Network security supervision method, system and device, storage medium and program product

Abstract

The invention discloses a network security supervision method, system and device, a storage medium and a program product, the network security supervision system comprises a data acquisition module, a security analysis module and an event response module, the data acquisition module is used for acquiring software operation data; the security analysis module is used for carrying out feature recognition and analysis on the software operation data to obtain data features, and matching the data features by utilizing a preset reference database to determine potential abnormal information; the event response module is used for determining event types and response priorities corresponding to the potential abnormal information, and triggering corresponding response measures according to the sequence of the response priorities for different types of events; wherein each event type corresponds to at least one response measure. By adopting the embodiment of the invention, potential safety hazards possibly existing in the software system can be quickly detected, so that external attacks of the software system are effectively prevented, and the risk that the software system is invaded is reduced.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of network security, and in particular to a network security supervision method, system, device, storage medium and program product. BACKGROUND

[0002] With more and more application programs and services running in cloud environment or distributed environment, it is particularly important to ensure the security of software running environment. In the Internet environment, software systems involve a large amount of user data and sensitive information, such as personal privacy, financial data, business secrets, etc. Once these data are leaked, it will cause irreparable loss to users and enterprises. Traditional security supervision mainly relies on manual vulnerability scanning, security assessment and monitoring, etc. It is low in efficiency and prone to human error. In the face of a large number of software systems and complex running environment, manual supervision is difficult to achieve comprehensive, timely and accurate discovery of security problems. In addition, the traditional security supervision method is usually carried out periodically, and cannot monitor the changes and potential security threats of software running environment in real time. SUMMARY

[0003] The purpose of the embodiments of the present application is to provide a network security supervision method, system, device, storage medium and program product, which can quickly detect potential security risks in software systems, thereby effectively preventing external attacks on software systems and reducing the risk of software system intrusion.

[0004] To achieve the above-mentioned purpose, the embodiments of the present application provide a network security supervision system, comprising: a data acquisition module, configured to acquire software running data; wherein the software running data comprises at least one of system running data, network interaction data and business scenario data; a security analysis module, configured to perform feature recognition and analysis on the software running data to obtain data features, and match the data features with a preset reference database to determine potential abnormal information; an event response module, configured to determine an event type and a response priority corresponding to the potential abnormal information, and trigger corresponding response measures in order of the response priority for different categories of events; wherein each event type corresponds to at least one response measure.

[0005] As an improvement of the above-mentioned scheme, the security analysis module comprises: a feature recognition unit, configured to process the software running data by using a preset data processing algorithm to obtain data features; an abnormal behavior recognition unit, configured to compare the data features with normal behavior benchmark data in the reference database to identify abnormal data; An attack behavior identification unit is configured to compare the abnormal data with attack data in the reference database to identify an attack behavior. A vulnerability scanning unit is configured to perform vulnerability scanning on the software system to obtain vulnerability data. A comprehensive determination unit is configured to integrate the abnormal data, the attack behavior, and the vulnerability data to obtain potential abnormal information.

[0006] As an improvement of the above-mentioned scheme, the event response module comprises: An event classification unit is configured to obtain an attack type and a severity level contained in the potential abnormal information, and determine a corresponding event type according to the attack type and the severity level. A priority evaluation unit is configured to perform impact evaluation on the event type by using a preset event impact evaluation dimension to determine a response priority. A response measure triggering unit is configured to obtain a response measure corresponding to the event type, and trigger the corresponding response measure in the order of the response priority for each event type.

[0007] As an improvement of the above-mentioned scheme, the event response module further comprises: An event analysis unit is configured to collect attack trace data after the response measure is executed, and determine an event occurrence cause according to the attack trace data. An event closed-loop unit is configured to close the event response process after detecting that the software system returns to normal, and update the response measure according to the event occurrence cause.

[0008] As an improvement of the above-mentioned scheme, the response measure comprises at least one of: An immediate disposal measure, comprising at least one of automatically isolating the software system, sending real-time alarm information, and executing a preset security policy; A recovery and repair measure, comprising performing a recovery operation and / or a security reinforcement operation on the software system.

[0009] As an improvement of the above-mentioned scheme, the system further comprises: A risk evaluation module is configured to quantitatively evaluate a security risk of a running environment of the software system according to the abnormal data, the attack behavior, and the vulnerability data, and output a risk score and a repair suggestion based on the quantitative evaluation result.

[0010] As an improvement of the above-mentioned scheme, the system further comprises: A security policy management module is configured to manage a security policy of the software system during running, wherein the security policy is at least one security control rule for regulating resource access, identity verification, network protection, and data protection of the software system during running.

[0011] As an improvement to the above solution, the system further includes: The security policy management module includes: The access control unit is used to configure user access permissions and access scope for system resources; An authentication unit is used to configure the authentication mechanism of a software system. A network protection unit is used to configure network protection measures for the software system; wherein, the network protection measures include at least one of firewall rules, intrusion detection and prevention policies, and virtual private network usage guidelines; A data protection unit is used to perform data protection measures on the data of a software system; wherein the data protection measures include at least one of data encryption, backup, data classification, and storage location control.

[0012] As an improvement to the above solution, the system further includes: The log management module is used to record all operations of the software system during operation, and to perform lifecycle management and / or log analysis on the log data generated by all operations.

[0013] As an improvement to the above solution, the log management module includes: The log collection unit is used to record all operations of the software system during operation, and to obtain log data after uniformly formatting the response operations. A log storage unit is used to classify and store the log data according to time and / or type, and to manage the lifecycle of the stored log data according to a preset log lifecycle strategy. The log analysis unit is used to perform real-time analysis on the log data to identify abnormal events and trigger alarm mechanisms. The log query unit provides the function of retrieving historical logs by conditions and generating periodic analysis reports.

[0014] As an improvement to the above solution, the system further includes: The monitoring module is used to acquire the operating status data of the software system and trigger an abnormal alarm when the operating status data meets the set conditions.

