TWI591576B - System and Method for Blocking Intelligent Information Security Network - Google Patents

Description

System and method for intelligent information security network blocking analysis

The invention belongs to a system and method for blocking analysis of intelligent information security network.

Because the network architecture in a large enterprise network is very complicated, if you want to ensure that the network service is indeed blocked, you need to execute blocking instructions on multiple gates, which may cause the efficiency of multiple gate blocking to be inconvenient and difficult to manage. On the other hand, in the past, the blocking method was blocked by the host of the network service, and there was a problem that the management problem of the blocking state could not be released.

In view of the shortcomings derived from the above-mentioned conventional methods, the inventors of the present invention have improved and innovated, and after years of painstaking research, they finally succeeded in researching and developing the system and method for blocking analysis of this intelligent information security network.

To achieve the above objective, the present invention provides an intelligent network service blocking method and system, which improves the execution efficiency of blocking instructions, improves host management efficiency, and solves management problems of host blocking and unblocking. The invention comprises a smart network blocking analysis server and a smart network blocking control server, and a smart information security network blocking analysis program and a smart information security network are installed in the corresponding server. Road blocking control program. The servo of the present invention The server and the program include the following eight modules: data analysis unit, IP asset analysis unit, asset management unit, blocking impact analysis unit, block list management unit, data collection unit, system communication unit, and IP blocking control unit. . The data collected by the present invention includes, but is not limited to, proxy server records, firewall records and other network activity record logs, and the priority of blocking network services is calculated for the host with information security concerns, and the smart computing is most suitable. The device that executes the blocking instruction dispatches a blocking instruction that preferentially blocks the network service to the device. In addition to blocking the dispatch of instructions, the present invention also provides an estimate of the lifetime of the host network connection. Based on this life cycle, it is estimated when the host of the blocked network service can release its blocking command.

A smart information security network blocking analysis system, which mainly comprises: an analysis module, which is an analysis of data and calculates a sum of asset scores Srcinv (IP), and a blocking score Srcbk (IP), including: data analysis The unit receives various log records and data through the system communication unit for pre-processing and analysis. The IP asset analysis unit is the enterprise information equipment asset information analyzed by the integrated asset management unit, and calculates the asset score of each host, Srcinv (IP). The blocking impact analysis unit intercepts the host information that is suspicious and needs to be blocked by the network through the blocking list management unit, analyzes the impact of the host, and analyzes the internal network of the host after being blocked and offline. The impact and impact of the overall architecture of the network; the information management module is to analyze and manage information, including: the asset management unit, which is to extract relevant information from the enterprise information equipment asset database, calculate and analyze the host equipment. Asset level and information; block list management unit to analyze and access related information in the block list database The collection module is for collecting relevant information (please specify what kind of information or information); the data collection unit collects the analysis data and stores it in the database, and collects various records (log) through the storage device and the network. Data; execution module, is to transmit data And the execution instructions, including: the system communication unit is the communication between the intelligent information security network blocking analysis program and the intelligent information security network blocking control program; the IP blocking control unit is in the enterprise network On the border security equipment, the network service blocking command or the network service blocking release command will be mainly executed.

The asset score is the calculated asset score Srcinv (IP) through the linear regression model. The calculation of the asset score refers to the importance of the role of the host, the importance of the domain, the confidentiality, the busyness of the operation, and the enterprise. The out-link frequency of other hosts connected to the network, the in-link frequency of other hosts connected to the network, and the impact analysis unit are blocked by managing all blocked hosts. Provide management and assistance, and calculate the blocking score Srcbk (IP) according to the asset score Srcinv (IP) calculated by the IP asset analysis unit module and the block list information of the host, and use this to judge the priority to block the network. The host of the road service, blocking the impact analysis unit, is the most suitable device for preferentially blocking the host to evaluate its blocking instruction delivery, and dispatching the instruction to the device, blocking the impact analysis unit, and also recording the blocked network. The start date, estimated end date, information of the device that blocks the execution of the service host, management information, information for the organization or internal assets of the enterprise, and the blocking of assets Information, all kinds of record (log) data, is the proxy server record, firewall record, system communication unit, is able to take the data collected by the data collection unit from the database, and send it to the data analysis unit for analysis, system communication The unit also receives the blocking dispatch and release command of the blocking impact analysis module, and transmits the command to the asset management unit to control the state of the specific host network service by using the internal network boundary security device of the enterprise.

