An internet security monitoring and early warning platform

Abstract

The application relates to the technical field of time series frequency domain decomposition, and discloses an internet security monitoring and early warning platform which adopts a B / S architecture and is composed of a data acquisition layer, a core analysis layer and a response display layer, comprises an asset detection and account book construction module, an asset fingerprint identification module, a multidimensional security detection module, a risk correlation research and judgment module, a linkage disposal closed loop verification module, and is sequentially connected with each module; the application integrates security elements such as asset management, baseline verification, vulnerability detection, website monitoring and virus defense into a unified system, eliminates the data islands of multiple tools in parallel, reduces the complexity of security operation and maintenance, the platform sets special detection logic for the domain name server, fills the blank of the general security platform in the domain name system security protection, simultaneously adopts an asset identification mode of multidimensional feature fusion, can adapt to a dynamic asset environment and a non-standard port scene, and guarantees the coverage range and identification precision of security monitoring.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to an internet security monitoring and early warning platform. Background Technology

[0002] With the rapid development of internet businesses, the scale of corporate websites serving the public continues to expand, and the domain name system server, as a core infrastructure, has gradually become a key target of cyberattacks.

[0003] At the same time, cybersecurity regulatory requirements are becoming increasingly stringent, and the procedures for reporting, handling, and compliance feedback are becoming increasingly detailed.

[0004] Currently, when enterprises carry out website and domain name server security protection, they often rely on multiple independent security tools to conduct decentralized testing, which makes it difficult to form a complete protection loop and cannot adapt to the dynamically changing network environment and the need for efficient compliance response. Summary of the Invention

[0005] The purpose of this invention is to provide an Internet security monitoring and early warning platform to solve the problems mentioned in the background art.

[0006] To achieve the above objectives, the present invention adopts the following technical solution:

[0007] An internet security monitoring and early warning platform adopts a B / S architecture and consists of a data acquisition layer, a core analysis layer, and a response display layer. It includes an asset detection and ledger construction module, an asset fingerprint recognition module, a multi-dimensional security detection module, a risk correlation analysis module, and a linkage and closed-loop verification module. The data of each module is connected sequentially.

[0008] As a further improvement to this technical solution: the asset detection and ledger construction module includes an active detection engine, a DNS resolution record capture unit, a reverse query unit, and a live host scanning unit. The active detection engine coordinates and schedules various detection tasks, and uniformly manages the detection cycle and target range. The DNS resolution record capture unit extracts the resolution data corresponding to the target domain name. The reverse query unit performs a reverse query on the associated domain name and subdomain information based on the known IP address. The live host scanning unit identifies live hosts and open ports in the public network environment.

[0009] As a further improvement to this technical solution: the asset fingerprint recognition module includes an HTTP response header analysis unit, an HTMLMeta tag parsing unit, a TCP stack fingerprint recognition unit, a service banner extraction unit, and an asset fingerprint database. This module employs a multi-dimensional feature fusion recognition method and determines the recognition result through a fingerprint confidence calculation model. The calculation formula is as follows:

[0010]

[0011] .

[0012] As a further improvement to this technical solution: the multi-dimensional security detection module includes a baseline inspection unit, a vulnerability scanning unit, a website risk monitoring unit, and a virus defense unit. The baseline inspection unit has a built-in inspection script library that complies with the Information Security Protection Standard 2.0 and the CIS standard. The vulnerability scanning unit uses a distributed engine to perform weak password detection and high-risk port comparison, and completes vulnerability detection based on the POC plugin framework. The website risk monitoring unit performs website availability, page tampering, malware injection, and sensitive content monitoring. The virus defense unit integrates a lightweight sandbox and a multi-engine virus scanning interface to complete suspicious file removal and backdoor detection.

[0013] As a further improvement to this technical solution: the baseline checking unit includes a system baseline checking subunit, a DNS-specific baseline checking subunit, and a middleware baseline checking subunit. The system baseline checking subunit checks the operating system for account permissions, password policies, and log auditing configurations. The middleware baseline checking subunit checks the Web middleware for default paths, error page leaks, and session configurations. The DNS-specific baseline checking subunit checks the domain name service component for zone transmission restrictions, recursive query switches, DNSSEC activation status, and cache poisoning risk configurations in the configuration file. The detection results are synchronized to the risk association analysis module.