[0015] As an improvement to the above solution, the monitoring module includes: A real-time status acquisition unit is used to acquire operational status data; wherein, the operational status data includes the component health status of key components of the software system, the resource usage of system resources, and the performance indicators of the software system; An abnormal alarm unit is used to automatically trigger alarms for operating status data that meets set conditions; The data visualization and reporting unit is used to visualize the operating status data and generate system performance reports periodically. The data integration unit is used to integrate log data and the operation status data, and / or integrate historical status data and the operation status data, and generate a data analysis report based on the integrated data.

[0016] To achieve the above objectives, embodiments of the present invention also provide a network security supervision method, comprising: Collect software operation data; wherein, the software operation data includes at least one of system operation data, network interaction data, and business scenario data; The software operation data is subjected to feature identification and analysis to obtain data features, and the data features are matched using a preset reference database to identify potential abnormal information. The event type and response priority corresponding to the potential anomaly information are determined, and the corresponding response measures are triggered in the order of the response priorities for different categories of events; wherein, each event type corresponds to at least one response measure.

[0017] As an improvement to the above solution, the step of performing feature identification and analysis on the software operation data to obtain data features, and matching the data features using a preset reference database to determine potential anomalies, includes: The software runtime data is processed using a preset data processing algorithm to obtain data features; The data features are compared with normal behavior benchmark data in the reference database to identify abnormal data; The abnormal data is compared with the attack data in the reference database to identify the attack behavior; Perform vulnerability scanning on the software system to obtain vulnerability data; By integrating the abnormal data, the attack behavior, and the vulnerability data, potential abnormal information is obtained.

[0018] As an improvement to the above solution, the method further includes: Based on the abnormal data, the attack behavior, and the vulnerability data, a quantitative assessment of the security risks of the software system's operating environment is conducted, and a risk score and remediation recommendations are output based on the quantitative assessment results.

[0019] As an improvement to the above solution, the method further includes: Security policies for managing software systems during runtime; wherein the security policy is at least one security control rule used to regulate resource access, authentication, network protection, and data protection during the operation of the software system; Record all response operations of the software system during operation, and perform lifecycle management and / or log analysis on the log data generated by all operations; The system acquires the operating status data of the software system and triggers an abnormal alarm when the operating status data meets the set conditions.

[0020] To achieve the above objectives, embodiments of the present invention also provide a network security monitoring device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, it implements the network security monitoring method as described in any of the above embodiments.

[0021] To achieve the above objectives, embodiments of the present invention also provide a computer-readable storage medium storing a computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to perform the network security monitoring method as described in any of the above embodiments.

[0022] To achieve the above objectives, embodiments of the present invention also provide a computer program product, including a computer program / instruction, which, when executed by a processor, implements the network security monitoring method as described in any of the above embodiments.

[0023] Compared to existing technologies, the network security monitoring method, system, device, storage medium, and program products disclosed in this invention comprehensively capture system, network, and business data during software operation through a data acquisition module, providing a multi-dimensional data source for security analysis. The security analysis module, based on feature recognition and reference database matching, accurately locates potential anomalies, enabling early detection of security threats. The event response module, through event classification and prioritization, triggers corresponding response measures according to the urgency of different event types, rapidly detecting potential security vulnerabilities in the software system and effectively preventing external attacks, thus reducing the risk of intrusion. Overall, the system not only comprehensively perceives the software's operational status and promptly identifies security risks, but also quickly handles threats through standardized and prioritized response strategies, effectively reducing the impact of security events on software operation, improving the software system's security, stability, and resilience, and providing end-to-end intelligent security protection for the software operating environment. Attached Figure Description

[0024] Figure 1 This is a structural block diagram of a network security monitoring system provided in an embodiment of the present invention; Figure 2 This is a structural block diagram of the security analysis module provided in an embodiment of the present invention; Figure 3This is a structural block diagram of the event response module provided in an embodiment of the present invention; Figure 4 This is another structural block diagram of a network security monitoring system provided in an embodiment of the present invention; Figure 5 This is a structural block diagram of the security policy management module provided in an embodiment of the present invention; Figure 6 This is a structural block diagram of the log management module provided in an embodiment of the present invention; Figure 7 This is a structural block diagram of the monitoring module provided in an embodiment of the present invention; Figure 8 This is a flowchart of a network security supervision method provided in an embodiment of the present invention; Figure 9 This is a structural block diagram of a network security monitoring device provided in an embodiment of the present invention. Detailed Implementation

[0025] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0026] See Figure 1 , Figure 1 This is a structural block diagram of a network security monitoring system 100 provided in an embodiment of the present invention. The network security monitoring system 100 includes: The data acquisition module 11 is used to collect software operation data; wherein, the software operation data includes at least one of system operation data, network interaction data, and business scenario data; The security analysis module 12 is used to perform feature recognition and analysis on the software operation data, obtain data features, and match the data features using a preset reference database to determine potential abnormal information. The event response module 13 is used to determine the event type and response priority corresponding to the potential abnormal information, and to trigger corresponding response measures for different categories of events in order of the response priority; wherein, each event type corresponds to at least one response measure.

[0027] In this embodiment of the invention, the data acquisition module comprehensively captures system, network, and business data during software operation, providing a multi-dimensional data source for security analysis. The security analysis module, based on feature recognition and reference database matching, accurately locates potential anomalies, enabling early detection of security threats. The event response module, through event classification and priority ranking, triggers corresponding response measures according to the urgency of different event types, rapidly detecting potential security vulnerabilities in the software system. This effectively prevents external attacks on the software system and reduces the risk of intrusion. Overall, the system not only comprehensively perceives the software's operational status and promptly identifies security risks, but also quickly handles threats through standardized and prioritized response strategies, effectively reducing the impact of security events on software operation, improving the software system's security, stability, and resilience, and providing end-to-end, intelligent security assurance for the software operating environment.

