TWI881506B - Information security rapid screening system - Google Patents

Abstract

An information security quick screening system is connected to a computer device and includes a status data collection module, a network threat analysis module and an analysis data presentation module. The status data collection module includes a logging component connected to the computer device. The network threat analysis module includes an intelligent analysis component connected to the status data collection module and a threat intelligence acquisition component connected to the intelligent analysis component and storing threat intelligence data. The intelligent analysis component has a log analysis unit. The log analysis unit analyzes the data stored in the log recording component based on the threat intelligence data to determine whether an intrusion has occurred in the computer device. The analysis data presentation module is connected to the intelligent analysis component to output the analysis results of the intelligent analysis component.

Description

Information Security Quick Screening System

The present invention relates to a quick information security screening system, in particular to a quick information security screening system that can automatically update threat data and perform quick analysis.

With the advancement of network technology, network attacks on the Internet are becoming more and more frequent. Among them, one type of network attack is denial of service (DoS), the purpose of which is to cause a shortage of system resources so that it cannot respond to legitimate service requests. Another similar network attack is distributed denial of service (DDoS), in which hackers control a large number of hosts infected with malware and try to exhaust system resources. "DDoS" attacks will make the victim server unable to provide services to users who want to access.

In addition, the infected host will be affected by the infected program and execute some non-original programs. Not only will the computer hardware capacity be fully occupied, but it will also send and receive network information and occupy the bandwidth, causing the service that the server could originally provide to be blocked.

From the above explanation, we can know that:

1. Unable to identify dangerous traffic: The current main anti-virus technology mainly uses the data stored in the firewall to block the transmission requests of known harmful addresses, but it cannot block the requests of harmful addresses that have not been stored. As a result, when the computer has dangerous traffic, it cannot analyze and identify it.

2. Unable to quickly block programs: As mentioned above, since the firewall only blocks transmission requests from harmful addresses, it cannot block harmful programs that have already infected and modified the system settings, causing the system to be unable to execute normal programs or occupying network traffic.

3. Inability to immediately notify the outside world: Many companies do not have network administrators on duty around the clock, or even do not have any network administrators. When a computer host has a problem, there is no way to issue an alert to the outside world. As a result, when a computer host has a problem, no one can understand the situation and prevent danger. The relevant technical personnel can only be notified to handle it when the user feels that a problem has occurred during use.

Therefore, how to update in real time and block the latest dangerous locations, how to detect problematic programs and block them, and how to issue external warnings are goals that relevant technical personnel urgently need to work hard on.

In view of this, the purpose of the present invention is to provide a information security fast screening system, which is connected to a computer device and includes a status data collection module, a network threat analysis module and an analysis data presentation module.

The status data collection module includes a log recording component connected to the computer device.

The network threat analysis module includes an intelligent analysis component connected to the status data collection module and a threat intelligence acquisition component connected to the intelligent analysis component and storing threat intelligence data. The intelligent analysis component has a log analysis unit, which analyzes the data stored in the log recording component based on the threat intelligence data to determine whether the computer device has been intruded.

The analysis data presentation module is connected to the intelligent analysis component to output the analysis results of the intelligent analysis component.

Another technical means of the present invention is that the above-mentioned information security fast screening system further includes a threat blocking module, which includes a blacklist recording component connected to the analysis data presentation module. The intelligent analysis component records the source of the intrusion attack in the blacklist recording component based on the analysis results.

Another technical means of the present invention is that the above-mentioned threat blocking module further includes a device connection blocking component connected to the blacklist recording component, and the device connection blocking component blocks the computer device from connecting to other devices based on the data stored in the blacklist recording component.

Another technical means of the present invention is that the above-mentioned status data collection module further includes a flow statistics component connected to the computer device, and the intelligent analysis component further includes a flow analysis unit. An abnormal judgment parameter is set in the flow analysis unit. The flow analysis unit analyzes the data stored in the flow statistics component based on the abnormal judgment parameter to determine whether an abnormal operation occurs in the program in the computer device.

Another technical means of the present invention is that the above-mentioned information security fast screening system further includes a threat blocking module, which includes a program interruption operation component connected to the analysis data presentation module, and the program interruption operation component interrupts the program in which an abnormal operation condition occurs based on the analysis result of the traffic analysis unit.

Another technical means of the present invention is that the above-mentioned network threat analysis module further includes a data normalization component connected to the state data acquisition module and the intelligent analysis component. A data normalization parameter corresponding to the analysis characteristics of the intelligent analysis component is set in the data normalization component so that the data normalization component converts the data stored in the state data acquisition module into data that can be used by the intelligent analysis component.

Another technical means of the present invention is that the above-mentioned analysis data presentation module includes an event notification component connected to the network threat analysis module, and the event notification component outputs the analysis result of the intelligent analysis component to the outside.

Another technical means of the present invention is that the above-mentioned analysis data presentation module includes a data visualization component connected to the network threat analysis module, and the data visualization component outputs the analysis result of the intelligent analysis component on the computer screen.

