CN115314315A - A network security risk assessment system based on big data - Google Patents

Abstract

The invention discloses a network security risk assessment system based on big data, comprising: an update management and control module for acquiring and recording an update request, wherein the update request includes update time, update item and updater information; Update items include software upgrade, equipment replacement, and addition of network hardware and software; asset comparison database, which records asset assessment data of various projects during network operation and asset assessment reports of the current system, including software and hardware; asset detection a module for periodically extracting update records in the update management and control module, acquiring all update requests in the update records, acquiring the update items, and acquiring the asset evaluation data of the updated items through the asset comparison database; The asset appraisal report in the asset comparison database is updated according to the new asset appraisal data. The present invention can record and update asset data in the system, thereby improving the accuracy of security assessment.

Description

A network security risk assessment system based on big data

technical field

The invention relates to the technical field of network security, in particular to a network security risk assessment system based on big data.

Background technique

Today's society is a rapidly developing society, with advanced technology, information flow, people's communication is getting closer and closer, and life is becoming more and more convenient. Big data is the product of this high-tech era. "Big data" requires a new processing model to have stronger decision-making power, insight and process optimization capabilities to adapt to massive, high-growth and diverse information assets. The definition given by the McKinsey Global Institute is: a data collection that is so large that it greatly exceeds the capabilities of traditional database software tools in terms of acquisition, storage, management, and analysis. It has massive data scale, fast data flow, and diverse Four major characteristics of low data type and value density.

From the perspective of risk assessment indicators, the network security risk indicator system consists of three parts, namely the network layer indicator system, the transmission network risk indicator system and the physical security risk indicator, which point out the direction for the implementation of internal control measures. At the same time, each indicator system also includes three elements: assets, threats and vulnerabilities. The existing risk assessment system will make a statistics on the assets in the system before operation, but in the process of daily operation, the system may produce new changes at any time, such as adding new network software and hardware, software upgrades, Equipment updates, all of which will lead to changes in assets, at this time the previous risk assessment conclusions lose their meaning.

Contents of the invention

The purpose of the present invention is to provide a network security risk assessment system based on big data to solve the following technical problems:

During the operation of the system, the asset changes caused by the system update are not within the evaluation system of the system, resulting in the deviation of the evaluation results.

The purpose of the present invention can be achieved through the following technical solutions:

A network security risk assessment system based on big data, including:

The update management and control module is used to obtain and record the update request, the update request includes update time, update item and updater information, and the update item includes software upgrade, equipment replacement, and addition of network software and hardware;

The asset comparison database records the asset evaluation data of various items in the network operation process and the asset evaluation report of the current system, and the items mentioned include software and hardware;

The asset detection module is used to periodically extract the update records in the update management and control module, obtain all update requests in the update records, obtain the updated items, and obtain the asset evaluation of the updated items through the asset comparison database data; update the asset appraisal report in the asset comparison database according to the new asset appraisal data.

As a further solution of the present invention: the update control module operates at a preset cycle, receives and records an update request at the beginning of the cycle, and after the cycle ends, all update records in this period are backed up and deleted, and into the next cycle.

As a further solution of the present invention: in the asset evaluation report, the asset evaluation data of all items in the system in the previous period are recorded.

As a further solution of the present invention: when the asset evaluation data of the updated item is not recorded in the asset comparison database among the updated items, it is determined that the item is an unfamiliar item.

As a further solution of the present invention: when the project is an unfamiliar project, obtain the updater information in the update request, the updater information includes the updater's identity information and contact information, and send the corresponding project evaluation The questionnaire is sent to the updater, and after the questionnaire information is entered, asset evaluation is performed on the unfamiliar items described to generate asset evaluation data.

As a further solution of the present invention: when the item is an unfamiliar item, use the name and content of the updated item as retrieval information, retrieve the information of the same or similar items through the Internet, and generate asset evaluation data.

As a further solution of the present invention: after the new asset evaluation report is generated, the original asset evaluation report is bound with the update record of the previous cycle and then backed up.

As a further solution of the present invention: when the update item exceeds the set threshold, end this cycle ahead of time and enter the next cycle immediately.