[0028] Furthermore, the system operation data reflects the real-time status and operation records of the underlying systems (hardware, operating system, etc.) upon which the software relies for operation. This includes at least one of the following: logs (such as system logs, operation logs, etc.), real-time system activities (such as CPU usage, memory usage, process status, etc.), file operations (such as file creation, modification, deletion, access records, etc.), and environmental data (such as information related to software and system configuration). Log data can help identify abnormal behavior, potential attack signs, or configuration errors; real-time system activities can promptly capture abnormal fluctuations in system resources; file operations help detect malware or malicious operations; and environmental data can help verify whether the system configuration meets security standards and detect improper configurations or vulnerabilities. The network interaction data can be network traffic data, such as traffic, connections, protocols, etc., helping to discover potential network attacks or network abuse. The business scenario data consists of business-related data generated around the software application itself and user behavior, including user behavior data (such as login, operation commands, access paths, etc.) and application running status (such as process startup, shutdown, resource usage, and abnormal crashes, etc.). User behavior data can help analyze whether there are abnormal user behaviors, such as unauthorized access or abuse of permissions. Application running status can reflect the software's running status in a timely manner.

[0029] It should be noted that the data acquisition module 11 can collect relevant data in various ways, mainly including: 1) The data acquisition module 11 actively initiates the monitoring and collection of system resources, log files, network traffic, etc. This method can realize real-time data collection and ensure timely response to potential security incidents; 2) The data acquisition module 11 is only triggered or responded to when certain events occur. This method is usually used for in-depth analysis of specific security events. 3) By deploying an agent program on the monitored system or server, the data acquisition module 11 collects data through the agent. This method enables fine-grained monitoring of each individual node and is suitable for distributed environments. 4) In some cases, the data acquisition module 11 may not be deployed directly in the target environment, but may collect relevant data remotely; 5) Data acquisition module 11 collects data from multiple sources and centralizes it in a central repository or data lake for further analysis.

[0030] See Figure 2 , Figure 2 This is a structural block diagram of the security analysis module 12 provided in an embodiment of the present invention. The security analysis module 12 includes: Feature recognition unit 121 is used to process the software running data using a preset data processing algorithm to obtain data features; The abnormal behavior identification unit 122 is used to compare the data features with normal behavior benchmark data in the reference database to identify abnormal data. The attack behavior identification unit 123 is used to compare the abnormal data with the attack data in the reference database to identify the attack behavior; Vulnerability scanning unit 124 is used to perform vulnerability scanning on the software system and obtain vulnerability data; The comprehensive judgment unit 125 is used to integrate the abnormal data, the attack behavior, and the vulnerability data to obtain potential abnormal information.

[0031] For example, the feature recognition unit 121 first receives multi-source software operation data collected by the data acquisition module 11 and performs in-depth processing through preset data processing algorithms. For instance, for structured data (such as user login time and resource access frequency), statistical methods (such as mean and variance calculation) are used to extract data distribution characteristics, such as extracting the average login time of a user over 30 consecutive days or the average daily access frequency of a port. For unstructured data (such as log text and data packet payload), natural language processing (NLP) and pattern recognition algorithms are used to extract key identifiers, such as identifying dangerous operation keywords from abnormal command line logs and extracting feature codes from network data packets. For time-series data, such as CPU utilization change curves and network connection establishment / disconnection time series, machine learning algorithms are used to capture trend features. For example, the machine learning algorithm can be LSTM (Long Short-Term Memory), such as using machine learning algorithms to identify a sudden pattern in which server memory usage spikes from 20% to 90% within 10 minutes. Finally, the feature recognition unit 121 transforms the raw data into standardized data features, providing a unified format for analysis objects in subsequent recognition.

[0032] The abnormal behavior identification unit 122 compares the data features output by the feature identification unit 121 with a pre-built normal behavior benchmark model in the reference database from multiple dimensions. This benchmark model includes historically accumulated normal behavior data, such as the regular login IP range of an administrator, the daily average transaction peak range of the business system, and the normal startup sequence of server processes, and is dynamically updated through continuous learning (e.g., incorporating new normal operation samples weekly). During the comparison process, methods such as threshold judgment (e.g., the access frequency of a certain IP exceeds 5 times the historical average), pattern matching (e.g., the consistency between the user operation sequence and the normal process is lower than a set value), and cluster analysis (e.g., the distance between the current behavior feature and the cluster center of normal behavior exceeds a threshold) are used to mark behaviors that deviate from the normal pattern. For example, when a user account that has never logged in before 3 AM suddenly attempts to log in 10 times during that time period, or when a business process suddenly accesses the second unauthorized database table, these are marked as abnormal data.

[0033] The attack behavior identification unit 123 initiates a precise match between the abnormal data output by the abnormal behavior identification unit 122 and the attack signature database in the reference database. The attack signature database contains multi-dimensional characteristics of known attacks and is updated synchronously with the latest threat intelligence released by security vendors. During the matching process, at least one method can be used, such as signature comparison (e.g., whether network traffic contains signatures of known malicious code), behavior sequence comparison (e.g., whether abnormal operations completely match the steps of a certain type of attack), and correlation analysis (e.g., whether the abnormal login IP is in the malicious IP list of the threat intelligence). For example, if the IP initiating the request is marked in recent ransomware attack intelligence, it is determined to be an attack behavior, and the attack type (injection attack), threat level (high risk), and possible attack source are associated.

[0034] The vulnerability scanning unit 124 periodically scans the operating system, applications, and network configuration of the software system. It then uses a known vulnerability database to identify security vulnerabilities in the system, such as unpatched high-risk vulnerabilities, and generates vulnerability data. By analyzing the scan results, it assesses potential security risks and analyzes the system's configuration, code, and network topology to identify configuration errors or potential security weaknesses, preventing attackers from exploiting these weaknesses to launch attacks on the system software.

