on the acquired network traffic history data, and compare the network traffic data collected during the monitoring period with the network traffic data threshold value Y to determine the abnormality of the network traffic, wherein:

[0021] If yj≤Y, the abnormality determination unit determines that the network traffic data in the jth time window of the current monitoring period is normal;

[0022] If yj>Y, the abnormality determination unit determines that the network traffic data in the jth time window of the current monitoring period is abnormal; when yc / J≤α, the abnormality determination unit determines that the network traffic data in the current monitoring period is normal; when yc / J>α, the abnormality determination unit determines that the network traffic data in the current monitoring period is abnormal, and adjusts the preset network status index to z0', setting z0'=z0×{1-exp[lg(yc / J-α)]}; yj is the network traffic data collected in the jth time window in the monitoring period, α is the preset abnormality ratio, 0<α<0.3, yc is the number of time windows with abnormal network traffic data in the monitoring period, and J is the number of time windows in the monitoring period.

[0023] Furthermore, the information entropy analysis unit is used to calculate the information entropy of each time window according to the source IP address of the network data packets collected during the monitoring period. The information entropy analysis unit sets the information entropy of the j-th time window as Hj; setting:

[0024] Mj is the number of source IP address types collected in the jth time window during the monitoring period, pm is the number of occurrences of the mth category IP address collected in the jth time window during the monitoring period, and Pj is the total number of IP addresses collected in the jth time window during the monitoring period;

[0025] The information entropy analysis unit analyzes the abnormality of the information entropy within the monitoring period according to the analysis results of the information entropy of each time window within the monitoring period. The abnormality of the information entropy includes normal and abnormal. If the information entropy of the monitoring period is abnormal, the preset abnormal ratio is adjusted to α1.

[0026] Furthermore, the security alarm module analyzes the enterprise information security status based on the judgment results of employee behavior status during the management cycle, the assessment results of equipment security status and the analysis results of network status. The enterprise information security status includes normal and abnormal. If the enterprise information security status in the current management cycle is abnormal, an information security risk alarm will be issued to the administrator.

[0027] The beneficial effects of the present invention are as follows: the system described in this embodiment realizes multi-dimensional data collection and analysis, enabling enterprises to comprehensively monitor information security status from three levels: employee behavior, device security and network connection, effectively improving the integrity and systematicness of information security management; through in-depth analysis of employee access behavior, the system can identify normal and abnormal access patterns, promptly discover potential internal security threats, enhance the controllability of employee behavior, and thus reduce information security incidents caused by human errors or malicious behavior; by utilizing device health status, patch management and monitoring of unauthorized programs, the system can promptly evaluate the security index of the device, ensure that the device is always in the best security state, and reduce the risk of security attacks caused by device vulnerabilities; through scientific analysis of network latency and connection times, network traffic data anomalies or potential DDoS attacks can be promptly discovered, ensuring network performance and security, thereby ensuring the smooth and safe daily operations of the enterprise; based on the comprehensive evaluation of multiple indicators, security risk alarms can be issued in real time to help enterprise management identify and deal with security risks in a timely manner, thereby reducing the probability of security incidents, formulating effective response measures, and ultimately improving the efficiency of enterprise information security management. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0029] Figure 1 This is a structural diagram of the enterprise information security management system of this embodiment.

[0030] Figure 2 This is a schematic diagram of the structure of the access analysis module in this embodiment.

[0031] Figure 3 Schematic diagram of the structure of the network analysis module in this embodiment.

[0032] Figure 4 Schematic diagram of the structure of the flow monitoring module of this embodiment. DETAILED DESCRIPTION

[0033] In order to more clearly illustrate the present invention, the present invention is further described below in conjunction with preferred embodiments and accompanying drawings. Similar components in the accompanying drawings are represented by the same reference numerals. It should be understood by those skilled in the art that the following detailed description is illustrative rather than restrictive and should not be used to limit the scope of protection of the present invention.

[0034] It should be noted that, although the terms "first," "second," and "third" may be used to describe the embodiments of the present application, the description should not be limited to these terms. These terms are merely used to distinguish the descriptions. For example, without departing from the scope of the embodiments of the present application, "first" may also be referred to as "second," and similarly, "second" may also be referred to as "first."