A smart information security network blocking analysis method includes: collecting data and transmitting data; analyzing data, processing and analyzing the data, and obtaining a total blocking score, As a basis for whether a host should prioritize blocking network services; add relevant information, use auxiliary information to assist analysis, and its auxiliary information refers to asset information, and blocking information; whether to block or not is based on analytical data. Blocking score Srcbk (IP), to determine whether the current host IP must be preferentially blocked; if the score is higher than the blocking threshold, the decision is yes, then continue, if the score is lower than the threshold, then the decision is no and the process ends; calculation execution The way to calculate the life cycle of the host and the best instruction execution device point; execute the command to execute the instruction on the most suitable device.

The collection of data includes: collecting log data, collecting various log record data, and storing it in the database; transmitting the data, and transmitting the collected log record data to the data analysis unit for analysis.

The analysis data includes: processing data, pre-processing and analyzing the received log record data; calculating the asset score, using the log record data and the host asset related information to calculate the asset score Srcinv (IP); calculating the block score, according to The asset score, Srcinv (IP), and the block-related information analyze the impact and impact of the host on the overall architecture of the internal network after the network service is blocked and offline, and calculate the blocking score Srcbk (IP).

The relevant information is included, including: adding asset information, importing information about the host asset into the analysis program; adding blocking information, and importing the blocking list information into the analysis program.

The calculation execution mode includes: calculating the optimal execution point and calculating the current host blocking instruction dispatching device. To achieve the highest blocking efficiency, this step will calculate the device with the best blocking effect; calculate the blocking life cycle through Estimating the life cycle of the host, calculating the date on which the blocked host may release the blocking command; transmitting the blocking instruction, dispatching the blocking instruction to the device according to the optimal blocking dispatching device calculated according to the transmitted data; The instruction, based on the estimated host life cycle and the block release date, transmits the blocking release information to the device and notifies the device administrator.

The execution command includes: executing a blocking instruction, executing a blocking instruction on the most suitable device for the host that needs to block the network service; executing the release instruction, and blocking the original host for the host that can restore the network service The release command is executed on the device of the network service.

The information about the host asset includes the importance of the role of the host, the importance and confidentiality of the domain to which the host belongs, the busyness of the host, the out-link frequency of the host, and the frequency of the host connection (in-link). Frequency).

The system and method for intelligent intelligence network security blocking analysis provided by the invention have the following advantages when compared with other conventional technologies: Compared with the general network blocking method, the present invention can solve the problem that the traditional multiple network service blocking methods are parallel but have no centralized management mechanism, and avoids the management to be repeatedly blocked and the resource is wasted. Or failing to block the equipment to be controlled The situation of missing. The invention automatically calculates the role and risk degree of the candidate blocking host, and blocks the impact level of the host. The system will recommend the host with important role, high risk value and wide influence level as the host to be prioritized, unlike the traditional method. All the hosts that need to block the network service are directly blocked without prioritization. On the other hand, according to each host profile, the most efficient blocking gate and the life cycle of the host network activity are calculated, thereby intelligently dispatching blocking instructions and transmitting blocking cancellation suggestions to solve the traditional multi-gate The inefficiency caused by blocking and the management are not easy to be bothered, and at the same time, the management problem that the blocked host can not be unblocked is solved. On the other hand, with regard to the delivery execution device for blocking the service, the present invention can be more intelligently blocked by different blocking methods in conjunction with the pipelines that various attacks may use, for example, for the domain name. Blocking needs to be performed on the DNS or NG-Firewall. Blocking for IP can be performed directly on the Firewall. In general, the present invention provides a more intelligent network blocking method that can assist in automatic decision making within an enterprise internal network, and even provides automatic decision making functions.