[0035] The comprehensive judgment unit 125 finally integrates the abnormal data output by the abnormal behavior identification unit, the attack behavior confirmed by the attack behavior identification unit, and the vulnerability data discovered by the vulnerability scanning unit. Through correlation analysis, it eliminates false alarms, clarifies the risk level, and finally forms potential abnormal information containing threat type and potential impact, which is then sent to the event response module. For example, if the vulnerability scanning unit 124 discovers a remote command execution vulnerability on a server, and the attack behavior identification unit 123 detects an abnormal command execution request from an external IP, then the two are determined to be related, thus strengthening the threat credibility. If an abnormal data appears only in isolation (such as a single misoperation) and is not related to attack characteristics or vulnerabilities, it is marked as a low-credibility anomaly to reduce false alarms. Secondly, risk rating can be performed, combining the severity of the anomaly (such as whether it involves sensitive data) and the destructive power of the attack behavior (such as whether it causes system crashes), and classifying potential risks into four levels: urgent, high-risk, medium-risk, and low-risk. Finally, structured potential anomaly information is generated, including threat type (such as a remote attack using the XX vulnerability), affected assets (such as database server B, user account C), risk level (such as urgent), key evidence (such as attack IP, vulnerability scan screenshots), and is pushed to the event response module 13 in real time, providing accurate decision-making basis for subsequent handling.

[0036] In this embodiment of the invention, the feature recognition unit 121 performs standardized feature extraction on the raw data, laying a precise foundation for subsequent analysis; the abnormal behavior recognition unit 122 quickly locates deviation behaviors based on normal baseline data, achieving preliminary screening of potential risks; the attack behavior recognition unit 123 performs secondary verification of abnormal data by combining known attack characteristics, improving the accuracy of threat identification; the vulnerability scanning unit 124 proactively discovers inherent system defects, compensating for the shortcomings of passive detection; and the comprehensive judgment unit 125 effectively reduces false positives and false negatives through multi-dimensional data integration and correlation analysis, forming comprehensive and accurate potential anomaly information. Overall, the security analysis module 12 not only achieves accurate identification of known threats but also captures unknown abnormal behaviors, while covering proactive vulnerability detection, comprehensively improving the timeliness, accuracy, and completeness of security threat identification, providing reliable decision-making basis for the event response module, and enhancing the system's ability to perceive and warn of security risks.

[0037] See Figure 3 , Figure 3 This is a structural block diagram of the event response module 13 provided in an embodiment of the present invention. The event response module 13 includes: Event classification unit 131 is used to obtain the attack type and severity contained in the potential anomaly information, and determine the corresponding event type according to the attack type and the severity. Priority assessment unit 132 is used to assess the impact of the event type using a preset event impact assessment dimension and determine the response priority; The response measure triggering unit 133 is used to obtain the response measures corresponding to the event category, and for each event category, trigger the corresponding response measures in the order of the response priority.

[0038] For example, the event classification unit 131 first receives potential anomaly information output by the security analysis module 12, extracts key elements from it, including attack type and severity. For example, attack types include data breach, network intrusion, and privilege abuse, determined based on threat characteristics in the potential anomaly information. Severity can be determined based on whether sensitive data is involved or whether core business is affected, as well as the risk level in the potential anomaly information. Subsequently, according to preset classification rules, such as "data breach + involving user privacy data" corresponding to high-risk data breach events, and "network intrusion + only affecting non-core servers" corresponding to medium-risk intrusion events, the event is classified into a clear event type, providing a basis for subsequent response strategy matching.

[0039] Priority assessment unit 132 initiates a multi-dimensional impact assessment for the event type determined by event classification unit 131. The assessment dimensions include the scope of event impact (such as the number of servers involved and the scale of users), data sensitivity (such as whether it is payment information or personal identity data), and attack destructive power (such as whether it causes system crashes or business interruptions). Then, based on a preset scoring model, each dimension is scored and a weighted total score is calculated. The response priority is determined according to the total score, such as 9-10 points corresponding to the highest priority, 6-8 points corresponding to medium-high priority, and so on.

[0040] The response triggering unit 133 performs tiered handling based on event type and response priority. First, it retrieves the corresponding response measures from a pre-set event-measure mapping library. Then, it schedules the measures for execution according to priority order. For the highest priority event, immediate handling measures are triggered immediately; for medium- and high-priority events, alarm notifications are initiated within 5 minutes. Simultaneously, this unit records the implementation status of the measures in real time, providing a basis for subsequent event closure.

[0041] In this embodiment of the invention, the event classification unit 131 accurately extracts attack types and severity to achieve standardized classification of security events, ensuring the targeted nature of response strategies; the priority assessment unit 132 scientifically delineates response priorities based on a multi-dimensional impact assessment model, avoiding resource waste and focusing on high-risk events; and the response measure triggering unit 133 ensures that emergency events are handled immediately and general events are responded to in an orderly manner. The collaborative work of these three units not only improves the timeliness and accuracy of security event response and reduces the risk of threat spread, but also reduces human decision-making errors through standardized processes, ensuring that all types of events receive resources commensurate with their risk levels. Ultimately, this enhances the system's practical ability to respond to security threats and effectively guarantees the stability and security of the software operating environment.

[0042] Furthermore, the response measures include at least one of the following: 1) Immediate response measures, including at least one of the following: automatic isolation of the software system, sending real-time alarm information, and executing preset security policies; For example, immediate response measures are used to quickly contain the spread of threats in the early stages of a security incident. For instance, when a server is detected to be under ransomware attack (the highest priority event), the automatic isolation unit immediately cuts off the connection between the server and the core business network segment to prevent the virus from spreading laterally. The real-time alarm module sends alarm information containing the attacking IP, affected assets, and risk level to the security administrator via SMS, telephone, etc., to ensure that relevant personnel respond quickly. Security policies can include automatically closing the remote login port of the server and activating file anti-tampering mechanisms to lock critical system directories, reducing the possibility of continued damage from the source. 2) Recovery and remediation measures, including performing recovery operations and / or security hardening operations on the software system.

