Safety protection system for computer

Abstract

The invention discloses a safety protection system for a computer, and belongs to the technical field of computer safety protection. Comprising a monitoring early warning module, a core protection module, a data acquisition module, a data storage module, an analysis processing module, a threshold setting module, an instruction issuing module and a warning reminding module. And the monitoring and early warning module is used for monitoring the computer subjected to security protection in real time and sending early warning information to the core protection module and the data acquisition module when the computer is subjected to security threat attack. And when the security protection system evaluation index is not greater than the threshold value of the security protection system evaluation index, an instruction is issued to the core protection module, and the training promotion module performs simulation training by obtaining the attacked data stored in the data storage module so as to improve the security protection performance of the security protection system. And meanwhile, a warning prompt for improving the safety protection performance of the system is sent to operation and maintenance personnel of the safety protection system according to a comparison result.

Description

Technical Field

[0001] The present invention relates to the technical field of computer security protection, and in particular to a security protection system for a computer. Background Art

[0002] The development of science, technology and economy has greatly improved the level of computer technology in my country, brought about earth-shaking changes in people's lives and work, and greatly improved work efficiency and quality. However, the Internet is highly open and has fast transmission speeds. Once some important files or confidential information are leaked, it will threaten everyone from individuals to enterprises and countries. Therefore, strengthening computer network defense has become a widely concerned issue. However, during the use of existing computer security protection systems, they often fail to analyze the relevant data in the computer security protection process to evaluate the security protection capabilities of the existing system. There is a lack of real-time dynamic evaluation methods to timely grasp the effectiveness of the security protection system, which leads to security risks in the process of computer security protection. Summary of the Invention

[0003] Purpose of the invention: The purpose of the present invention is to provide a security protection system for computers; it can solve the problem that the existing computer security protection system often fails to analyze the relevant data in the computer security protection process to evaluate the security protection capabilities of the existing system during use.

[0004] Technical solution: To solve the above technical problems, according to one aspect of the present invention, more specifically, a security protection system for a computer includes: a monitoring and early warning module, a core protection module, a data acquisition module, a data storage module, an analysis and processing module, a threshold setting module, an instruction issuing module, and a warning and reminder module; Monitoring and early warning module: used to implement real-time monitoring of computers undergoing security protection, and send early warning information to the core protection module and data acquisition module when the computer is attacked by security threats; Core protection module: used to defend against attacks on the computer when the monitoring and warning module issues a security threat attack warning message, train and improve the defense strategy according to the instructions issued by the instruction issuing module, and can also perform virus disinfection operations on files in the computer; Data acquisition module: used to collect relevant data of attacks suffered during the entire defense process and relevant data during the defense process in real time when the monitoring and warning module issues security threat attack warning information, and transmit it to the data storage module and analysis and processing module; Data storage module: used to receive and store the relevant data of the attacks suffered during the entire defense process and the relevant data during the defense process collected in real time by the data acquisition module, and transmit the stored relevant data to the analysis and processing module; Analysis and processing module: used to comprehensively analyze the relevant data of attacks suffered during the entire defense process and the relevant data during the defense process collected in real time by the data acquisition module and the relevant data of attacks suffered during the entire defense process of the computer stored in the data storage module, and obtain the security protection system evaluation index, compare it with the threshold value of the security protection system evaluation index set by the threshold setting module, and transmit the comparison result to the instruction issuing module and the warning reminder module; Threshold setting module: used to set the threshold of the safety protection system evaluation index obtained by comprehensive analysis of the analysis and processing module; Instruction issuing module: used to receive the comparison results of the analysis and processing module, and issue corresponding instructions to the core protection module based on the comparison results; Warning reminder module: used to receive the comparison results of the analysis and processing module, and issue warning reminders to the security protection system operation and maintenance personnel to improve the system security protection performance based on the comparison results.

[0005] Furthermore, the core protection module includes: a file antivirus module, an attack defense module, and a training and improvement module; File antivirus module: used to perform related antivirus operations on files in the computer; Attack defense module: used to defend against attacks on the computer when the monitoring and warning module issues a security threat attack warning message; Training and improvement module: used to train and upgrade the defense strategy after receiving the corresponding instructions issued by the instruction issuance module.