110‧‧‧Analysis module

111‧‧‧Data Analysis Unit

112‧‧‧IP Asset Analysis Unit

113‧‧‧Block impact analysis unit

120‧‧‧Information Management Module

121‧‧‧ Asset Management Unit

122‧‧‧Blocking list management unit

210‧‧‧Execution module

211‧‧‧System Communication Unit

212‧‧‧IP blocking control unit

220‧‧‧Collection module

221‧‧‧ data collection unit

S210~S262‧‧‧ Process

The detailed description of the present invention and the accompanying drawings will be further understood, and the technical contents of the present invention and the functions thereof can be further understood. FIG. 1 is a system and method for blocking analysis of intelligent information security network according to the present invention. Schematic diagram of the architecture; FIG. 2 and FIG. 3 are flowcharts of a system and method for blocking analysis of a smart information security network according to the present invention.

The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It is understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

The following is a further description of the present invention with reference to the accompanying drawings: FIG. 1 is a schematic structural diagram of a system and method for blocking analysis of a smart information security network according to the present invention, and a smart information security network blocking analysis system, It mainly includes an analysis module 110, which is an asset score Srcinv (IP) for analyzing data and calculating a sum, and a blocking score Srcbk (IP), which includes: a data analysis unit 111, which receives various types through the system communication unit 211. The log record data is pre-processed and analyzed. The IP asset analysis unit 112 is the enterprise information device asset information analyzed by the integrated asset management unit 121, and calculates the asset score Srcinv (IP) of each host; the blocking impact analysis unit 113, Through the block list management unit 122, the host information of the host that is suspected and needs to be blocked by the network is analyzed, and the impact analysis of the host is performed to analyze the overall architecture of the internal network of the enterprise after the host is blocked from the network service and offline. The impact and impact level; the information management module 120 is for analyzing and managing information, including: the asset management unit 121, which is a capture enterprise The information in the information equipment asset database calculates and analyzes the asset level and information of the host device; the blocking list management unit 122 analyzes and accesses related information in the blocking list database; the collection module 220 is In order to collect related data, the related data includes a traffic log, a proxy log, a firewall log, a DNS log, etc., and the data collecting unit 221 collects data. Analyze the data and store it in the database, collect various log data through the storage device and the network; execute the module 210, which is to transfer the data and execute The line instruction includes: the system communication unit 211 is a communication between the intelligent information security network blocking analysis program and the intelligent information security network blocking control program; the IP blocking control unit 212 is on the enterprise network. On the security equipment of the road boundary, the network service blocking command or the network service blocking release command will be mainly executed.

The asset score is the calculated asset score Srcinv (IP) through the linear regression model. The calculation of the asset score refers to the importance of the role of the host, the importance of the domain, the confidentiality, the busyness of the operation, and the enterprise. The out-link frequency of other hosts connected to the network, the in-link frequency of other hosts in the enterprise network, and the impact analysis unit 113 are used to manage all blocked hosts. And provide assistance in management and control, and calculate the blocking score Srcbk (IP) according to the asset score Srcinv (IP) calculated by the IP asset analysis unit 112 module and the block list information of the host, and the priority is blocked by the segmentation judgment. The host of the network service, the blocking impact analysis unit 113, is the most suitable device for preferentially blocking the host to evaluate the blocking instruction delivery, and dispatching the instruction to the device, blocking the impact analysis unit 113, also recording The start date, estimated end date, information of the device that blocked the execution of the blocked network service host, management information, information for the organization or internal assets of the enterprise, And blocking information, various types of log data are proxy server records, firewall records, and the system communication unit 211 is configured to take the data collected by the data collecting unit 221 from the database and transmit the data to the data analysis. The unit 111 analyzes that the system communication unit 211 also receives the blocking dispatch and release command for blocking the impact analysis module, and transmits the command to the asset management unit 121 to control the specific by the enterprise internal network boundary security device. Host network service status.