[0043] For example, recovery and remediation measures are used to restore normal system operation and strengthen defenses after the threat has been initially controlled. For instance, in the case of database paralysis caused by a vulnerability attack, recovery operations can call the most recent full backup to roll back the data to its normal state before the attack. Security hardening operations include installing patches for the corresponding vulnerabilities on the database server (such as version updates that fix the vulnerabilities), reconfiguring access permissions (such as deleting unnecessary high-privilege accounts), and enabling database audit logs to monitor subsequent operations. If the incident involves user data leakage, hardening operations such as password resets and encrypted storage of sensitive data can also be performed to prevent similar leakage incidents from happening again.

[0044] In this embodiment of the invention, immediate response measures and recovery and repair measures together enhance the network security monitoring system's ability to handle security incidents throughout their entire lifecycle, providing dual protection for the continuous and stable operation of the software system.

[0045] Furthermore, the event response module 13 also includes: The event analysis unit 134 is used to collect attack tracing data after the response measures are executed, and to determine the cause of the event based on the attack tracing data. The event closed-loop unit 135 is used to close the current event response process after detecting that the software system has returned to normal, and update the response measures according to the cause of the event.

[0046] For example, the incident analysis unit 134 analyzes data such as system logs, network traffic, and file change records to find the attacker's intrusion path and behavioral patterns, determine the source, target, and impact of the attack, and identify the root cause of the attack, such as system vulnerabilities, configuration errors, or internal personnel abuse. This helps prevent similar incidents from recurring. If necessary, digital forensics are conducted to prove the evidence and process of the attack, ensuring the legality and effectiveness of the incident investigation. After the incident is repaired and the threat is confirmed to no longer exist, the incident closure unit 135 formally closes the incident response process, ensuring that all necessary repairs have been completed and the relevant systems have returned to normal. Simultaneously, it analyzes the advantages and disadvantages of the entire incident response process, identifying which measures were effective and which aspects were insufficient. Based on the review results, the incident response plan is updated and optimized, and emergency response processes, tools, and technologies are improved. Future response capabilities can also be enhanced by supplementing new protective measures and strengthening training.

[0047] In this embodiment of the invention, the event analysis unit 134, by comprehensively collecting source data and deeply exploring the root causes, not only achieves the knowledge and traceability of security events, providing a basis for responsibility definition and compliance audit, but also accurately locates the system's defense weaknesses; the event closure unit 135, through process closure and measure update, transforms the experience of handling a single event into long-term defense capabilities, ensuring the standardization and integrity of the event response process, and continuously improving the system's ability to predict and handle new threats by dynamically optimizing response measures and updating the threat signature database.

[0048] See Figure 4 , Figure 4 This is another structural block diagram of a network security monitoring system 100 provided in an embodiment of the present invention. The network security monitoring system 100 further includes a risk assessment module 14, a security policy management module 15, a log management module 16, and a monitoring module 17.

[0049] Specifically, the risk assessment module 14 is used to quantitatively assess the security risks of the operating environment of the software system based on the abnormal data, the attack behavior and the vulnerability data, and output a risk score and remediation suggestions based on the quantitative assessment results.

[0050] For example, the risk assessment module 14 first receives the abnormal data, attack behaviors, and vulnerability data output by the security analysis module 13. Then, based on a preset risk quantification model, it assigns scores to the three types of data. For example, in the abnormal data, "more than 10 failed login attempts in a single day" is scored as 5 points, and "unauthorized access to the core database" is scored as 15 points; in the attack behaviors, "successful intrusion by known high-risk attacks" is scored as 30 points, and "attacks are intercepted but the number of attempts is frequent" is scored as 10 points; in the vulnerability data, "the existence of vulnerabilities that can be exploited by public tools" is scored as 10 points. Finally, a comprehensive risk score is obtained through weighted calculation (e.g., attack behavior weight 40%, vulnerability data weight 35%, and abnormal data weight 25%), and targeted remediation suggestions are generated based on the score results, such as prioritizing the remediation of vulnerabilities, then restricting the access permissions of abnormal login IPs, and strengthening the updating of the attack signature database.

[0051] In this embodiment of the invention, the risk assessment module 14 transforms abstract security risks into intuitive scoring results through quantitative analysis of abnormal data, attack behaviors, and vulnerability data. This allows administrators to clearly understand the risk level of the software system's operating environment. Simultaneously, the remediation suggestions generated based on the scoring logic clarify the priority and specific measures for risk handling, avoiding blind defense. This process achieves both accurate quantification and visualization of security risks, provides a scientific basis for risk governance, effectively enhances the initiative and targeted approach of the software system in responding to security threats, and further strengthens the closed-loop defense capabilities of the network security supervision system.

[0052] Specifically, the security policy management module 15 is used to manage the security policies of the software system during operation; wherein, the security policy is at least one security control rule used to regulate resource access, authentication, network protection and data protection during the operation of the software system.

[0053] For example, resource access refers to the scope of access and restrictions on operation permissions for resources such as servers and databases. Authentication refers to mechanisms such as password strength and two-factor authentication when users log in. Network protection refers to the configuration of firewall rules and intrusion detection policies. Data protection refers to specifications such as data encryption standards and backup frequency.

[0054] In this embodiment of the invention, a security policy management module 15 is provided to ensure software operation compliance, reduce human error, provide standardized protection for the system, and improve overall security by uniformly managing security rules such as resource access and authentication.

[0055] Further, see Figure 5 , Figure 5 This is a structural block diagram of the security policy management module 15 provided in an embodiment of the present invention. The security policy management module 15 includes: Access control unit 151 is used to configure user access permissions and access scope to system resources; it is used to define who can access which resources, and their access permission level. The authentication unit 152 is used to configure the authentication mechanism of the software system, such as password strength requirements, two-factor authentication, and biometrics. Network protection unit 153 is used to configure network protection measures for the software system; wherein, the network protection measures include at least one of firewall rules, intrusion detection and prevention policies, and virtual private network usage specifications; The data protection unit 154 is used to perform data protection measures on the data of the software system; wherein the data protection measures include at least one of data encryption, backup, data classification, and storage location control.