[0035] See also Figure 1 As shown, it is a structural diagram of the enterprise information security management system of this embodiment, the system includes:

[0036] The data collection module is used to collect employee behavior data, device data and network data. The employee behavior data includes the number of employee visits and the duration of visits. The number of employee visits and the duration of visits are the number of times and the duration of employees access the company's intranet applications; the network data includes the average network delay time and the number of network connections; the number of network connections is the number of times employees establish connections with network services; the device data includes the device security patch score, the device unauthorized program score and the device health status score. The security patch score is 1 when the patch is updated and 0 when the patch is not updated. The unauthorized program score is 0 when an unauthorized program is running on the device and 1 when no unauthorized program is running on the device. The device health status score is 1 when the antivirus software is installed and activated and the virus database is updated to this month. It is 0.5 when the antivirus software is installed but not started, or the virus database has not been updated for more than one month, and it is 0 when the antivirus software is not installed.

[0037] Specifically, in this embodiment, no specific limitation is imposed on the method for collecting employee behavior data, device data, and network data. Those skilled in the art may freely set the method as long as the collection requirements of employee behavior data, device data, and network data are met. Employee behavior data can be automatically collected through log records (such as Web server logs and application logs) to record employees' access behavior to the company's intranet applications. Network monitoring tools are used to track each employee's access request and record the start and end time of each access to calculate the access duration. The network delay time can be regularly tested with the intranet service delay through a network performance monitoring tool, and real-time monitoring and collection can be performed using the ping command or other network monitoring tools. The number of network connections can be recorded through a network traffic data analysis system to record the connection requests between employee devices and network services and count the number of successful connections. The device security patch score can be determined by monitoring the operating system and application patch status of the device through an automated system, checking whether the patch is updated to determine the score. The device unauthorized program score can be determined by regularly scanning the device using a security audit tool. If an unauthorized program is found, it is marked as 0; otherwise, it is marked as 1. The device health status score can be determined by monitoring the installation status, activation status, and virus database update of the antivirus software through the device management system, and scoring based on this information.

[0038] Please continue reading Figure 1 As shown, the system includes a visit analysis module, which is connected to the data collection module and is used to judge the employee's behavior status based on the number of employee visits and visit duration collected during a monitoring period.

[0039] Specifically, the present embodiment does not impose any specific limitation on the setting of the monitoring period, and those skilled in the art can freely set it as long as the setting requirements of the monitoring period are met. The monitoring period can be set to 30 minutes, 1 hour, etc.

[0040] See also Figure 2 As shown, the access analysis module includes a behavior analysis unit, which is used to compare the number of employee accesses a0 collected during the monitoring period with a preset access threshold a1 to construct a first behavior coefficient to improve the accuracy of the first behavior coefficient construction, wherein:

[0041] If a0≤a1, the behavior analysis unit determines that the number of employee visits in the current monitoring period is normal, and sets the first behavior coefficient to R1, setting R1=0; if a0>a1, the behavior analysis unit determines that the number of employee visits in the current monitoring period is abnormal, and sets the first behavior coefficient to R2, setting R2=(a0-a1) / a1;

[0042] The behavior analysis unit compares the employee access duration s0 collected during the monitoring period with the preset duration s1 to construct a second behavior coefficient. If s0≤s1, the behavior analysis unit determines that the employee access duration of the current monitoring period is normal, and sets the second behavior coefficient to X1, setting X1=0. If s0>s1, the behavior analysis unit determines that the employee access duration of the current monitoring period is abnormal, and sets the second behavior coefficient to X2, setting X2=[e 3(s0-s1) / (s0+s1) -1] / [e 3 -1], e is the natural logarithm; the behavior analysis unit is constructed through the comparison process and coefficient of the behavior analysis unit, which helps to accurately determine whether the employee's operation within the monitoring period is an abnormal behavior and finely manage the employee's operation behavior.

[0043] Specifically, in this embodiment, there is no specific limitation on the setting of the preset number of times and the preset duration. Those skilled in the art can set them freely as long as the setting requirements of the preset number of times and the preset duration are met. Among them, the setting of the preset number of times and the preset duration can be calculated and set by calculating the average of the employee's historical visit times and visit duration data.