In the use scenario of the present invention, the user can use the present invention in the intranet of the enterprise, and the smart network blocking analysis server will be divided into It is analyzed whether a host IP needs to block its network service, calculate a dispatching place (or a dispatching device) of the blocking instruction, and a release suggestion of the blocking instruction. The analysis results of the intelligent network blocking analysis server are transmitted to the intelligent network blocking control server located at the boundary of the enterprise network, and the execution of each instruction is controlled by the control server.

Each module is divided into functions according to different functions. The data collection unit 221 is mainly used for collecting and analyzing the data to be analyzed, and collecting various types of records (1og) through the storage device and the network. Information includes, but is not limited to, proxy server records, firewall records, etc.

The system communication unit 211 is mainly used for communication between the intelligent information security network blocking analysis program and the intelligent information security network blocking control program, and can be collected by the data collecting unit 221 through the system communication unit 211. The data is taken out from the database and sent to the data analysis unit 111 for analysis; on the other hand, the system communication unit 211 also receives the blocking dispatch instruction of the blocking impact analysis unit 113, and the blocking release command, which will receive the data. The instructions are transmitted to the IP blocking control unit 212, which controls the network service status of the specific host through the security device on the internal network boundary of the enterprise, and blocks the network service or restores its network service as needed.

The IP blocking control unit 212 is installed on the security device at the enterprise network boundary, and the IP blocking control unit 212 will execute but is not limited to the network service blocking command or the network service blocking release command.

The data analysis unit 111 is mainly configured to receive various types of log record data through the system communication unit 211 for pre-processing and analysis.

The IP asset analysis unit 112 obtains the analyzed enterprise information equipment asset information through the asset management unit 121, and calculates the asset score of each host, Srcinv (IP); the estimation of the single host IP asset score includes but is not limited to the main The importance of the role of the machine, the importance and confidentiality of the domain to which the host belongs, the busyness of the host, the out-link frequency of the host connecting to other hosts in the enterprise network, and the host being in the corporate network. Other indicators such as in-link frequency and other indicators, and through the above multiple indicators, calculate the sum of the asset scores Srcinv (IP) through the linear regression model.

The asset management unit 121 extracts related information from the enterprise information equipment asset database, and after calculating and analyzing, the asset analysis result of the output host device includes but is not limited to the role of the host and its importance, whether the host provides or receives the service. Host, busyness of the host, etc.

The blocking impact analysis unit 113 searches for the host information that has security concerns and needs to be blocked by the network through the blocking list management unit 122, analyzes the impact of the host, analyzes the host after the network service is blocked, and goes offline. The impact and impact of the overall architecture of the internal network. And used to manage all the blocking hosts and provide assistance in management and control, and calculate the blocking score Srcbk (IP) according to the asset score Srcinv (IP) calculated by the IP asset analyzing unit 112 and the block list information of the host, and judge the judgment by this. The host that must preferentially block its network service, and the most suitable device for the priority blocking host to evaluate its blocking command delivery, and dispatch the command to the device, also record the start date of the blocked network service host. Information such as the expected end date, instructions to block the execution of the device, etc., to achieve centralized management. This estimation mechanism considers the node where the host that is currently blocking the network service is located in the enterprise network, and the comparison is made by each device including but not limited to a proxy server (Proxy), a firewall, or a domain name system (DNS). The cost and benefit of blocking, under the premise of the same blocking effect, the blocking management module will recommend a minimum of blocking delivery points, and the best blocking command delivery point, in order to achieve the purpose of intelligent blocking. On the other hand, predicting the host network activity life cycle based on the host's profile, predicting the host's blocking 讫 Date, and the required blocking period, when the host no longer has the risks and concerns of information security, restore the network service, and automatically send the blocking release message to the specific blocking device to achieve another level of smart blocking. efficacy.

