Information security vulnerability processing system and processing method
By combining network monitoring and anomaly detection modules with artificial neural networks, the problem of information leakage caused by network vulnerabilities has been solved, enabling real-time monitoring and rapid location of attack sources, thereby improving network security defense capabilities.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- NANTONG UNIV
- Filing Date
- 2026-02-06
- Publication Date
- 2026-05-01
AI Technical Summary
Existing technologies have failed to effectively prevent information leakage and attacks when addressing network vulnerabilities, and patching methods cannot effectively protect computer information security until timely fixes are made.
It employs a network monitoring module, an intrusion detection module, an abnormal network information detection module, an early warning module, and an intrusion tracing module. By monitoring network data streams, it detects abnormal information and responds automatically, locates the attack source, sets violation alarm levels, uses artificial neural networks to classify abnormal information, and combines principal component analysis and reverse correction algorithms to improve detection accuracy.
It enables real-time monitoring and anomaly detection of network information, improves early warning efficiency, effectively prevents information capture, tampering and theft, quickly locates the source of attacks, and enhances network security defense capabilities.
Smart Images
Figure CN121967046A_ABST
Abstract
Description
A system and method for handling information security vulnerabilities Technical Field
[0001] This invention relates to the field of computer security technology, and more specifically, to a system and method for handling information security vulnerabilities. Background Technology
[0002] Network vulnerabilities are one way network information can be compromised. Different hardware and software devices are highly likely to contain different security vulnerabilities. Vulnerabilities mainly arise from negligence or errors by designers and implementers, as well as unfamiliarity with the network environment, causing conflicts between network functions and security parameters. This leads to losses in information integrity, confidentiality, and accessibility. Furthermore, vulnerabilities can also be intentionally created by malicious actors or automated malicious code. A single vulnerability in an entire system or network can significantly jeopardize an organization's security posture. Observing the principles and steps of network vulnerability attacks, we know that the best way to reduce or prevent network vulnerability attacks is to avoid scanning and protecting host ports, discover vulnerabilities before attackers, and take effective measures to improve network security.
[0003] Network vulnerabilities are various defects in the entire operating and application system. If they are exploited by hackers, they can lead to the leakage or loss of computer information, which has a significant impact on the interests of the legitimate users of the data. At present, when people solve system vulnerabilities, they often choose to patch them. However, before they are patched in time, computer information will still be under great threat. Summary of the Invention
[0004] In order to overcome the above-mentioned defects of the prior art, embodiments of the present invention provide an information security vulnerability processing system and method, which solves the problems mentioned in the background art through an abnormal network detection module.
[0005] To achieve the above objectives, the present invention provides the following technical solution: comprising a network monitoring module, an intrusion detection module, an abnormal network information detection module, an early warning module, and an intrusion tracking module. The network monitoring module listens to various information data in the network, analyzes higher-level protocols, and collects illegal intrusion behavior through log recording. The intrusion detection module determines the legitimacy of access to the protected network by detecting network data streams and performs keyword matching on the captured data streams. The abnormal network information detection module receives the data streams transmitted by the intrusion detection module and detects abnormal information. The early warning module automatically responds to detected network vulnerabilities and sets violation alarm levels. The intrusion tracking module uses information tracking to determine the traces of attackers and locate the attack source.
[0006] In a preferred embodiment, the network monitoring module listens to various information in the network, controls the data traffic entering and leaving the network, and implements basic access control. It can achieve IP address-based access control, analyze commonly used high-level protocols, know the basic usage of the network through port-based traffic statistics, and collect illegal user behavior within the network through log analysis.
[0007] In a preferred embodiment, the intrusion detection module determines the legitimacy of access to the protected network by detecting network data flow. For legitimate access, it is not blocked, and the requirements of legitimate access for the continuity of system functions, transmission speed, and information integrity will not be significantly interfered with or reduced by the intervention of the warning. For illegal intrusion access, the intrusion detection module will analyze the incoming data in stages, detect the data flow, and transmit the captured data to the abnormal network detection module for abnormal data detection. Feature codes are extracted from the relevant data of known intrusion behavior as keywords. During the detection process, the keywords are matched with the captured data. If the match is successful, it is identified as an intrusion. The keyword mainly consists of two parts: rule header and rule options. The rule header includes the rule behavior, protocol, source address, destination address, subnet mask, source and destination port information. The rule options include alarm information and data packet area location information that needs to be checked to determine whether to issue a rule response action.