[0014] As a further improvement to this technical solution: the risk association assessment module includes a risk association engine, a configuration-based risk marking unit, and a risk level dynamic adjustment unit. The configuration-based risk marking unit marks baseline configuration items that do not meet security standards as configuration-based risks. The risk level dynamic adjustment unit uses a risk weight attenuation model to correct the vulnerability risk level, and the calculation formula is as follows:

[0015]

[0016] in This is the revised final risk level; The initial risk level determined by the vulnerability scan; Configure the impact factor for the baseline; This serves as the activation status identifier for the corresponding service; the risk association engine coordinates the association matching and hierarchical output of all risk data.

[0017] As a further improvement to this technical solution: the linked handling closed-loop verification module includes a repair suggestion generation unit, a security device linkage unit, and a re-inspection task triggering unit. The repair suggestion generation unit generates repair guidelines by combining asset fingerprint information and baseline configuration status. The security device linkage unit connects to firewalls and Web application firewalls to perform high-risk blocking operations. After the handling operation is completed, the re-inspection task triggering unit initiates secondary verification of the corresponding detection items.

[0018] Compared with the prior art, the beneficial effects of the present invention are:

[0019] 1. This invention integrates security elements such as asset management, baseline verification, vulnerability detection, website monitoring, and virus defense into a unified system, eliminating data silos caused by multiple parallel tools and reducing the complexity of security operations and maintenance. The platform sets up special detection logic for domain name servers, filling the gap in domain name system security protection of general security platforms. At the same time, it adopts a multi-dimensional feature fusion asset identification method, which can adapt to dynamic asset environments and non-standard port scenarios, ensuring the coverage and identification accuracy of security monitoring. Through the linkage analysis of asset fingerprints, baseline configuration, and vulnerability scanning, the platform can judge the exploitability of risks in combination with the actual operating status, effectively reducing invalid alarms and improving the accuracy of risk judgment.

[0020] 2. This invention achieves a fully automated closed loop from risk monitoring and discovery to coordinated handling and verification, improving the efficiency of emergency response to security incidents. The platform has embedded a handling process for regulatory and operational notifications, which can complete the fully automated processing of notifications from receipt to reply and archiving, greatly improving the response efficiency of regulatory compliance and reducing the error rate of manual operation. The platform and the operation and maintenance system achieve deep data integration, promoting the automatic flow and two-way synchronization of security incidents and operation and maintenance tasks, breaking down the barriers between security and operation and maintenance systems, and further improving the synergy and operability of the overall protection system.

[0021] The above description is merely an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention and to implement it in accordance with the contents of the specification, the preferred embodiments of the present invention are described in detail below with reference to the accompanying drawings. Specific implementation methods are given in detail in the following embodiments and their accompanying drawings. Attached Figure Description

[0022] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, illustrate exemplary embodiments of the invention and, together with their description, serve to explain the invention and do not constitute an undue limitation thereof. In the drawings:

[0023] Figure 1 This is a schematic diagram of the structure of the present invention. Detailed Implementation

[0024] The principles and features of the present invention are described below with reference to the accompanying drawings. The examples given are for illustrative purposes only and are not intended to limit the scope of the invention. The invention is described more specifically in the following paragraphs by way of example with reference to the accompanying drawings. It should be noted that the drawings are in a very simplified form and use non-precise proportions, and are only used to facilitate and clarify the illustration of the embodiments of the present invention.

[0025] Please see Figure 1 In this embodiment of the invention, an Internet security monitoring and early warning platform adopts a B / S architecture and consists of a data acquisition layer, a core analysis layer, and a response display layer. It includes an asset detection and ledger construction module, an asset fingerprint recognition module, a multi-dimensional security detection module, a risk correlation analysis module, and a linkage disposal closed-loop verification module. Each module is connected to the data in sequence.

[0026] Specifically, the B / S architecture, or browser and server architecture, allows users to access platform functions through a browser without installing a dedicated client. The data acquisition layer is responsible for collecting and acquiring raw data related to various assets, configurations, and vulnerabilities. The core analysis layer is responsible for data processing, risk calculation, and logical judgment. The response and display layer is responsible for result display, operation interaction, and disposal execution. The five core functional modules of the platform are asset detection and ledger construction, asset fingerprint recognition, multi-dimensional security detection, risk correlation judgment, and linkage disposal closed-loop verification. These modules are connected sequentially according to the data flow, forming a complete link from data acquisition to disposal closed loop.

[0027] The asset detection and ledger construction module includes an active detection engine, a DNS resolution record capture unit, a reverse query unit, and a live host scanning unit. The active detection engine coordinates and schedules various detection tasks, and uniformly manages the detection cycle and target scope. The DNS resolution record capture unit extracts the resolution data corresponding to the target domain name. The reverse query unit performs reverse lookup of related domain names and subdomain information based on known IP addresses. The live host scanning unit identifies live hosts and open ports in the public network environment.