[0044] Please continue reading Figure 2 As shown, the access analysis module further includes a judgment unit, which is connected to the behavior analysis unit and is used to judge the employee's behavior status based on the construction results of the first behavior coefficient and the second behavior coefficient of the employee during the monitoring period to improve the accuracy of the employee's behavior status judgment, wherein:

[0045] If w1×first behavior coefficient+w2×second behavior coefficient≤T, the judgment unit determines that the employee behavior status in the current monitoring period is normal; if w1×first behavior coefficient+w2×second behavior coefficient>T, the judgment unit determines that the employee behavior status in the current monitoring period is abnormal, w1 is the first behavior weight, w2 is the second behavior weight, w1≥w2, w1+w2=1, and T is the preset behavior status threshold; the judgment unit effectively reduces the misjudgment rate through reasonable setting of weights and thresholds, and only judges abnormality when abnormal behavior actually exists, thereby reducing interference with normal work.

[0046] Specifically, in this embodiment, there is no specific limitation on the setting of the preset behavior state threshold, the first behavior weight and the second behavior weight. Those skilled in the art can set them freely as long as the setting requirements of the preset behavior state threshold, the first behavior weight and the second behavior weight are met. Among them, the optimal value of w1 is 0.65, the optimal value of w2 is 0.35, and the optimal value of T is 0.34.

[0047] Please continue reading Figure 1As shown, the system also includes a device analysis module, which is connected to the data acquisition module and is used to construct a device security index L0 based on the device security patch score U1, the device unauthorized program score U2 and the device health status score U3 collected during the monitoring period, and set L0 = G1×U1+G2×U2+G3×U3;

[0048] The equipment analysis module compares the equipment safety index L0 with the preset safety factor L to evaluate the safety status of the equipment, wherein:

[0049] If L0≤L, the device analysis module determines that the device security status in the current monitoring period is abnormal; if L0>L, the device analysis module determines that the device security status in the current monitoring period is normal, G1 is the security patch weight, G2 is the unauthorized program weight, G3 is the device health weight, L is the preset safety factor, G2>G3>G1, G1+G2+G3=1; the device analysis module can prevent security threats caused by device vulnerabilities, malicious programs or antivirus software failures through comprehensive judgment of the device's security patch status, unauthorized programs, and health status, while improving the accuracy of device security status analysis, thereby improving the efficiency of enterprise information security management.

[0050] Specifically, in this embodiment, there is no specific limitation on the setting of the preset safety factor, security patch weight, unauthorized program weight and device health weight. Those skilled in the art can set them freely as long as they meet the setting requirements of the preset safety factor, security patch weight, unauthorized program weight and device health weight. Among them, the optimal value of G1 is 0.2, the optimal value of G2 is 0.38, the optimal value of G3 is 0.42, and the optimal value of L is 0.7.

[0051] Please continue reading Figure 1 As shown, the system further includes a network analysis module, which is connected to the data acquisition module and is used to analyze the network status according to the average network delay time and the number of network connections collected during the monitoring period.

[0052] See also Figure 3 As shown, the network analysis module includes a delay analysis unit, which is used to compare the average network delay time t0 collected during the monitoring period with the preset network delay time t1 to analyze the network delay status, wherein:

[0053] If t0≤t1, the delay analysis unit determines that the network delay status of the current monitoring period is normal; if t0>t1, the delay analysis unit determines that the network delay status of the current monitoring period is abnormal; the delay analysis unit detects the abnormality of the network delay status to discover network transmission bottlenecks, prevent large-scale network disconnection or network performance degradation, and improve the accuracy of network status analysis.

[0054] Specifically, in this embodiment, there is no specific limitation on the setting of the preset network delay time, and those skilled in the art can freely set it as long as the setting requirements of the preset network delay time are met. Among them, the optimal value of t1 is 100ms.

[0055] Please continue reading Figure 3 As shown, the network analysis module includes a network connection analysis unit, which is used to compare the number of network connections c0 collected during the monitoring period with the preset number of connections c1, and analyze the abnormality of the number of network connections based on the comparison result, wherein:

[0056] If c0≤c1, the network connection analysis unit determines that the number of network connections in the current monitoring period is normal; if c0>c1, the network connection unit determines that the number of network connections in the current monitoring period is abnormal; the network connection analysis unit successfully identifies potential DDoS attacks or frequent identity authentication failures and other abnormal situations by monitoring the number of connections, prevents malicious connections from affecting the system, and improves the accuracy of network status analysis.