[0006] Furthermore, when performing analysis and processing, the analysis and processing module obtains the total number of attacks suffered by the computer, the number of successful defenses of the security protection system, and the response time from the start of each attack to the effectiveness of the defense, and conducts a comprehensive analysis of the above data to obtain the core effectiveness index of the security protection system:

[0007] in, It is the core performance index of the security protection system. is the total number of attacks on the computer, The number of successful defenses of the security protection system, is a constant whose value is 2. The response time from attack to defense. is a constant whose value is 0.1.

[0008] Furthermore, when performing analysis and processing, the analysis and processing module will obtain the response capability index by analyzing and processing the number of attack types, the number of attacks of each attack type, the total number of attacks, the number of defense types, the number of defenses of each defense type, and the total number of defenses:

[0009] in, For the coping capacity index, is a constant with a value of 0.3, is the number of attack types, The number of attacks for each attack type, is the total number of attacks, is the number of defense types, The number of defenses for each defense type, The total number of defenses.

[0010] Furthermore, when performing analysis and processing, the analysis and processing module will comprehensively analyze the core effectiveness index and the response capability index to obtain the security protection system evaluation index of the security protection system:

[0011] in, is the safety protection system evaluation index of the safety protection system, is a constant with a value of 0.6, is a constant whose value is 0.4; thus, the safety protection performance of the safety protection system is determined by the safety protection system evaluation index of the safety protection system. When the safety protection system evaluation index of the safety protection system is larger, the safety protection performance of the safety protection system is better, and vice versa, the safety protection performance of the safety protection system is worse.

[0012] Furthermore, when setting the threshold, the threshold setting module will set the threshold of the security protection system evaluation index of the security protection system according to the demand for security protection and the acceptable risk level. The higher the demand for security protection and the lower the acceptable risk level, the greater the security protection demand and the threshold of the acceptable risk level will be set. Conversely, the smaller the security protection demand and the threshold of the acceptable risk level will be set.

[0013] Furthermore, when the instruction issuing module receives the comparison result of the security protection system evaluation index and the threshold of the security protection system evaluation index from the analysis and processing module, when the security protection system evaluation index is not greater than the threshold of the security protection system evaluation index, it issues an instruction to the core protection module, and the training improvement module performs simulation training by obtaining the attack data stored in the data storage module to improve the security protection performance of the security protection system.

[0014] Furthermore, when the warning reminder module receives the comparison result of the security protection system evaluation index and the threshold of the security protection system evaluation index from the analysis and processing module, when the security protection system evaluation index is not greater than the threshold of the security protection system evaluation index, the comparison result will be sent to the security protection system operation and maintenance personnel as a warning reminder to improve the system security protection performance.

[0015] Beneficial effect: When issuing a security threat attack warning, data related to the attacks suffered during the entire defense process and the relevant data during the defense process are collected in real time to ensure the timeliness of the collected data. At the same time, data is collected when the warning is issued to avoid constant collection and increasing operational pressure. By obtaining the total number of attacks suffered by the computer, the number of successful defenses of the security protection system, and the response time from the start of each attack to the effectiveness of the defense, the above data are comprehensively analyzed to obtain the core effectiveness index of the security protection system. The number of attack types, the number of attacks of each attack type, the total number of attacks, the number of defense types, the number of defenses of each defense type, and the total number of defenses are analyzed to obtain the response capability index. Finally, the core effectiveness index and the response capability index are combined to obtain the security protection system evaluation index of the security protection system. The security protection performance of the security protection system is determined by the security protection system evaluation index. The larger the security protection system evaluation index of the security protection system, the higher the security protection performance of the security protection system. Conversely, the lower the security protection performance of the security protection system, the security protection performance of the security protection system is determined by multi-index analysis. Compared with the determination based on a single data, the determination result is more reasonable and accurate. The threshold of the security protection system evaluation index of the security protection system is set according to the demand for security protection and the acceptable risk level. The higher the demand for security protection and the lower the acceptable risk level, the greater the threshold of the security protection demand and the acceptable risk level is set. Conversely, the smaller the threshold of the security protection demand and the acceptable risk level is set, so that the security protection of the computer is more personalized and can meet different usage needs. When the security protection system evaluation index is not greater than the threshold of the security protection system evaluation index, an instruction is issued to the core protection module. The training and improvement module performs simulation training by obtaining the attack data stored in the data storage module to improve the security protection performance of the security protection system. At the same time, the comparison results are issued to the security protection system operation and maintenance personnel to warn them to improve the system's security protection performance. When the security protection system has insufficient security protection performance, the system's security protection performance is improved through system self-training as soon as possible, and a warning reminder is issued to the security protection system operation and maintenance personnel to improve the system's security protection performance. Through the dual measures of system self-upgrade and manual intervention by operation and maintenance personnel, the ability to ensure computer security is improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 It is a schematic diagram of the system principle. DETAILED DESCRIPTION