[0008] In a preferred embodiment, the abnormal network information detection module can effectively prevent network information from being captured, tampered with, and stolen. It takes network information sets X and Y as inputs, where X represents the test set and Y represents the training set, and outputs the categories of network information L. These categories include normal information and abnormal information. It should be noted that L... The abnormal network information detection specifically includes the following steps:
[0009] S1. Principal component analysis is used to reduce the dimensionality of the test set X. The dimensionality-reduced test set is denoted as... ;
[0010] S2. Input the training set Y into the artificial neural network, train the training set, and obtain the optimal artificial neural network parameters.
[0011] S3, the test set after dimensionality reduction. The input is fed into the trained artificial neural network, and the input result is the category determination result of the network information L;
[0012] S4. Load the training set and use it as input data for the artificial neural network classifier, denoted as Y=[ The weighted sum product of neurons is calculated using the following formula:
[0013]
[0014] In the formula, This represents the weight value between any two neurons. This represents the information of the i-th test network.
[0015] S5. Map the hidden layers of the artificial neural network, denoted as Z=F( ), where F() represents the mapping function, Indicates the mapping control parameter;
[0016] S6. Calculate the error between the output result and the expected result, denoted as Q. The ideal range of the given error is []. ], when Q is in [ Within the range, training is stopped; Q is not within [[ Within the range, the weights are reversed;
[0017] S7. The formula for calculating reverse correction is:
[0018]
[0019] In the formula, Indicates the adjustment of weights, Describe the output information and input information respectively;
[0020] S8. Perform reverse correction on the artificial neural network based on the corrected weights obtained in step S7 until the error Q meets the given range. ]until.
[0021] In a preferred embodiment, the early warning module automatically identifies and responds to network vulnerabilities in real time. By monitoring network data streams in real time, it identifies and records intrusions and destructive access operations. It detects network violations and unauthorized network access attempts through the abnormal network information detection module, provides security warnings for network violation patterns and unauthorized networks, sets alarm levels for violation patterns, classifies threat events, determines the source of threats, and statistically analyzes threats. Through the early warning module, the security status of the entire network can be comprehensively grasped, improving the ability to proactively detect security events.
[0022] In a preferred embodiment, the intrusion tracking module uses information tracking to determine the traces of the attacker and locate the source of the attack. When the network changes, the information in the device management information database is automatically updated, enabling rapid retrieval of information from the database. It uses network management protocols to collect network management information from devices on the network and uses these protocols to query the address tables in the switch buffers level by level to find the source port of the switch that first forwarded the data, thus obtaining the specific location of the intruding host. After obtaining the set of switches, it pings all switches and sequentially reads the MAC address table of each switch port. If a switch's downlink port is cascaded with other switches, the search continues downwards until no other switch devices are cascaded. This indicates that the port of this switch is directly connected to the intruding host, thus pinpointing the specific location of the intruding host.
[0023] In a preferred embodiment, the specific steps include:
[0024] 101. Monitor various information and data in the network, analyze high-level protocols, and collect illegal intrusion behavior through log records;
[0025] 102. Determine the legitimacy of access to the protected network by detecting network data streams, and perform keyword matching on the captured data streams;
[0026] 103. Upon receiving the data stream transmitted by the intrusion detection module, detect any abnormal information.
[0027] 104. Automatically respond to detected network vulnerabilities and establish violation alert levels;
[0028] 105. Use information tracking to determine the traces of attackers and locate the source of the attack.
[0029] The technical effects and advantages of this invention are as follows:
[0030] 1. This invention monitors various data in the network and centralizes the data captured by the monitoring points into the abnormal network information detection module for processing. This greatly improves the early warning efficiency, enables the assessment of various network risks, and allows for the continuous updating and expansion of the keyword database, thereby continuously enhancing the system's defense capabilities.