[0056] For example, it is also necessary to regularly evaluate existing security strategies to ensure they can cope with new security threats, regularly check for security vulnerabilities in the system using vulnerability scanning tools and apply patches in a timely manner, and continuously adjust and optimize security strategies through the analysis of historical security incidents.

[0057] In this embodiment of the invention, the security policy management module 15 achieves refined configuration and unified management of security rules through the collaboration of access control, authentication and other units, forming a full-dimensional protection system from resource access, identity verification, network protection to data security, reducing security policy loopholes and ensuring the compliance and security of system operation.

[0058] Specifically, the log management module 16 is used to record all operations of the software system during operation, and to perform lifecycle management and / or log analysis on the log data generated by all operations.

[0059] For example, these operations include all interactions and actions during software operation, such as user login / logout, resource access (e.g., file reading, database querying), system configuration changes (e.g., permission modification, policy update), and security incident response (e.g., isolation operations, vulnerability patching).

[0060] In this embodiment of the invention, the log management module 16 comprehensively records operations, standardizes the log lifecycle, and performs in-depth analysis. This not only meets compliance audit requirements but also allows for tracing the root cause of events and optimizing security strategies. It provides the system with a fully traceable operational record and strengthens the closed-loop capability of security supervision.

[0061] Further, see Figure 6 , Figure 6 This is a structural block diagram of the log management module 16 provided in an embodiment of the present invention. The log management module 16 includes: The log collection unit 161 is used to record all operations of the software system during operation, and to obtain log data after uniformly formatting the response operations. Log storage unit 162 is used to classify and store the log data according to time and / or type, and to manage the lifecycle of the stored log data according to a preset log lifecycle strategy. The log analysis unit 163 is used to perform real-time analysis on the log data to identify abnormal events and trigger an alarm mechanism. Log query unit 164 is used to provide the function of retrieving historical logs by conditions and to generate periodic analysis reports.

[0062] For example, the log collection unit 161 captures all operations in the software system in real time (such as user login, permission changes, vulnerability repair, etc.), converting unstructured raw records (such as system logs and application logs in different formats) into a unified format, such as converting them into a JSON structure, containing fields such as operation time, subject, content, and result, forming standardized log data. The log storage unit 162 classifies and stores log data according to time (such as creating storage partitions daily) and type (such as user operation logs and response action logs). According to preset strategies, such as retaining core logs for 3 years and ordinary logs for 6 months, expired logs are automatically archived to cold storage, and log integrity is checked periodically, such as by comparing hash values ​​to prevent tampering. The log analysis unit 163 monitors the log data flowing in in real time, and identifies potential abnormal events and triggers alarms (such as pushing abnormal operation details to the administrator) through rule matching (such as detecting 10 consecutive failed logins) and anomaly detection algorithms (such as identifying high-frequency configuration modifications that deviate from historical patterns). The log query unit 164 provides multi-condition search functionality, supporting filtering by time range, operation type, user account, etc., and automatically generates regular reports, such as weekly security operation audit reports and monthly abnormal event statistics reports, for users to trace events and analyze trends.

[0063] In this embodiment of the invention, the log management module 16 achieves standardized management of the entire log lifecycle through the collaboration of the collection, storage, analysis and query units. This not only ensures the integrity and traceability of operation records and meets compliance audit requirements, but also enables rapid identification of anomalies through real-time analysis, providing data support for security decisions and strengthening the system's auditability and risk warning capabilities.

[0064] Specifically, the monitoring module 17 is used to acquire the operating status data of the software system, and trigger an abnormal alarm when the operating status data is detected to meet the set conditions.

[0065] Further, see Figure 7 , Figure 7 This is a structural block diagram of the monitoring module 17 provided in an embodiment of the present invention. The monitoring module 17 includes: The real-time status acquisition unit 171 is used to acquire operating status data; wherein, the operating status data includes the component health status of the key components of the software system, the resource usage of system resources, and the performance indicators of the software system; The abnormal alarm unit 172 is used to automatically trigger alarms for operating status data that meet set conditions; The data visualization and reporting unit 173 is used to visualize the operating status data and generate system performance reports periodically. The data integration unit 174 is used to integrate log data and the operation status data, and / or integrate historical status data and the operation status data, and generate a data analysis report based on the integrated data.

[0066] For example, the real-time status acquisition unit 171 continuously collects operational status data of the software system, such as obtaining the health status of key components like server online status and database connection success rate through interface calls; collecting resource usage data such as CPU utilization, memory usage, and network bandwidth through system monitoring tools; and obtaining performance indicators such as response time, transaction throughput, and error rate through business tracking points to form a real-time dynamic dataset. The anomaly alarm unit 172 compares the real-time status data with preset thresholds or rules. When the data meets the alarm conditions, it automatically triggers multi-level alarms, such as sending SMS, email, and system push notifications simultaneously for urgent anomalies; and generating system notifications for general anomalies, along with anomaly details (such as specific indicator values ​​and related components). The data visualization and reporting unit 173 transforms the operational status data into dashboards, such as displaying the 24-hour trend of CPU / memory using line charts, presenting the error rate percentage of each business module using pie charts, and displaying real-time transaction throughput using dashboard indicator cards; it also automatically generates system performance reports on a weekly / monthly basis, including resource load peaks, performance bottleneck analysis, and capacity planning suggestions. The data integration unit 174 integrates error logs and real-time status data from the log management module, such as database connection timeout logs, and combines them with database performance indicators for the corresponding time period to locate the root cause of the anomaly. On the other hand, it associates historical status data with current data and identifies potential risks through trend analysis. For example, if the potential risk is a 5% monthly increase in memory usage, which is expected to reach a critical value in 3 months, a comprehensive report will be generated.

[0067] In this embodiment of the invention, the monitoring module 17 achieves full-dimensional perception of the system's operating status, timely early warning of anomalies, and in-depth correlation analysis of data through the collaboration of real-time status acquisition, anomaly alarms, visual reports, and data integration. This provides the operation and maintenance team with an intuitive monitoring perspective and helps to avoid risks in advance through predictive analysis and optimization suggestions, thereby improving the stability and operational efficiency of the system.