[0017] In order to make the technical solution of the present invention clearer, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0018] Example 1 First, when the monitoring and early warning module monitors that the computer is under a security threat attack, it sends an early warning message to the core protection module and the data acquisition module. At this time, when the core defense module receives the security threat attack early warning information issued by the monitoring and early warning module, it will promptly defend against the security threat attack suffered by the computer. At the same time, when the data acquisition module receives the security threat attack early warning information issued by the monitoring and early warning module, it will collect the relevant data of the attacks suffered during the entire defense process and the relevant data during the defense process in real time, and transmit it to the data storage module and the analysis and processing module.

[0019] Then, the data storage module receives and stores the relevant data of the attacks suffered during the entire defense process and the relevant data during the defense process collected in real time by the data acquisition module, and transmits the stored relevant data to the analysis and processing module. The threshold setting module sets the threshold of the security protection system evaluation index obtained by the comprehensive analysis of the analysis and processing module. When setting the threshold, the threshold of the security protection system evaluation index of the security protection system will be set according to the demand for security protection and the acceptable risk level. The higher the demand for security protection and the lower the acceptable risk level, the greater the threshold of the demand for security protection and the acceptable risk level will be set. Conversely, the smaller the threshold of the demand for security protection and the acceptable risk level will be set. The analysis and processing module receives the relevant data of the attacks suffered during the entire defense process and the relevant data during the defense process collected in real time by the data acquisition module and the relevant data of the attacks suffered during the entire defense process of the computer stored in the data storage module, and comprehensively analyzes the above data to obtain the security protection system evaluation index, and compares it with the threshold of the security protection system evaluation index set by the threshold setting module, and transmits the comparison result to the instruction issuing module and the warning reminder module.

[0020] During the analysis process, the total number of attacks on the computer, the number of successful defenses by the security protection system, and the response time from the start of each attack to the effectiveness of the defense are obtained. The above data are then comprehensively analyzed to obtain the core effectiveness index of the security protection system:

[0021] in, It is the core performance index of the security protection system. is the total number of attacks on the computer, The number of successful defenses of the security protection system. is a constant whose value is 2. The response time from attack to defense. is a constant whose value is 0.1.

[0022] At the same time, the response capability index is obtained by analyzing the number of attack types, the number of attacks of each attack type, the total number of attacks, the number of defense types, the number of defenses of each defense type, and the total number of defenses:

[0023] in, For the coping capacity index, is a constant with a value of 0.3, is the number of attack types, The number of attacks for each attack type, is the total number of attacks, is the number of defense types, The number of defenses for each defense type, The total number of defenses.

[0024] And the core effectiveness index and response capability index will be comprehensively analyzed to obtain the safety protection system evaluation index of the safety protection system:

[0025] in, is the safety protection system evaluation index of the safety protection system, is a constant with a value of 0.6, is a constant whose value is 0.4; thus, the safety protection performance of the safety protection system is determined by the safety protection system evaluation index of the safety protection system. When the safety protection system evaluation index of the safety protection system is larger, the safety protection performance of the safety protection system is better, and vice versa, the safety protection performance of the safety protection system is worse.