[0028] Specifically, the active detection engine is the scheduling core of this module, responsible for uniformly initiating various detection tasks, controlling the detection time period and target asset scope, and avoiding duplicate detection and detection omissions; the DNS resolution record capture unit extracts the A record, NS record and other resolution data corresponding to the target domain name by sending query requests to the domain name server, and sorts out the correspondence between the domain name and IP; the reverse query unit starts from a known IP address and reversely retrieves all domain names and subdomains bound to that IP, expanding the coverage of asset discovery; the live host scanning unit uses ICMP and TCPSYN scanning technology to detect the liveness status of public network addresses, and at the same time identify the open port information of the host, providing the target scope for subsequent detection.

[0029] The asset fingerprinting module includes an HTTP response header analysis unit, an HTML Meta tag parsing unit, a TCP stack fingerprinting unit, a service banner extraction unit, and an asset fingerprint database. The module employs a multi-dimensional feature fusion identification method and determines the identification result through a fingerprint confidence calculation model. The calculation formula is as follows:

[0030]

[0031] ; The weight coefficients are for four types of features: HTTP response headers, Meta tags, TCP stack fingerprints, and service banners. When the confidence level exceeds the set threshold, the recognition result is entered into the asset fingerprint database.

[0032] Specifically, the HTTP response header analysis unit sends a request to the target web service, extracts the returned HTTP response header fields, and determines the service type and version information accordingly; the HTMLMeta tag parsing unit obtains the Meta tag content in the webpage source code to help identify the site's development framework and website building system; the TCP stack fingerprint recognition unit analyzes the protocol stack characteristics of SYN and ACK packets to determine the target host's operating system type and version; the service banner extraction unit captures the service identification information returned by the port to identify the real service type running under non-standard ports; and the asset fingerprint database stores the fingerprint information of all identified assets, supporting historical version tracing and dynamic updates.

[0033] The fingerprint confidence calculation model is used to integrate the recognition results of four types of features and output the final recognition confidence level; in the formula, C is the final fingerprint confidence level, and the higher the value, the more reliable the recognition result. to These are the weighting coefficients corresponding to the four types of features, reflecting the contribution ratio of different features in fingerprint determination; to The recognition matching degree of a single feature represents the degree of matching between a single-dimensional feature and a known fingerprint database. The comprehensive confidence score is obtained by weighted summation. When the value exceeds a preset threshold, the recognition result is deemed valid and entered into the asset fingerprint database, thereby improving the recognition accuracy of non-standard ports and dynamic assets.

[0034] The multi-dimensional security detection module includes a baseline inspection unit, a vulnerability scanning unit, a website risk monitoring unit, and a virus defense unit. The baseline inspection unit has a built-in inspection script library that complies with the Information Security Protection Standard 2.0 and the CIS standard. The vulnerability scanning unit uses a distributed engine to perform weak password detection and high-risk port comparison, and completes vulnerability detection based on the POC plugin framework. The website risk monitoring unit performs website availability, page tampering, malware injection, and sensitive content monitoring. The virus defense unit integrates a lightweight sandbox and a multi-engine virus scanning interface to complete suspicious file removal and backdoor detection.

[0035] Specifically, the baseline inspection unit has a built-in inspection script library that complies with the Cybersecurity Classified Protection 2.0 and CIS benchmarks, used to verify the configuration compliance of systems and services; the vulnerability scanning unit uses a distributed deployment detection engine to perform weak password detection on various service ports, and compares open ports with a high-risk port database, and completes the detection of web application vulnerabilities and system CVE vulnerabilities based on a POC proof-of-concept plugin framework; the website risk monitoring unit continuously monitors the operational availability, page content integrity, malicious link penetration, and sensitive page content of publicly released websites; the virus defense unit integrates a lightweight sandbox environment and a multi-engine virus scanning interface, analyzes the execution behavior of suspicious files in an isolated environment, and completes the detection and removal of malicious programs in combination with a virus signature database, while also specifically detecting website backdoor programs.

[0036] The baseline inspection unit includes a system baseline inspection subunit, a DNS-specific baseline inspection subunit, and a middleware baseline inspection subunit. The system baseline inspection subunit performs checks on the operating system for account permissions, password policies, and log auditing configurations. The middleware baseline inspection subunit performs checks on the Web middleware for default paths, error page leaks, and session configurations. The DNS-specific baseline inspection subunit checks the domain name service component for zone transfer restrictions, recursive query switches, DNSSEC activation status, and cache poisoning risk configurations in the configuration file. The detection results are synchronized to the risk association analysis module.