[0068] Compared to existing technologies, the network security monitoring system 100 disclosed in this invention, by monitoring the software's operating environment in real time, can quickly detect potential vulnerabilities and security risks, and promptly notify relevant personnel for remediation. This effectively prevents vulnerabilities from being exploited by external attacks, reducing the risk of software intrusion. The security monitoring system can monitor and analyze data traffic and file access during software operation, promptly detecting and intercepting the spread of malicious software and viruses, protecting the integrity and availability of software and related data. The network security monitoring system 100 can strictly control and encrypt data access and transmission in the software operating environment, preventing data leakage, tampering, and other security incidents, ensuring the confidentiality, integrity, and authenticity of data, and meeting the stringent data security requirements of enterprises and users. In addition, the network security monitoring system monitors the system resource usage in the software's operating environment in real time. Based on the monitoring results, it allocates and optimizes resources reasonably to ensure that the software can run under the best resource configuration, thereby improving the software's operating efficiency and response speed. When the software experiences performance problems, the system can quickly locate the root cause of the problem and determine whether it is caused by network congestion, system failure, or defects in the software itself. It also provides corresponding solutions to help developers and operations personnel quickly resolve problems, reduce software downtime, and improve software availability.

[0069] See Figure 8 , Figure 8 This is a flowchart of a network security supervision method provided by an embodiment of the present invention, the network security supervision method comprising: S1. Collect software operation data; wherein, the software operation data includes at least one of system operation data, network interaction data, and business scenario data; S2. Perform feature recognition and analysis on the software operation data to obtain data features, and use a preset reference database to match the data features to determine potential abnormal information; S3. Determine the event type and response priority corresponding to the potential abnormal information, and trigger the corresponding response measures for different categories of events in order of the response priority; wherein, each event type corresponds to at least one response measure.

[0070] Furthermore, the step of performing feature identification and analysis on the software operation data to obtain data features, and matching the data features using a preset reference database to determine potential anomalies, includes: The software runtime data is processed using a preset data processing algorithm to obtain data features; The data features are compared with normal behavior benchmark data in the reference database to identify abnormal data; The abnormal data is compared with the attack data in the reference database to identify the attack behavior; Perform vulnerability scanning on the software system to obtain vulnerability data; By integrating the abnormal data, the attack behavior, and the vulnerability data, potential abnormal information is obtained.

[0071] Furthermore, the method also includes: Based on the abnormal data, the attack behavior, and the vulnerability data, a quantitative assessment of the security risks of the software system's operating environment is conducted, and a risk score and remediation suggestions are output based on the quantitative assessment results.

[0072] Furthermore, the method also includes: Based on the abnormal data, the attack behavior, and the vulnerability data, a quantitative assessment of the security risks of the software system's operating environment is conducted, and a risk score and remediation suggestions are output based on the quantitative assessment results.

[0073] It is worth noting that the working process of each module in the network security supervision method described in the embodiments of the present invention can refer to the working process of the network security supervision system described in the above embodiments, and will not be repeated here.

[0074] See Figure 9 , Figure 9 This is a structural block diagram of a network security monitoring device 200 provided in an embodiment of the present invention. The network security monitoring device 200 includes a processor 21, a memory 22, and a computer program stored in the memory 22 and executable on the processor 21. When the processor 21 executes the computer program, it implements the steps in the various network security monitoring method embodiments described above.

[0075] For example, the computer program may be divided into one or more modules / units, which are stored in the memory 22 and executed by the processor 21 to complete the present invention. The one or more modules / units may be a series of computer program instruction segments capable of performing specific functions, which describe the execution process of the computer program in the network security monitoring device 200.

[0076] The network security monitoring device 200 may include, but is not limited to, a processor 21 and a memory 22. Those skilled in the art will understand that the schematic diagram is merely an example of the network security monitoring device 200 and does not constitute a limitation on the network security monitoring device 200. It may include more or fewer components than illustrated, or combine certain components, or different components. For example, the network security monitoring device 200 may also include input / output devices, network access devices, buses, etc.

[0077] The processor 21 can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor. The processor 21 is the control center of the network security monitoring device 200, connecting all parts of the network security monitoring device 200 via various interfaces and lines.

[0078] The memory 22 can be used to store the computer programs and / or modules. The processor 21 implements various functions of the network security monitoring device 200 by running or executing the computer programs and / or modules stored in the memory 22 and calling the data stored in the memory 22. The memory 22 may mainly include a program storage area and a data storage area. The program storage area may store the operating system, at least one application program required for a function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created according to the use of the mobile phone (such as audio data, phonebook, etc.). In addition, the memory 22 may include high-speed random access memory, and may also include non-volatile memory, such as hard disk, memory, plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0079] If the modules / units integrated in the network security monitoring device 200 are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by the processor 21, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc.

[0080] Furthermore, the present invention also provides a computer program product, including a computer program / instruction that, when executed by a processor, implements the network security monitoring method as described in any of the above embodiments.

[0081] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A cyber-security monitoring system, characterized by, The system comprises: a data collection module for collecting software operation data, wherein the software operation data comprises at least one of system operation data, network interaction data and business scenario data; a security analysis module for identifying and analyzing features of the software operation data to obtain data features, and matching the data features with a preset reference database to determine potential abnormal information; an event response module for determining an event type and a response priority corresponding to the potential abnormal information, and triggering corresponding response measures in order of the response priority for different categories of events; wherein each event type corresponds to at least one response measure.

2. The cyber-security monitoring system of claim 1, wherein, The security analysis module comprises: a feature identification unit for processing the software operation data using a preset data processing algorithm to obtain data features; an abnormal behavior identification unit for comparing the data features with normal behavior benchmark data in the reference database to identify abnormal data; an attack behavior identification unit for comparing the abnormal data with attack data in the reference database to identify attack behavior; a vulnerability scanning unit for scanning software systems for vulnerabilities to obtain vulnerability data; a comprehensive determination unit for integrating the abnormal data, the attack behavior and the vulnerability data to obtain potential abnormal information.