[0057] Specifically, in this embodiment, there is no specific limitation on the setting of the preset number of connections, and those skilled in the art can freely set it as long as the setting requirements of the preset number of connections are met. Among them, the optimal value of c1 is 1000 times.

[0058] Please continue reading Figure 3 As shown, the network analysis module includes a state analysis unit, which is connected to the delay analysis unit and the network connection analysis unit. The state analysis unit is used to analyze the network state index according to the analysis results of the abnormality of the network delay state and the number of network connections within the monitoring period to improve the accuracy of the network state index analysis, wherein:

[0059] When the network delay state is normal and the number of network connections is normal, the state analysis unit sets the network state index to Z1, setting Z1=0; when the network delay state is normal and the number of network connections is abnormal, the state analysis unit sets the network state index to Z2, setting Z2=q2×ln[(c0-c1) / (c0+c1)+1]; when the network delay state is abnormal and the number of network connections is normal, the state analysis unit sets the network state index to Z3, setting Z3=q1×{3×[(t0-t1) / t1] 2+2×[(t0-t1) / t1] 3 When the network delay state is abnormal and the number of network connections is abnormal, the state analysis unit sets the network state index to Z4, setting Z4 = q1 × {3 × [(t0-t1) / t1] 2 +2×[(t0-t1) / t1] 3}+q2×ln[(c0-c1) / (c0+c1)+1];

[0060] The state analysis unit compares the network state index with a preset state index z0 to evaluate the network state within the monitoring period. If the network state index is less than z0, the state analysis unit determines that the network state of the current monitoring period is normal. If the network state index is greater than or equal to z0, the state analysis unit determines that the network state of the current monitoring period is abnormal.

[0061] Among them, q1 is the network delay weight, q2 is the network connection weight, q1<q2, q1+q2=1; the status analysis unit combines the network delay and the number of connections to comprehensively judge the operating status of the network, avoid the failure of single-dimensional judgment, improve the accuracy of network monitoring, and thus improve the efficiency of enterprise information security management.

[0062] Specifically, in this embodiment, there is no specific limitation on the setting of each weight and preset state index. Those skilled in the art can set it freely as long as the setting requirements of each weight and preset state index are met. Among them, the optimal value of q1 is 0.31, the optimal value of q2 is 0.69, and the optimal value of z0 is 0.26.

[0063] Please continue reading Figure 1 As shown, the system further includes a traffic monitoring module, which is connected to the network analysis module and is used to determine abnormal traffic based on the acquired network traffic history data and the network traffic data collected during the monitoring period.

[0064] See also Figure 4 As shown, the traffic monitoring module includes an abnormality determination unit, which is used to analyze the network traffic data threshold Y based on the acquired network traffic history data to improve the accuracy of the network traffic data abnormality determination, setting:

[0065]

[0066] Wherein, N is the number of historical network traffic data, k is the preset adjustment ratio, and xi is the i-th historical network traffic data;

[0067] The abnormality determination unit compares the network traffic data collected during the monitoring period with the network traffic data threshold value Y to determine the abnormality of the network traffic, wherein:

[0068] If yj≤Y, the abnormality determination unit determines that the network traffic data in the jth time window of the current monitoring period is normal;

[0069] If yj>Y, the abnormality determination unit determines that the network traffic data in the jth time window of the current monitoring period is abnormal; when yc / J≤α, the abnormality determination unit determines that the network traffic data in the current monitoring period is normal; when yc / J>α, the abnormality determination unit determines that the network traffic data in the current monitoring period is abnormal, and adjusts the preset network status index to z0', setting z0'=z0×{1-exp[lg(yc / J-α)]}; yj is the network traffic data collected in the jth time window in the monitoring period, α is the preset abnormality ratio, 0<α<0.3, yc is the number of time windows in which the network traffic data is abnormal in the monitoring period, and J is the number of time windows in the monitoring period; the abnormality determination unit determines whether the current traffic is abnormal based on the historical data analysis of the network traffic data to improve the accuracy of the judgment of the abnormality of the network traffic data, thereby improving the accuracy of the network status analysis, thereby improving the efficiency of the enterprise information security management.