[0037] Specifically, the system baseline check subunit targets operating systems such as Linux and Windows, verifying compliance items such as account permission allocation, password complexity policies, and log audit function configuration; the middleware baseline check subunit targets web middleware such as Nginx, Apache, and Tomcat, verifying items such as default management paths, error page information leakage, and session security configuration; the DNS-specific baseline check subunit targets domain name service components such as BIND and PowerDNS, reading service configuration files to verify zone transfer access restrictions, recursive query function switches, DNSSEC security extension enabled status, and cache poisoning-related risk configurations, specifically covering security risks unique to domain name servers; after the tests are completed, all results are synchronously transmitted to the risk correlation analysis module for subsequent comprehensive risk assessment.

[0038] The risk correlation assessment module includes a risk correlation engine, a configuration-based risk marking unit, and a risk level dynamic adjustment unit. The configuration-based risk marking unit marks baseline configuration items that do not meet security standards as configuration-based risks. The risk level dynamic adjustment unit uses a risk weight decay model to correct the vulnerability risk level. The calculation formula is as follows:

[0039]

[0040] in This is the revised final risk level; The initial risk level determined by the vulnerability scan; Configure the impact factor for the baseline; This serves as an activation status indicator for the corresponding service; the risk association engine coordinates the association matching and hierarchical output of all risk data.

[0041] Specifically, the risk association engine is the core scheduling unit of the module, responsible for coordinating the association and matching of three types of data: assets, baselines, and vulnerabilities, and completing the classification and unified output of risks; the configuration risk marking unit marks non-compliant configuration items found in the baseline check separately and classifies them as configuration risks, distinguishing them from traditional vulnerability risks; the risk level dynamic adjustment unit corrects the initial risk level obtained from vulnerability scanning based on the baseline configuration status.

[0042] The risk weight decay model is used to adjust the risk level based on the service's operational status, avoiding invalid alarms; in the formula... This is the revised final risk level. The initial risk level output by the vulnerability scan. The baseline configuration has an impact factor on vulnerability risk, reflecting the degree to which the configuration status affects the exploitability of vulnerabilities. This serves as the enable / disable status indicator for the corresponding service. The value is 1 when the service associated with the vulnerability is disabled and 0 when the service is enabled. When the service corresponding to the target vulnerability has been disabled through the baseline configuration, the model will proportionally lower the risk level to reduce the number of false positives.

[0043] The collaborative handling closed-loop verification module includes a repair suggestion generation unit, a security device linkage unit, and a re-inspection task triggering unit. The repair suggestion generation unit generates repair guidelines by combining asset fingerprint information and baseline configuration status. The security device linkage unit connects to firewalls and web application firewalls to perform high-risk blocking operations. After the handling operation is completed, the re-inspection task triggering unit initiates secondary verification of the corresponding detection items.

[0044] Specifically, the remediation suggestion generation unit generates targeted risk remediation operation guidelines by combining the specific version information and current configuration status of the asset; the security device linkage unit connects to the firewall and Web application firewall through standard interfaces to perform operations such as blocking the attack source IP and adjusting access policies for confirmed high-risk risks; after the handling operation is completed, the re-inspection task triggering unit automatically initiates a secondary scan and verification of the corresponding detection items to confirm that the risk has been eliminated, completing the complete closed loop of monitoring and handling.

[0045] The method of use and working principle of this invention are as follows:

[0046] Usage: Administrators access the platform through a browser, enter the target unit's basic information and the scope of the monitoring domain, and initiate routine security monitoring tasks. The platform automatically completes asset discovery, liveness identification, and fingerprint information collection. It simultaneously schedules multiple detection tasks, including baseline checks, vulnerability scanning, website security monitoring, and virus defense, to be executed in parallel. After risk correlation analysis, the detection data generates a graded risk list. Operation and maintenance personnel can carry out risk disposal based on the remediation guidelines generated by the platform. After disposal, the platform automatically triggers a re-inspection task to verify the disposal effect, forming a closed loop of monitoring and disposal. The platform also automatically connects to regulatory and operational notifications, generates disposal work orders after parsing and associating with internal assets, and automatically generates compliance response letters and synchronizes them to the corresponding systems after disposal, realizing full-process management of notification and disposal.

[0047] Working principle: The platform operates using a B / S three-tier architecture. It discovers assets across the entire domain through an active detection engine combined with domain name resolution query and port scanning technology. It achieves accurate asset fingerprint identification based on a confidence calculation model that integrates multi-dimensional network and application layer features. It conducts multi-dimensional security detection in parallel using built-in standardized inspection scripts and plug-in detection framework. It connects the three types of data links—assets, baselines, and vulnerabilities—through a risk correlation engine. It corrects the vulnerability risk level using a risk weight attenuation model combined with configuration status. Finally, it links with protection devices to perform risk disposal. At the same time, it connects with the supervision and operation and maintenance system through standardized interfaces. It achieves a fully automated closed loop of notification and disposal through natural language processing and template filling mechanisms.