[0026] Finally, when the instruction issuing module receives the comparison result of the security protection system evaluation index and the threshold of the security protection system evaluation index from the analysis and processing module, when the security protection system evaluation index is not greater than the threshold of the security protection system evaluation index, it issues an instruction to the core protection module, and the training improvement module performs simulation training by obtaining the attack data stored in the data storage module to improve the security protection performance of the security protection system.

[0027] At the same time, when the warning reminder module receives the comparison result of the analysis and processing module on the security protection system evaluation index and the threshold of the security protection system evaluation index, when the security protection system evaluation index is not greater than the threshold of the security protection system evaluation index, the comparison result will be sent to the security protection system operation and maintenance personnel to issue a warning reminder to improve the system security protection performance.

[0028] Example 2 By obtaining the total number of attacks suffered by the computer, the number of successful defenses of the security protection system, and the response time from the start of each attack to the effectiveness of the defense, and conducting a comprehensive analysis of the above data to obtain the core effectiveness index of the security protection system, there is =80, =100, =153, =2 =0.1, then:

[0029] The core effectiveness index of the security protection system is obtained through the above calculation =0.5492, where the larger the core effectiveness index of the safety protection system is, the higher the core effectiveness of the safety protection system is and the better the protection performance of the safety protection system is.

[0030] When the response capability index is obtained by analyzing the number of attack types, the number of attacks of each attack type, the total number of attacks, the number of defense types, the number of defenses of each defense type, and the total number of defenses, =1.0888, =1.0943, =0.3, then:

[0031] The coping capacity index is calculated by =1.2278, where the larger the response capability index is, the stronger the security protection system's defense strategy is in responding to attacks, and the better the security protection system's protection performance is.

[0032] When comprehensively analyzing the core effectiveness index and the response capability index to obtain the safety protection system evaluation index of the safety protection system, there are =0.5492, =1.2278, =0.6, =0.4, then:

[0033] The safety protection system evaluation index of the safety protection system is obtained by calculating =0.82064, where the larger the safety protection system evaluation index is, the better the safety protection performance of the safety protection system is.

[0034] Example 3 After the analysis and processing module calculates the safety protection system evaluation index of the safety protection system, it will be compared with the threshold value of the safety protection system evaluation index set by the threshold setting module. For comparison, when When the command issuing module issues a command to the core protection module, the training and improvement module performs simulation training by obtaining the attack data stored in the data storage module to improve the security protection performance of the security protection system. At the same time, the warning and reminder module will send a warning reminder to the security protection system operation and maintenance personnel based on the comparison results to improve the security protection performance of the system; when When the command issuing module does not issue a command, the warning reminder module does not issue a warning reminder.

[0035] The above-described embodiments merely illustrate several implementations of the present invention, and while their descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that a person skilled in the art would be able to make numerous variations and improvements without departing from the spirit of the present invention, all of which fall within the scope of protection of the present invention. Therefore, the scope of protection of the present invention shall be determined by the appended claims.

Claims

1. A computer security system, characterized in that: include: Monitoring and early warning module, core protection module, data acquisition module, data storage module, analysis and processing module, threshold setting module, instruction issuing module, warning reminder module; Monitoring and early warning module: used to implement real-time monitoring of computers undergoing security protection, and send early warning information to the core protection module and data acquisition module when the computer is attacked by security threats; Core protection module: used to defend against attacks on the computer when the monitoring and warning module issues a security threat attack warning message, train and improve the defense strategy according to the instructions issued by the instruction issuing module, and can also perform virus disinfection operations on files in the computer; Data acquisition module: used to collect relevant data of attacks suffered during the entire defense process and relevant data during the defense process in real time when the monitoring and warning module issues security threat attack warning information, and transmit it to the data storage module and analysis and processing module; Data storage module: used to receive and store the relevant data of the attacks suffered during the entire defense process and the relevant data during the defense process collected in real time by the data acquisition module, and transmit the stored relevant data to the analysis and processing module; Analysis and processing module: used to comprehensively analyze the relevant data of attacks suffered during the entire defense process and the relevant data during the defense process collected in real time by the data acquisition module and the relevant data of attacks suffered during the entire defense process of the computer stored in the data storage module, and obtain the security protection system evaluation index, compare it with the threshold value of the security protection system evaluation index set by the threshold setting module, and transmit the comparison result to the instruction issuing module and the warning reminder module; Threshold setting module: used to set the threshold of the safety protection system evaluation index obtained by comprehensive analysis of the analysis and processing module; Instruction issuing module: used to receive the comparison results of the analysis and processing module, and issue corresponding instructions to the core protection module based on the comparison results; Warning reminder module: used to receive the comparison results of the analysis and processing module, and issue warning reminders to the security protection system operation and maintenance personnel to improve the system security protection performance based on the comparison results.