[0070] Specifically, in this embodiment, there is no specific limitation on the setting of the preset abnormal ratio and the preset adjustment ratio. Those skilled in the art can set them freely, as long as the setting requirements of the preset abnormal ratio and the preset adjustment ratio are met. Among them, the optimal value of k is 3, and the optimal value of α is 0.12.

[0071] Specifically, in this embodiment, there is no specific limitation on the setting of the time window, and those skilled in the art can set it freely as long as the design requirements of the time window are met. Among them, the setting of the time window should be smaller than the setting of the monitoring period, and the time window can be set to 1 minute, 2 minutes, etc.

[0072] Specifically, the present embodiment does not impose any specific limitation on the method for obtaining the historical network traffic data, and those skilled in the art may freely set it as long as the requirements for obtaining the historical network traffic data are met. The historical network traffic data may be obtained through interaction.

[0073] Please continue reading Figure 4 As shown, the traffic monitoring module includes an information entropy analysis unit, which is connected to the abnormality determination unit and is used to calculate the information entropy of each time window according to the source IP address of the network data packet collected during the monitoring period to improve the accuracy of the information entropy abnormality analysis during the monitoring period. The information entropy analysis unit sets the information entropy of the j-th time window as Hj and sets:

[0074] Mj is the number of source IP address types collected in the jth time window during the monitoring period, pm is the number of occurrences of the mth category IP address collected in the jth time window during the monitoring period, and Pj is the total number of IP addresses collected in the jth time window during the monitoring period;

[0075] The information entropy analysis unit adjusts the analysis process of the abnormality of the network traffic data within the monitoring period according to the analysis results of the information entropy of each time window within the monitoring period, wherein:

[0076] when When , the information entropy analysis unit determines that the information entropy of the current monitoring period is normal and does not make any adjustments;

[0077] when When , the information entropy analysis unit determines that the information entropy of the current monitoring period is abnormal, and adjusts the preset abnormal ratio to α1, setting:

[0078] H0 is a preset entropy value; the information entropy analysis unit can detect potential abnormal IP connections, especially DDos attacks, through entropy analysis, thereby improving the accuracy of network status analysis and thus improving the efficiency of enterprise information security management.

[0079] Specifically, in this embodiment, the setting of the preset entropy value is not specifically limited, and those skilled in the art can set it freely as long as the setting requirements of the preset entropy value are met. Among them, the optimal value of H0 is 2.5.

[0080] Specifically, in this embodiment, there is no specific limitation on the method for collecting the source IP addresses of network traffic data and network data packets. Those skilled in the art can set it freely, and it is only necessary to meet the collection requirements of the source IP addresses of network traffic data and network data packets. Among them, the source IP addresses of network traffic data and network data packets can be collected through network traffic data analysis tools such as Wireshark, tcpdump, NetFlow, etc.

[0081] Please continue reading Figure 1 As shown, the system also includes a security alarm module, which is connected to the access analysis module, the device analysis module, and the traffic monitoring module. The security alarm module is used to issue information security risk alarms to the administrator based on the judgment results of the employee behavior status within the management cycle, the assessment results of the device security status, and the analysis results of the network status, wherein:

[0082] When D1×E1 / E0+D2×E2 / E0+D3×E3 / E0≤γ, the security alarm module determines that the enterprise information security status of the current management period is normal and does not issue an information security risk alarm to the administrator;

[0083] When D1×E1 / E0+D2×E2 / E0+D3×E3 / E0>γ, the security alarm module determines that the enterprise information security status of the current management period is abnormal and issues an information security risk alarm to the administrator;

[0084] Among them, D1 is the employee behavior weight, D2 is the equipment health weight, D3 is the network status weight, D1+D2+D3=1, E1 is the number of monitoring cycles with abnormal employee behavior status within the management cycle, E2 is the number of monitoring cycles with abnormal equipment security status within the management cycle, E3 is the number of monitoring cycles with abnormal network status within the management cycle, E0 is the number of monitoring cycles within the management cycle, and γ is the risk factor threshold; the security alarm module can send accurate alarms when the security status is abnormal through multi-dimensional security risk analysis, ensuring that management personnel can take timely countermeasures to prevent the risk from expanding, while avoiding unnecessary alarms, reducing the interference caused by false alarms, and ultimately improving the efficiency of enterprise information security management.