The block list management unit 122 extracts relevant information from the block list database.

Please refer to FIG. 2 and FIG. 3, which are flowcharts of a system and method for blocking analysis of a smart information security network according to the present invention, including: S210 collecting data and transmitting data; S220 analyzing data, processing and analyzing data. , to obtain the total blocking score, as a basis for whether a host should prioritize blocking network services; S230 join relevant information, use auxiliary information to assist analysis, and its auxiliary information refers to asset information, and blocking information; S240 Judging whether to block or not is based on the blocked score Srcbk (IP) calculated by the analysis data to determine whether the current host IP needs to be preferentially blocked; if the score is higher than the blocking threshold, the determination is yes, then if the score is lower than the threshold, then The determination is no and the flow is ended; S250 calculates the execution mode, calculates the life cycle of the host and the optimal instruction execution device point; S260 executes the command to execute the instruction on the most suitable device.

The data collected by S210 includes: S211 collects log data, collects various log record data, and stores it in the database; S212 transmits the data, and transmits the collected log record data to the data analysis unit for analysis.

The S220 analysis data includes: S221 processing data, pre-processing the received log record data and Analysis; S222 calculates the asset score, uses the log record data and the host asset related information to calculate the asset score Srcinv (IP); S223 calculates the block score, and analyzes the host blocked network according to the asset score Srcinv (IP) and the block list related information. The impact and impact of the service and the offline on the overall architecture of the company's internal network, and calculate the blocking score Srcbk (IP).

S230 adds relevant information, which includes: S231 joins the asset information, and imports the host asset related information into the analysis program; S232 adds the blocking information, and the blocking list related information is imported into the analysis program.

The S250 calculates the execution mode, which includes: S251 calculates the optimal execution point, and calculates the current host blocking instruction dispatching device. In order to achieve the highest blocking efficiency, this step will calculate the device with the best blocking effect; S252 calculates the blocking life. Cycle, through the estimation of the host life cycle, calculate the date that the blocked host may release the blocking command; S253 transmits the blocking command, and sends the blocking command to the device according to the optimal blocking dispatching device calculated based on the transmitted data. Up; S254 transmits a release command, and based on the estimated host life cycle and the block release date, the block release information is transmitted to the device and notified to the device administrator.

The S260 executes the command, which includes: S261 executes a blocking instruction, and performs a blocking instruction on the most suitable device for the host that needs to block the network service; S262 executes a release command to execute a release command on the device that originally blocked the network service for the host that is able to resume the network service.

The information about the host asset includes the importance of the role of the host, the importance and confidentiality of the domain to which the host belongs, the busyness of the host, the out-link frequency of the host, and the frequency of the host connection (in-link). Frequency).

In summary, the smart network blocking analysis server and the intelligent network security network blocking analysis program and the intelligent information security network blocking control program in the intelligent network blocking control server After being started, data processing and analysis will be started, various log records will be collected, stored in the database, and the collected log records will be sent to the data analysis module for analysis, and the log records will be received. Pre-processing and analysis, importing host asset related information into the analysis program, using log record data and host asset related information, according to various indicators including but not limited to the importance of the role of the host, the importance of the domain to which the host belongs and the degree of confidentiality The host operation is busy, the out-link frequency, the in-link frequency calculates the asset score Srcinv (IP), and the block-related information is imported into the analysis program. According to the asset score Srcinv (IP) and blocking list related information, analyze the host after being blocked by the network service and go offline after the internal The impact of the overall architecture of the road and the degree of impact, and calculate the blocking score Srcbk (IP), according to the blocking score Srcbk (IP) calculated in the previous step, determine whether the current host IP must be preferentially blocked; if the score is higher than the resistance When the door is broken, it is judged as Yes, and if it is lower than the threshold, it is judged as No and the flow is terminated, and the device that the current host block command is dispatched is calculated. In order to achieve the highest blocking efficiency, this step will calculate the best blocking effect. Device (for example: firewall), through the estimation of the host life cycle, calculate the day when the blocked host may be able to release the blocking command. Period, according to the calculated optimal blocking dispatching device, dispatching a blocking instruction to the device, and transmitting the blocking release information to the device according to the estimated host life cycle and the blocking release date, and notifying the device management For the host that needs to block the network service, the blocking instruction is executed on the most suitable device, and the host that can recover the network service performs the release instruction on the device that originally blocked the network service.