[0031] 2. This invention detects abnormal information by receiving the data stream transmitted by the intrusion detection module through the abnormal network information detection module, the early warning module automatically responds to the detected network vulnerabilities and sets the violation alarm level, and the intrusion tracking module uses information tracking to determine the traces of attackers and locate the location of the attack source.
[0032] 3. This invention can effectively prevent network information from being captured, tampered with, and stolen through the abnormal network information detection module. The input network information sets X and Y, where X represents the test set and Y represents the training set, and the output is the category of network information L, which includes normal information and abnormal information. Attached Figure Description
[0033] Figure 1 is a flowchart of an information security vulnerability processing system and processing method.
[0034] Figure 2 is a structural block diagram of an information security vulnerability processing system and processing method. Detailed Implementation
[0035] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0036] Example 1
[0037] This embodiment provides a method for handling information security vulnerabilities, as shown in Figure 1, which specifically includes the following steps:
[0038] 101. Monitor various information and data in the network, analyze high-level protocols, and collect illegal intrusion behavior through log records;
[0039] 102. Determine the legitimacy of access to the protected network by detecting network data streams, and perform keyword matching on the captured data streams;
[0040] 103. Upon receiving the data stream transmitted by the intrusion detection module, detect any abnormal information.
[0041] 104. Automatically respond to detected network vulnerabilities and establish violation alert levels;
[0042] 105. Use information tracking to determine the traces of attackers and locate the source of the attack.
[0043] As shown in Figure 2, this embodiment provides an information security vulnerability processing system, including a network monitoring module, an intrusion detection module, an abnormal network information detection module, an early warning module, and an intrusion tracking module. The network monitoring module listens to various information data in the network, analyzes high-level protocols, and collects illegal intrusion behaviors through log recording. The intrusion detection module determines the legitimacy of access to the protected network by detecting network data streams and performs keyword matching on the captured data streams. The abnormal network information detection module receives the data streams transmitted by the intrusion detection module and detects abnormal information. The early warning module automatically responds to detected network vulnerabilities and sets violation alarm levels. The intrusion tracking module uses information tracking to determine the traces of attackers and locate the attack source.
[0044] 101. Monitor various information and data in the network, analyze high-level protocols, and collect illegal intrusion behavior through log records;
[0045] In this embodiment, the network monitoring module is specifically described. The network monitoring module listens to various information in the network, controls the data traffic entering and leaving the network, and implements basic access control. It can realize access control based on IP address, analyze commonly used high-level protocols, know the basic usage of the network through port-based traffic statistics, and collect illegal user behavior within the network through log analysis.
[0046] 102. Determine the legitimacy of access to the protected network by detecting network data streams, and perform keyword matching on the captured data streams;
[0047] In this embodiment, the intrusion detection module is specifically described. This module determines the legitimacy of access to the protected network by detecting network data flow. For legitimate access, it does not block it, and the continuity of system functions, transmission speed, and information integrity requirements of legitimate access are not significantly interfered with or reduced by the alert. For illegal intrusion access, the intrusion detection module analyzes the incoming data in stages, detects the data flow, and transmits the captured data to the abnormal network detection module for anomaly detection. It extracts feature codes as keywords from relevant data of known intrusion behaviors. During the detection process, the keywords are matched with the captured data. If a match is successful, an intrusion is identified. The keywords mainly consist of a rule header and rule options. The rule header includes the rule's behavior, protocol, source address, destination address, subnet mask, and source and destination port information. The rule options include alarm information and data packet area location information that needs to be checked to determine whether to issue a rule response action.
[0048] 103. Upon receiving the data stream transmitted by the intrusion detection module, detect any abnormal information.
[0049] In this embodiment, the abnormal network information detection module needs to be specifically described. This module effectively prevents network information from being captured, tampered with, or stolen. It takes two sets of network information, X and Y, as inputs, where X represents the test set and Y represents the training set. The output is the category of network information L, which includes normal information and abnormal information. It is important to note that L... The abnormal network information detection specifically includes the following steps:
[0050] S1. Principal component analysis is used to reduce the dimensionality of the test set X. The dimensionality-reduced test set is denoted as... ;
[0051] S2. Input the training set Y into the artificial neural network, train the training set, and obtain the optimal artificial neural network parameters.