[0085] Specifically, in this embodiment, there is no specific limitation on the setting of each weight and preset risk factor. Those skilled in the art can set it freely as long as the setting requirements of each weight and preset risk factor are met. Among them, the optimal value of D1 is 0.4, the optimal value of D2 is 0.3, the optimal value of D3 is 0.3, and the optimal value of γ is 0.36.

[0086] Specifically, in this embodiment, there is no specific limitation on the setting of the management period, and those skilled in the art can set it freely, as long as the setting requirements of the management period are met. Among them, the setting of the management period should be greater than the setting of the monitoring period, and the management period can be set to 12h, 24h, etc.

[0087] Specifically, this embodiment is applied to medium and large enterprises, finance, manufacturing, medical institutions, etc. By analyzing employee behavior patterns, monitoring equipment health status and analyzing network connection status, it can timely identify potential security risks, abnormal traffic and other security threats, thereby improving the level of information security protection and ensuring business continuity and data security.

[0088] Obviously, the above embodiments of the present invention are merely examples for clearly illustrating the present invention, and are not limitations on the implementation methods of the present invention. For ordinary technicians in this field, other different forms of changes or modifications can be made based on the above description. It is impossible to list all the implementation methods here. All obvious changes or modifications derived from the technical solution of the present invention are still within the scope of protection of the present invention.

Claims

1. An enterprise information security management system, characterized in that: include, The device analysis module is used to evaluate the security status of the device based on the device security patch score, device unauthorized program score, and device health status score collected during the monitoring period; The traffic monitoring module is used to determine the abnormality of network traffic based on the acquired historical network traffic data and the network traffic data collected during the monitoring period, and to analyze the abnormality of information entropy during the monitoring period based on the source IP addresses of the network data packets collected during the monitoring period; The security alarm module is used to evaluate the enterprise information security status based on the judgment results of employee behavior status within the management cycle, the assessment results of equipment security status and the analysis results of network status.

2. The enterprise information security management system according to claim 1, characterized in that: Also includes: Data collection module, used to collect employee behavior data, device data and network data; An access analysis module is configured to determine an employee's behavior based on the number of employee visits and the duration of visits collected during a monitoring period. The access analysis module comprises a behavior analysis unit and a judgment unit. The behavior analysis unit is configured to compare the number of employee visits a0 collected during the monitoring period with a preset access number threshold a1 to construct a first behavior coefficient. The behavior analysis unit compares the employee access duration s0 collected during the monitoring period with the preset duration s1 to construct a second behavior coefficient; if s0≤s1, the behavior analysis unit determines that the employee access duration in the current monitoring period is normal, and sets the second behavior coefficient to X1, setting X1=0; if s0>s1, the behavior analysis unit determines that the employee access duration in the current monitoring period is abnormal, and sets the second behavior coefficient to X2, setting X2=[e 3(s0-s1) / (s0+s1) -1] / [e 3 -1], e is the natural logarithm.

3. The enterprise information security management system according to claim 2, characterized in that: The judgment unit is used to judge the employee's behavior status according to the construction results of the first behavior coefficient and the second behavior coefficient of the employee during the monitoring period. The employee's behavior status includes normal and abnormal.

4. The enterprise information security management system according to claim 3, characterized in that: The device analysis module constructs a device security index L0 based on the device security patch score U1, the device unauthorized program score U2, and the device health status score U3 collected during the monitoring period, and compares the device security index L0 with a preset safety factor L to evaluate the security status of the device. If L0 ≤ L, the device analysis module determines that the device security status of the current monitoring period is abnormal; If L0>L, the equipment analysis module determines that the equipment safety status in the current monitoring period is normal.