[0048] The above are merely preferred embodiments of the present invention and are not intended to limit the present invention in any way. Those skilled in the art can readily implement the present invention based on the description and drawings above. However, any modifications, alterations, and variations made by those skilled in the art without departing from the scope of the present invention using the disclosed technical content are equivalent embodiments of the present invention. Furthermore, any modifications, alterations, and variations made to the above embodiments based on the essential technology of the present invention are still within the protection scope of the present invention.

Claims

1. An internet security monitoring and early warning platform, adopting a B / S architecture, consisting of a data acquisition layer, a core analysis layer, and a response display layer, characterized in that, It includes an asset detection and ledger construction module, an asset fingerprint recognition module, a multi-dimensional security detection module, a risk correlation analysis module, and a closed-loop verification module for coordinated disposal. The data of each module is connected sequentially.

2. The Internet security monitoring and early warning platform according to claim 1, characterized in that, The asset detection and ledger construction module includes an active detection engine, a DNS resolution record capture unit, a reverse query unit, and a live host scanning unit. The active detection engine coordinates and schedules various detection tasks, and uniformly manages the detection cycle and target scope. The DNS resolution record capture unit extracts the resolution data corresponding to the target domain name. The reverse query unit performs reverse lookup of related domain names and subdomain information based on known IP addresses. The live host scanning unit identifies live hosts and open ports in the public network environment.

3. The Internet security monitoring and early warning platform according to claim 1, characterized in that, The asset fingerprinting module includes an HTTP response header analysis unit, an HTMLMeta tag parsing unit, a TCP stack fingerprinting unit, a service banner extraction unit, and an asset fingerprint database. The module employs a multi-dimensional feature fusion identification method and determines the identification result through a fingerprint confidence calculation model. The calculation formula is as follows: ； ； ； 。 4. The Internet security monitoring and early warning platform according to claim 1, characterized in that, The multi-dimensional security detection module includes a baseline inspection unit, a vulnerability scanning unit, a website risk monitoring unit, and a virus defense unit. The baseline inspection unit has a built-in inspection script library that complies with the Cybersecurity Classified Protection 2.0 and CIS standards. The vulnerability scanning unit uses a distributed engine to perform weak password detection and high-risk port comparison, and completes vulnerability detection based on a POC plugin framework. The website risk monitoring unit performs website availability, page tampering, malware injection, and sensitive content monitoring. The virus defense unit integrates a lightweight sandbox and a multi-engine virus scanning interface to complete suspicious file removal and backdoor detection.

5. The Internet security monitoring and early warning platform according to claim 4, characterized in that, The baseline inspection unit includes a system baseline inspection subunit, a DNS-specific baseline inspection subunit, and a middleware baseline inspection subunit. The system baseline inspection subunit performs checks on the operating system for account permissions, password policies, and log auditing configurations. The middleware baseline inspection subunit performs checks on the Web middleware for default paths, error page leaks, and session configurations. The DNS-specific baseline inspection subunit detects zone transmission restrictions, recursive query switches, DNSSEC activation status, and cache poisoning risk configurations in the configuration file for the domain name service component. The detection results are synchronized to the risk association analysis module.

6. The Internet security monitoring and early warning platform according to claim 1, characterized in that, The risk association assessment module includes a risk association engine, a configuration-based risk marking unit, and a risk level dynamic adjustment unit. The configuration-based risk marking unit marks baseline configuration items that do not meet security standards as configuration-based risks. The risk level dynamic adjustment unit uses a risk weight attenuation model to correct the vulnerability risk level, and the calculation formula is as follows: in This is the revised final risk level; The initial risk level determined by the vulnerability scan; Configure the impact factor for the baseline; This serves as the activation status identifier for the corresponding service; the risk association engine coordinates the association matching and hierarchical output of all risk data.

7. The Internet security monitoring and early warning platform according to claim 1, characterized in that, The coordinated handling closed-loop verification module includes a repair suggestion generation unit, a security device linkage unit, and a re-inspection task triggering unit. The repair suggestion generation unit generates repair guidelines by combining asset fingerprint information and baseline configuration status. The security device linkage unit connects to firewall and Web application firewall devices to perform high-risk blocking operations. After the handling operation is completed, the re-inspection task triggering unit initiates a secondary verification of the corresponding detection items.

Images