2. A computer security protection system according to claim 1, characterized in that: The core protection module includes: file antivirus module, attack defense module and training improvement module; File antivirus module: used to perform related antivirus operations on files in the computer; Attack defense module: used to defend against attacks on the computer when the monitoring and warning module issues a security threat attack warning message; Training and improvement module: used to train and upgrade the defense strategy after receiving the corresponding instructions issued by the instruction issuance module.

3. A computer security protection system according to claim 1, characterized in that: When performing analysis and processing, the analysis and processing module obtains the total number of attacks suffered by the computer, the number of successful defenses of the security protection system, and the response time from the start of each attack to the effectiveness of the defense, and conducts a comprehensive analysis of the above data to obtain the core effectiveness index of the security protection system: ； in, It is the core performance index of the security protection system. is the total number of attacks on the computer, The number of successful defenses of the security protection system. is a constant whose value is 2. The response time from attack to defense. is a constant whose value is 0.

1.

4. A computer security protection system according to claim 3, characterized in that: When performing analysis and processing, the analysis and processing module obtains the response capability index by analyzing and processing the number of attack types, the number of attacks of each attack type, the total number of attacks, the number of defense types, the number of defenses of each defense type, and the total number of defenses: ； in, For the coping capacity index, is a constant with a value of 0.3, is the number of attack types, The number of attacks for each attack type, is the total number of attacks, is the number of defense types, The number of defenses for each defense type, The total number of defenses.

5. A computer security protection system according to claim 4, characterized in that: When performing analysis and processing, the analysis and processing module will comprehensively analyze the core effectiveness index and the response capability index to obtain the security protection system evaluation index of the security protection system: ； in, is the safety protection system evaluation index of the safety protection system, is a constant with a value of 0.6, is a constant whose value is 0.4; thus, the safety protection performance of the safety protection system is determined by the safety protection system evaluation index of the safety protection system. When the safety protection system evaluation index of the safety protection system is larger, the safety protection performance of the safety protection system is better, and vice versa, the safety protection performance of the safety protection system is worse.

6. A computer security protection system according to claim 5, characterized in that: When setting the threshold, the threshold setting module will set the threshold of the security protection system evaluation index of the security protection system according to the demand for security protection and the acceptable risk level. The higher the demand for security protection and the lower the acceptable risk level, the greater the threshold for security protection demand and acceptable risk level will be set. Conversely, the smaller the threshold for security protection demand and acceptable risk level will be set.

7. A computer security protection system according to claim 6, characterized in that: When the instruction issuing module receives the comparison result of the security protection system evaluation index and the threshold of the security protection system evaluation index from the analysis and processing module, when the security protection system evaluation index is not greater than the threshold of the security protection system evaluation index, it issues an instruction to the core protection module, and the training improvement module performs simulation training by obtaining the attack data stored in the data storage module to improve the security protection performance of the security protection system.

8. A computer security protection system according to claim 6, characterized in that: When the warning reminder module receives the comparison result of the security protection system evaluation index and the threshold of the security protection system evaluation index from the analysis and processing module, when the security protection system evaluation index is not greater than the threshold of the security protection system evaluation index, the comparison result will be issued to the security protection system operation and maintenance personnel as a warning reminder to improve the system security protection performance.

Images