5. The enterprise information security management system according to claim 4, characterized in that: Also includes: A network analysis module is used to analyze the network status based on the average network delay time and the number of network connections collected during the monitoring period. The network analysis module is equipped with a delay analysis unit, a network connection analysis unit and a status analysis unit. The delay analysis unit is used to compare the average network delay time t0 collected during the monitoring period with the preset network delay time t1 to analyze the network delay status, which includes normal and abnormal network delay status.

6. The enterprise information security management system according to claim 5, characterized in that: The network connection analysis unit is used to compare the number of network connections c0 collected during the monitoring period with the preset number of connections c1, and analyze the abnormality of the number of network connections according to the comparison result. The abnormality of the number of network connections includes normal and abnormal.

7. The enterprise information security management system according to claim 6, characterized in that: The state analysis unit is used to analyze the network state index according to the analysis results of the abnormality of the network delay state and the number of network connections within the monitoring period. When the network delay state is normal and the number of network connections is normal, the state analysis unit sets the network state index to Z1, setting Z1=0; when the network delay state is normal and the number of network connections is abnormal, the state analysis unit sets the network state index to Z2, setting Z2=q2×ln[(c0-c1) / (c0+c1)+1]; when the network delay state is abnormal and the number of network connections is normal, the state analysis unit sets the network state index to Z3, setting Z3=q1×{3×[(t0-t1) / t1] 2 +2×[(t0-t1) / t1] 3 When the network delay state is abnormal and the number of network connections is abnormal, the state analysis unit sets the network state index to Z4, setting Z4 = q1 × {3 × [(t0-t1) / t1] 2 +2×[(t0-t1) / t1] 3 }+q2×ln[(c0-c1) / (c0+c1)+1]; The state analysis unit compares the network state index with a preset state index z0 to evaluate the network state within the monitoring period. If the network state index is less than z0, the state analysis unit determines that the network state of the current monitoring period is normal. If the network state index is greater than or equal to z0, the state analysis unit determines that the network state of the current monitoring period is abnormal. Among them, q1 is the network delay weight, and q2 is the network connection weight.

8. The enterprise information security management system according to claim 7, characterized in that: The traffic monitoring module is provided with an abnormality determination unit and an information entropy analysis unit. The abnormality determination unit is used to analyze the network traffic data threshold value Y based on the acquired network traffic history data, and compare the network traffic data collected during the monitoring period with the network traffic data threshold value Y to determine the abnormality of the network traffic, wherein: If yj≤Y, the abnormality determination unit determines that the network traffic data in the jth time window of the current monitoring period is normal; If yj>Y, the abnormality determination unit determines that the network traffic data in the jth time window of the current monitoring period is abnormal; when yc / J≤α, the abnormality determination unit determines that the network traffic data in the current monitoring period is normal; when yc / J>α, the abnormality determination unit determines that the network traffic data in the current monitoring period is abnormal, and adjusts the preset network status index to z0', setting z0'=z0×{1-exp[lg(yc / J-α)]}; yj is the network traffic data collected in the jth time window in the monitoring period, α is the preset abnormality ratio, 0<α<0.3, yc is the number of time windows with abnormal network traffic data in the monitoring period, and J is the number of time windows in the monitoring period.

9. The enterprise information security management system according to claim 8, characterized in that: The information entropy analysis unit is used to calculate the information entropy of each time window according to the source IP address of the network data packets collected during the monitoring period, and the information entropy analysis unit sets the information entropy of the j-th time window as Hj; set up: Mj is the number of source IP address types collected in the jth time window during the monitoring period, pm is the number of occurrences of the mth category IP address collected in the jth time window during the monitoring period, and Pj is the total number of IP addresses collected in the jth time window during the monitoring period; The information entropy analysis unit analyzes the abnormality of the information entropy within the monitoring period according to the analysis results of the information entropy of each time window within the monitoring period. The abnormality of the information entropy includes normal and abnormal. If the information entropy of the monitoring period is abnormal, the preset abnormal ratio is adjusted to α1.

10. The enterprise information security management system according to claim 9, characterized in that: The security alarm module analyzes the enterprise information security status based on the judgment results of employee behavior status within the management cycle, the assessment results of equipment security status and the analysis results of network status. The enterprise information security status includes normal and abnormal. If the enterprise information security status in the current management cycle is abnormal, an information security risk alarm will be issued to the administrator.

Images