3. The cyber-security monitoring system of claim 1, wherein, The event response module comprises: an event classification unit for obtaining an attack type and a severity level contained in the potential abnormal information, and determining a corresponding event type according to the attack type and the severity level; a priority evaluation unit for evaluating the impact of the event type using a preset event impact evaluation dimension to determine a response priority; a response measure triggering unit for obtaining response measures corresponding to the event category, and triggering corresponding response measures in order of the response priority for each event category.

4. The cyber-security monitoring system of claim 3, wherein, The event response module further comprises: an event analysis unit for collecting attack trace data after the response measures are executed, and determining the cause of the event according to the attack trace data; an event closure unit for closing the current event response process after detecting that the software system has returned to normal, and updating the response measures according to the cause of the event.

5. The cyber-security monitoring system of claim 3, wherein, The response measures comprise at least one of: immediate disposal measures, including at least one of automatically isolating the software system, sending real-time alarm information and executing a preset security policy; restoration and repair measures, including performing restoration and / or security reinforcement operations on the software system.

6. The cyber-security monitoring system of claim 2, wherein, The system further comprises: a risk assessment module for quantitatively evaluating the security risks of the running environment of the software system based on the abnormal data, the attack behavior and the vulnerability data, and outputting a risk score and repair recommendations based on the quantitative evaluation results.

7. The cyber-security monitoring system of claim 1, wherein, The system further comprises: a security policy management module for managing security policies of the software system during operation; wherein the security policy is at least one security control rule for regulating resource access, identity verification, network protection and data protection of the software system during operation.

8. The cyber-security monitoring system of claim 7, wherein, The security policy management module comprises: an access control unit configured to configure access permissions and access scopes of users to system resources; an identity verification unit configured to configure an identity verification mechanism of the software system; a network protection unit configured to configure network protection measures of the software system; wherein the network protection measures comprise at least one of a firewall rule, an intrusion detection and prevention strategy, and a usage specification of a virtual private network; a data protection unit configured to perform data protection measures on data of the software system; wherein the data protection measures comprise at least one of data encryption, backup, data classification, and storage location control.

9. The cyber-security monitoring system of claim 1, wherein, The system further comprises: a log management module configured to record all operations of the software system during operation and perform lifecycle management and / or log analysis on log data generated by all operations.

10. The cyber-security monitoring system of claim 9, wherein, The log management module comprises: a log collection unit configured to record all operations of the software system during operation and obtain log data after performing unified formatting processing on the response operations; a log storage unit configured to store the log data in a classified manner according to time and / or type, and perform lifecycle management on the stored log data according to a preset log lifecycle policy; a log analysis unit configured to perform real-time analysis on the log data to identify abnormal events and trigger an alarm mechanism; a log query unit configured to provide a function of searching historical logs according to conditions and generate a periodic analysis report.

11. The cyber-security monitoring system of claim 1, wherein, The system further comprises: a monitoring module configured to obtain running state data of the software system and trigger an abnormal alarm when it is detected that the running state data meets a set condition.

12. The cyber-security monitoring system of claim 11, wherein, The monitoring module comprises: a real-time state acquisition unit configured to obtain running state data; wherein the running state data comprises a component health state of a key component of the software system, resource usage of system resources, and a performance indicator of the software system; an abnormal alarm unit configured to automatically trigger an alarm for running state data meeting a set condition; a data visualization and reporting unit configured to visually display the running state data and periodically generate a system performance report; a data integration unit configured to integrate log data and the running state data, and / or integrate historical state data and the running state data, and generate a data analysis report based on the integrated data.

13. A cyber-security monitoring method, comprising: comprises: collecting software running data; wherein the software running data comprises at least one of system running data, network interaction data, and business scenario data; performing feature recognition and analysis on the software running data to obtain data features, and matching the data features with a preset reference database to determine potential abnormal information; determining an event type and a response priority corresponding to the potential abnormal information, and triggering corresponding response measures in order of the response priority for different categories of events; wherein each event type corresponds to at least one response measure.

14. The network security policing method of claim 13, wherein, The performing feature recognition and analysis on the software running data to obtain data features, and matching the data features with a preset reference database to determine potential abnormal information, comprises: adopting a preset data processing algorithm to process the software running data to obtain data features; comparing the data features with normal behavior benchmark data in the reference database to identify abnormal data; comparing the abnormal data with attack data in the reference database to identify attack behaviors; performing vulnerability scanning on the software system to obtain vulnerability data; integrating the abnormal data, the attack behaviors, and the vulnerability data to obtain potential abnormal information.

15. The cyber-security monitoring method of claim 14, wherein, The method further comprises: quantitatively evaluating security risks of a running environment of the software system according to the abnormal data, the attack behaviors, and the vulnerability data, and outputting a risk score and repair suggestions based on a quantitative evaluation result.

16. The network security policing method of claim 13, wherein, The method further comprises: managing a security policy of the software system during running, wherein the security policy is at least one security control rule for regulating resource access, identity verification, network protection, and data protection of the software system during running; recording all response operations of the software system during running, and performing life cycle management and / or log analysis on log data generated by all operations; obtaining running state data of the software system, and triggering an abnormal alarm when it is detected that the running state data meets a set condition.

17. A network security policing device, comprising: The computer readable storage medium stores a computer program, wherein the computer program controls a device where the computer readable storage medium is located to perform the network security supervision method as claimed in any one of claims 13 to 16 when the computer program runs.

18. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, wherein the computer program controls a device where the computer readable storage medium is located to perform the network security supervision method as claimed in any one of claims 13 to 16 when the computer program runs.

19. A computer program product, characterised in that, The computer readable storage medium stores a computer program, wherein the computer program controls a device where the computer readable storage medium is located to perform the network security supervision method as claimed in any one of claims 13 to 16 when the computer program runs.

Images