The detailed description of the present invention is intended to be illustrative of a preferred embodiment of the invention, and is not intended to limit the scope of the invention. The patent scope of this case.

To sum up, this case is not only innovative in terms of technical thinking, but also has many of the above-mentioned functions that are not in the traditional methods of the past. It has fully complied with the statutory invention patent requirements of novelty and progressiveness, and applied for it according to law. Approved this invention patent application, in order to invent invention, to the sense of virtue.

110‧‧‧Analysis module

111‧‧‧Data Analysis Unit

112‧‧‧IP Asset Analysis Unit

113‧‧‧Block impact analysis unit

120‧‧‧Information Management Module

121‧‧‧ Asset Management Unit

122‧‧‧Blocking list management unit

210‧‧‧Execution module

211‧‧‧System Communication Unit

212‧‧‧IP blocking control unit

220‧‧‧Collection module

221‧‧‧ data collection unit

Claims (16)

A smart information security network blocking analysis system, which mainly comprises: an analysis module, which is to analyze data and calculate a sum of asset scores Srcinv (IP), and a blocking score Srcbk (IP), including: data analysis The unit receives various log records and data through the system communication unit for pre-processing and analysis; the IP asset analysis unit is based on the enterprise information equipment asset information analyzed by the integrated asset management unit, and calculates the asset score of each host, Srcinv (IP). The blocking impact analysis unit intercepts the host information that is suspicious and needs to be blocked by the network through the blocking list management unit, analyzes the impact of the host, analyzes that the host is blocked by the network service and goes offline after the enterprise The impact and impact of the overall architecture of the internal network; the information management module is based on analysis and management information, including: asset management unit, which draws relevant information from the enterprise information equipment asset database, calculates and analyzes the host device. Asset level and information; block list management unit for analyzing and accessing related assets in the block list database The collection module is a collection of related data, including a traffic log, a proxy log, a firewall log, a DNS log, and a data collection unit. It collects analytical data and stores it in a database. It collects various types of log data through storage devices and the Internet. The execution module is used to transmit data and execute instructions, including: system communication unit, which is based on wisdom. Communication between the information security network blocking analysis program and the intelligent information security network blocking control program; The IP blocking control unit is attached to the security equipment of the enterprise network boundary, and mainly performs a network service blocking instruction or a network service blocking release command. For example, the intelligent information security network blocking analysis system described in claim 1 wherein the asset score is calculated by a linear regression model to calculate the sum of the asset scores Srcinv (IP). For example, the intelligent information security network blocking analysis system described in claim 1 wherein the calculation of the asset score refers to the importance of the role of the host, the importance of the domain, the confidentiality, and the operation. Busyness, the out-link frequency of other hosts connected to the corporate network, and the in-link frequency of other hosts connected to the corporate network. For example, the intelligent information security network blocking analysis system described in claim 1 of the patent scope, wherein the blocking impact analysis unit is responsible for managing all blocking hosts and providing management assistance, and analyzing according to the IP assets. The asset score calculated by the unit module, Srcinv (IP), is combined with the block list information of the host to calculate the blocking score Srcbk (IP), and the score is used to determine the host that must preferentially block its network service. The system for intelligent intelligence network blocking analysis according to claim 1, wherein the blocking impact analysis unit is further configured to preferentially block the host to evaluate the optimal delivery device for the blocking instruction, and Instructions are dispatched to the device. The system for intelligent intelligence network blocking analysis according to claim 1, wherein the blocking impact analysis unit also records the start date, estimated end date, and instruction of the blocked network service host. Block information about the device being executed. For example, the intelligent information security network blocking analysis system described in claim 1 of the patent scope, wherein the management information is information about the organization or internal assets of the