Beneficial effects of the present invention: the present invention needs to be recorded before adding, deleting, upgrading and replacing the software or hardware inside the system, so that the changes inside the system can be traced; the changes in the system are recorded periodically , and after the cycle is over, count all the update items in this cycle, so as to re-evaluate the assets of the system, thereby improving the accuracy of the security evaluation.

Description of drawings

The present invention will be further described below in conjunction with the accompanying drawings.

FIG. 1 is a schematic structural diagram of a network security risk assessment system based on big data in the present invention.

Detailed ways

The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only some, not all, embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without creative efforts fall within the protection scope of the present invention.

Please refer to shown in Fig. 1, the present invention is a kind of network security risk assessment system based on big data, comprising:

The update management and control module is used to obtain and record the update request, the update request includes update time, update item and updater information, and the update item includes software upgrade, equipment replacement, and addition of network software and hardware;

The asset comparison database records the asset evaluation data of various items in the network operation process and the asset evaluation report of the current system, and the items mentioned include software and hardware;

The asset detection module is used to periodically extract the update records in the update management and control module, obtain all update requests in the update records, obtain the updated items, and obtain the asset evaluation of the updated items through the asset comparison database data; update the asset appraisal report in the asset comparison database according to the new asset appraisal data.

In a preferred embodiment of the present invention, the update management and control module operates in a preset cycle, receives an update request and records it at the beginning of the cycle, and backs up all update records in this period after the cycle ends Then delete it and enter the next cycle.

In another preferred embodiment of the present invention, the asset evaluation report records the asset evaluation data of all items in the system in the last cycle.

In this embodiment, when the asset evaluation data of the updated item is not recorded in the asset comparison database among the updated items, it is determined that the item is an unfamiliar item.

It is worth noting that when the project is an unfamiliar project, obtain the updater information in the update request, the updater information includes the updater's identity information and contact information, and send the corresponding project evaluation questionnaire to Update the person's office, and after entering the questionnaire information, perform asset evaluation on the unfamiliar items described, and generate asset evaluation data.

In another preferred embodiment of the present invention, when the item is an unfamiliar item, the name and content of the updated item are used as retrieval information to retrieve the information of the same or similar items through the Internet and generate an asset evaluation data.

As a further solution of the present invention, after the new asset evaluation report is generated, the original asset evaluation report is bound with the update record of the previous period and then backed up.

In another preferred embodiment of the present invention, when the update item exceeds the set threshold, the current cycle ends ahead of schedule and immediately enters the next cycle.

The functions that can be realized by the network security risk assessment system based on big data are all completed by computer equipment, and the computer equipment includes one or more processors and one or more memories, and the one or more memories At least one piece of program code is stored, and the program code is loaded and executed by the one or more processors to realize the functions of the distributed data analysis task scheduling system and method.

The processor takes out the instructions one by one from the memory, analyzes the instructions, and then completes the corresponding operations according to the instruction requirements, and generates a series of control commands, so that the various parts of the computer can automatically, continuously and coordinate actions to form an organic whole, and realize the input of programs and the exchange of data. Input and calculation and output results, the arithmetic operation or logic operation generated in this process is completed by the arithmetic unit; the memory includes a read-only memory (Read-Only Memory, ROM), and the read-only memory is used to store computer programs , a protection device is provided outside the memory.

Exemplarily, a computer program can be divided into one or more modules, and one or more modules are stored in a memory and executed by a processor to implement the present invention. One or more modules may be a series of computer program instruction segments capable of accomplishing specific functions, and the instruction segments are used to describe the execution process of the computer program in the terminal device.

Those skilled in the art can understand that the above description of the service device is only an example, and does not constitute a limitation on the terminal device, and may include more or less components than the above description, or combine certain components, or different components, such as It can include input and output devices, network access devices, buses, etc.

The so-called processor can be a central processing unit (Central Processing Unit, CPU), and can also be other general-purpose processors, digital signal processors (Digital Signal Processor, DSP), application specific integrated circuits (Application Specific Integrated Circuit, ASIC), off-the-shelf Programmable gate array (Field-Programmable Gate Array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc. The above-mentioned processor is the control center of the above-mentioned terminal equipment, and uses various interfaces and lines to connect various parts of the entire user terminal.