[0052] S3, the test set after dimensionality reduction. The input is fed into the trained artificial neural network, and the input result is the category determination result of the network information L;
[0053] S4. Load the training set and use it as input data for the artificial neural network classifier, denoted as Y=[ The weighted sum product of neurons is calculated using the following formula:
[0054]
[0055] In the formula, This represents the weight value between any two neurons. This represents the information of the i-th test network.
[0056] S5. Map the hidden layers of the artificial neural network, denoted as Z=F( ), where F() represents the mapping function, Indicates the mapping control parameter;
[0057] S6. Calculate the error between the output result and the expected result, denoted as Q. The ideal range of the given error is []. ], when Q is in [ Within the range, training is stopped; Q is not within [[ Within the range, the weights are reversed;
[0058] S7. The formula for calculating reverse correction is:
[0059]
[0060] In the formula, Indicates the adjustment of weights, Describe the output information and input information respectively;
[0061] S8. Perform reverse correction on the artificial neural network based on the corrected weights obtained in step S7 until the error Q meets the given range. ]until.
[0062] 104. Automatically respond to detected network vulnerabilities and establish violation alert levels;
[0063] In this embodiment, the early warning module is specifically described. This module automatically identifies and responds to network vulnerabilities in real time. By monitoring network data streams in real time, it identifies and records intrusions and destructive access operations. It detects network violations and unauthorized network access attempts through the abnormal network information detection module, provides security warnings for network violation patterns and unauthorized networks, sets alarm levels for violation patterns, classifies threat events, determines the source of threats, and performs threat statistics. Through the early warning module, the security status of the entire network can be comprehensively grasped, improving the ability to proactively detect security events.
[0064] 105. Employ information tracking to determine the traces of attackers and locate the source of the attack;
[0065] In this embodiment, the intrusion tracking module is specifically described. This module uses information tracking to determine the traces of the attacker and locate the source of the attack. When network changes, the information in the device management information database is automatically updated, allowing for rapid information retrieval from the database. It uses network management protocols to collect network management information from devices on the network and uses these protocols to query the address tables in the switch buffers level by level to find the source port of the switch that first forwarded the data, thus obtaining the specific location of the intruding host. After obtaining the set of switches, it pings all switches and sequentially reads the MAC address table of each switch port. If a switch's downlink port is cascaded with other switches, the search continues downwards until no other switch devices are cascaded. This confirms that the port of this switch is directly connected to the intruding host, thus pinpointing the specific location of the intruding host.
[0066] The formula in this invention is a numerical calculation that removes dimensions. It is obtained by software simulation through the collection of a large amount of data to obtain a formula that is closest to the real situation. The preset proportional coefficients in the formula are set by those skilled in the art according to the actual situation or obtained through simulation of a large amount of data.
[0067] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, as a computer program product. A computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, all or part of the processes or functions according to the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. Computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via a wired connection. A computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more sets of available media. The available medium can be a magnetic medium, an optical medium, or a semiconductor medium. A semiconductor medium can be a solid-state drive.
[0068] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.
[0069] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.
[0070] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.
[0071] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.
[0072] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.
[0073] In conclusion, the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.
Claims
1. A system for handling information security vulnerabilities, characterized in that: It includes a network monitoring module, an intrusion detection module, an abnormal network information detection module, an early warning module, and an intrusion tracing module. The network monitoring module listens to various information data in the network, analyzes high-level protocols, and collects illegal intrusion behavior through log recording. The intrusion detection module determines the legitimacy of access to the protected network by detecting network data streams and performs keyword matching on the captured data streams. The abnormal network information detection module receives the data streams transmitted by the intrusion detection module and detects abnormal information. The early warning module automatically responds to detected network vulnerabilities and sets violation alarm levels. The intrusion tracing module uses information tracking to determine the traces of attackers and locate the attack source.
2. The information security vulnerability processing system according to claim 1, characterized in that: The network monitoring module listens to various information in the network, controls the data traffic entering and leaving the network, and can know the basic usage of the network through port-based traffic statistics. By analyzing log records, it can collect illegal user behavior within the network.