enterprise, and blocking information. For example, the intelligent information security network blocking analysis system described in claim 1 of the patent scope, wherein the various types of log data are proxy server records and firewall records. For example, the intelligent information security network blocking analysis system described in claim 1 wherein the system communication unit is capable of taking the data collected by the data collection unit from the database and transmitting the data to the data. Analysis unit analysis. The system for intelligent intelligence network blocking analysis according to claim 1, wherein the system communication unit further receives the blocking delivery and release command of the blocking impact analysis module, and transmits the instruction to The asset management unit is configured to control the status of a specific host network service by means of an intranet network security device. A smart information security network blocking analysis method includes: collecting data, collecting relevant data by a collection module, and transmitting data; analyzing data, processing and analyzing the data by the analysis module, and obtaining a total blocking score, As a basis for whether a host should preferentially block network services, the analysis data includes: processing data, pre-processing and analyzing the received log record data; calculating asset scores, using log record data, and host assets Related information calculates the asset score Srcinv (IP); calculates the blocking score, analyzes the host's blocked network service and goes offline after the offline based on the asset score Srcinv (IP) and the block list related information. The impact of the overall structure of the internal network and the impact degree, and calculate the blocking score Srcbk (IP); add relevant information, the auxiliary information provided by the information management module to assist analysis, the auxiliary information refers to asset information, and resistance Breaking the information; determining whether to block, based on the blocking score Srcbk (IP) calculated by the analysis data, determining whether the current host IP needs to be preferentially blocked; if the score is higher than the blocking threshold, the determination is yes, then the continuation, if the score is low At the threshold, the determination is no and the process is terminated; the execution mode is calculated, the life cycle of the host and the optimal instruction execution device point are calculated; and the execution module executes the command on the most suitable device by the execution module. The method for blocking analysis of the intelligent information security network described in claim 11 of the patent application, wherein the collecting data includes: collecting log data, collecting various log record data, and storing in the database; transmitting The data is transmitted to the data analysis unit for analysis. For example, the smart information security network blocking analysis method described in claim 11 of the patent application, wherein the related information includes: adding asset information, importing host asset related information into the analysis program; adding blocking information , the block list related information is imported into the analysis program. For example, the smart information security network blocking analysis method described in claim 11 of the patent scope includes: calculating the optimal execution point, and calculating the current host blocking instruction dispatching device, to achieve the highest Blocking efficiency, this step will calculate the device with the best blocking effect; Calculate the blocking life cycle, calculate the date that the blocked host may release the blocking command through the estimation of the host life cycle; transmit the blocking command, and the optimal blocking dispatching device calculated based on the transmitted data will block The instruction is dispatched to the device; the transfer release command transmits the block release information to the device and notifies the device administrator based on the estimated host life cycle and the block release date based on the local data. The method for blocking analysis of a smart information security network according to claim 11, wherein the executing the command comprises: executing a blocking instruction, for a host that needs to block the network service, on the most suitable device Execute the block instruction; execute the release command to execute the release command on the device that originally blocked the network service for the host that is able to recover the network service. For example, the smart information security network blocking analysis method described in claim 13 of the patent scope, wherein the host asset related information includes the importance degree of the host belonging to the host, the importance degree and confidentiality of the host domain, and the busyness of the host operation. The out-link frequency of the host and the in-link frequency of the host.