The above-mentioned memory can be used to store computer programs and/or modules, and the above-mentioned processor realizes various functions of the above-mentioned terminal device by running or executing the computer programs and/or modules stored in the memory, and calling the data stored in the memory. The memory can mainly include a storage program area and a storage data area, wherein the storage program area can store an operating system, at least one application program required by a function (such as information collection template display function, product information release function, etc.); Store the data created according to the use of the berth status display system (such as product information collection templates corresponding to different product categories, product information to be released by different product providers, etc.), etc. In addition, the memory may include high-speed random access memory, and may also include non-volatile memory, such as hard disk, memory, plug-in hard disk, smart memory card (Smart Media Card, SMC), secure digital (Secure Digital, SD) card , a flash memory card (Flash Card), at least one magnetic disk storage device, flash memory device, or other volatile solid-state storage devices.

If the integrated module/unit of the terminal device is realized in the form of a software function unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present invention realizes all or part of the modules/units in the system of the above-mentioned embodiments, and it can also be completed by instructing related hardware through a computer program. The above-mentioned computer program can be stored in a computer-readable storage medium. The computer When the program is executed by the processor, the functions of the above-mentioned various system embodiments can be realized. Wherein, the computer program includes computer program code, and the computer program code may be in the form of source code, object code, executable file or some intermediate form. The computer-readable medium may include: any entity or device capable of carrying computer program code, recording medium, U disk, removable hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access Memory (RAM, Random Access Memory), electrical carrier signal, telecommunication signal, and software distribution medium, etc.

An embodiment of the present invention has been described in detail above, but the content described is only a preferred embodiment of the present invention, and cannot be considered as limiting the implementation scope of the present invention. All equivalent changes and improvements made according to the application scope of the present invention shall still belong to the scope covered by the patent of the present invention.

Claims (8)

1. A big data-based network security risk assessment system is characterized by comprising:

the updating management and control module is used for acquiring and recording an updating request, wherein the updating request comprises updating time, an updating project and updating person information, and the updating project comprises software upgrading, equipment replacement and addition of network software and hardware;

the asset comparison database records asset evaluation data of each project and an asset evaluation report of a current system in the network operation process, wherein the project comprises software and hardware;

the asset detection module is used for periodically extracting the update record in the update management and control module, acquiring all update requests in the update record, acquiring the update project and acquiring asset evaluation data of the updated project through the asset comparison database; and updating the asset evaluation report in the asset comparison database according to the new asset evaluation data.

2. The system according to claim 1, wherein the update management and control module operates at a preset period, receives an update request and records the update request when the period starts, and deletes all update records in the period after the period ends and enters the next period.

3. The big data based cyber security risk assessment system according to claim 1, wherein asset assessment data of all items in the system in the previous period is recorded in the asset assessment report.

4. The big data-based cyber security risk assessment system according to claim 1, wherein when the asset assessment data of the updated project is not recorded in the asset comparison database in the updated project, it is determined that the project is an unfamiliar project.

5. The big data-based network security risk assessment system according to claim 4, wherein when the item is an unfamiliar item, updater information in the update request is obtained, the updater information includes identity information and contact information of the updater, a corresponding item assessment questionnaire is sent to the updater, and after the questionnaire information is entered, asset assessment is performed on the unfamiliar item to generate asset assessment data.

6. The big data-based cyber security risk assessment system according to claim 4, wherein when the item is an unfamiliar item, the updated name and content of the item are used as retrieval information, information of the same or similar item is retrieved through the internet, and asset assessment data is generated.

7. The big-data-based cyber security risk assessment system according to claim 1, wherein after a new asset assessment report is generated, the original asset assessment report is backed up after being bound with the updated record of the previous period.

8. The big data-based cyber security risk assessment system according to claim 1, wherein when the updated item exceeds the set threshold, the period is ended in advance and the next period is entered immediately.

Images