3. The information security vulnerability processing system according to claim 1, characterized in that: The intrusion detection module determines the legitimacy of access to the protected network by detecting network data flow. For legitimate access, it does not block it. For illegitimate intrusion access, the intrusion detection module analyzes the incoming data in stages, detects the data flow, and transmits the captured data to the abnormal network detection module for anomaly detection. It extracts feature codes as keywords from the relevant data of known intrusion behaviors. During the detection process, the keywords are matched with the captured data. If the match is successful, it is determined that an intrusion has occurred. The keyword mainly consists of two parts: rule header and rule options.
4. The information security vulnerability processing system according to claim 1, characterized in that: The abnormal network information detection module can effectively prevent network information from being captured, tampered with, and stolen. It takes two sets of network information, X and Y, as input, where X represents the test set and Y represents the training set. The output is the category of network information L, which includes normal information and abnormal information. It is important to note that L... The abnormal network information detection specifically includes the following steps: S1, using principal component analysis to reduce the dimensionality of the test set X, and denoting the dimensionality-reduced test set as... S2. Input the training set Y into the artificial neural network, train the training set, and obtain the optimal artificial neural network parameters; S3. Input the dimensionality-reduced test set... The input is fed into the trained artificial neural network, and the input result is the category determination result of the network information L.
5. The information security vulnerability processing system according to claim 4, characterized in that: The loaded training set is used as input data for the artificial neural network classifier, denoted as Y=[ The weighted sum product of neurons is calculated using the following formula: In the formula, This represents the weight value between any two neurons. This represents the information of the i-th test network, which is used to map the hidden layers of the artificial neural network, denoted as Z=F( ), where F(.) represents the mapping function, This represents the mapping control parameter.
6. The information security vulnerability processing system according to claim 5, characterized in that: The error between the calculated output and the expected result is denoted as Q, and the ideal range of the given error is []. ], when Q is in [ Within the range, training is stopped; Q is not within [[ Within the specified range, the weights are reverse-corrected, and the calculation formula for the reverse correction is as follows: In the formula, Indicates the adjustment of weights, Describe the output information and input information respectively.
7. The information security vulnerability processing system according to claim 6, characterized in that: The obtained modified weights are used to reverse-correct the artificial neural network until the error Q meets the given range. ]until.
8. The information security vulnerability processing system according to claim 1, characterized in that: The early warning module automatically identifies and responds to network vulnerabilities in real time. By monitoring network data streams in real time, it identifies and records intrusions and destructive access operations. It detects network violations and unauthorized network access attempts through the abnormal network information detection module, provides security warnings for network violation patterns and unauthorized networks, sets alarm levels for violation patterns, classifies threat events, and determines the source of threats.
9. The information security vulnerability processing system according to claim 1, characterized in that: The intrusion tracking module uses information tracking to determine the traces of attackers and locate the source of the attack. When the network changes, the information in the device management information database is automatically updated, enabling rapid retrieval of information from the database. It collects network management information from devices on the network using network management protocols, and uses network management protocols to query the address tables in the switch buffers level by level to find the source port of the switch that first forwarded the data, thus obtaining the specific location of the intruding host. After obtaining the set of switches, it pings all switches and reads the MAC address table of each switch port in turn. If a switch's downlink port is found to be cascaded with other switches, the search continues down until no other switch devices are cascaded, at which point it can be determined that the port of this switch is directly connected to the intruding host.
10. A method for handling information security vulnerabilities, applied to an information security vulnerability handling system as described in any one of claims 1-9, characterized in that: Specifically, the process includes the following steps: 101: Monitoring various information data in the network, analyzing high-level protocols, and collecting illegal intrusion behavior through log recording; 102: Determining the legitimacy of access to the protected network by detecting network data streams, and matching keywords in the captured data streams; 103: Detecting abnormal information in the data streams received from the intrusion detection module; 104: Automatically responding to detected network vulnerabilities and setting violation alarm levels; 105: Using information tracing to determine the traces of attackers and locate the attack source.