Another technical means of the present invention is that the above-mentioned threat intelligence acquisition component maintains a connection with a threat intelligence platform, and the threat intelligence acquisition component updates the threat intelligence data from the threat intelligence platform.

Another technical means of the present invention is that the network threat analysis module and the analysis data presentation module are arranged in a security fast screening host, the status data collection module is arranged in the computer device, and the security fast screening system further includes a transmission channel arranged between the computer device and the security fast screening host, and the transmission channel is used for the computer device and the security fast screening host to transmit data.

The beneficial effect of the present invention is that the network threat analysis module detects logs and traffic, and informs the analysis data presentation module of problematic programs, so that the user or the threat blocking module can immediately block the problematic programs to avoid loss expansion.

The related patent application features and technical contents of the present invention will be clearly presented in the following detailed description of two preferred embodiments with reference to the drawings. Before the detailed description, it should be noted that similar components are represented by the same numbers.

Referring to FIG. 1 , FIG. 2 and FIG. 3 , a first preferred embodiment of a fast information security screening system of the present invention is shown. The fast information security screening system is connected to a computer device 21 , and the computer device 21 may be a general computer, a server, a sharing device, a firewall, etc., but is not limited thereto.

In the first preferred embodiment, a plurality of data collection sensors 22 are provided in the computer device 21, and the computer device 21 is connected to a security screening host 23 using a transmission channel, and the transmission channel is a transmission line, but other transmission methods can also be used. The security screening host 23 is connected to an output device of a user end 24, and the output device can use a screen and a speaker to notify the security guards, technicians and other relevant personnel of the user end 24 of the status of the computer device 21. In actual implementation, other settings can also be used, and should not be limited to this.

The information security fast screening system includes a state data collection module 3, a network threat analysis module 4 and an analysis data presentation module 5. In the first preferred embodiment, the state data collection module 3 is disposed in the plurality of data collection sensors 22, and the network threat analysis module 4 and the analysis data presentation module 5 are disposed in the information security fast screening host 23, but not limited thereto.

The state data collection module 3 includes a log recording component 31 connected to the computer device 21 and a traffic statistics component 32 connected to the computer device 21. The network threat analysis module 4 includes an intelligent analysis component 41 connected to the state data collection module 3, a threat intelligence acquisition component 42 connected to the intelligent analysis component 41 and storing threat intelligence data, and a data normalization component 43 connected to the state data collection module 3 and the intelligent analysis component 41. The analysis data presentation module 5 includes an event notification component 51 connected to the network threat analysis module 4 and a data visualization component 52 connected to the network threat analysis module 4. The intelligent analysis component 41 has a log analysis unit 411 connected to the log recording component 31 and a traffic analysis unit 412 connected to the traffic statistics component 32 .

The log analysis unit 411 analyzes the data stored in the log recording component 31 according to the threat intelligence data to determine whether the computer device 21 has been invaded. For example, the log recording component 31 stores the execution track of a known virus. When the log recording component 31 stores the execution track of a known virus, the log analysis unit 411 can capture the virus and report the poisoning incident through the analysis data presentation module 5.

The flow analysis unit 412 is set with an abnormality judgment parameter. The flow analysis unit 412 analyzes the data stored in the flow statistics component 32 according to the abnormality judgment parameter to judge whether the program in the computer device 21 has an abnormal operation. For example, when the computer device 21 is working normally, the working pressure of the computer hardware will be maintained within the normal range, and the external transmission data will also be maintained within the normal range. In the environment, the flow analysis unit 412 analyzes the working pressure and transmission data of the computer device 21 within the normal range and stores them as the abnormal judgment parameters. The flow analysis unit 412 analyzes the working pressure and transmission data of the computer device 21 at all times. When the working pressure and transmission data of the computer device 21 exceed the abnormal judgment parameters, the event is reported through the analysis data presentation module 5.

Among them, the threat intelligence acquisition component 42 maintains connection with a threat intelligence platform 7, and the threat intelligence acquisition component 42 updates the threat intelligence data from the threat intelligence platform 7. Preferably, the threat intelligence platform 7 is the virus code database of the Information Security Institute of the Institute for Information Industry, which can publish known virus codes to the outside, but is not limited to this. The threat intelligence acquisition component 42 can obtain the latest virus code from the threat intelligence platform 7, so that the computer device 21 can be protected by the latest virus code.

The analysis data presentation module 5 is connected to the intelligent analysis component 41 to output the analysis result of the intelligent analysis component 41, wherein the event notification component 51 outputs the analysis result of the intelligent analysis component 41 to the outside. For example, the event notification component 51 can notify the set computer (including general computers, mobile phones, tablets, etc.) of the dangerous events analyzed by the intelligent analysis component 41, but it is not limited to this. The data visualization component 52 outputs the analysis result of the intelligent analysis component 41 on the computer screen. The data visualization component 52 can use text or numbers to present the analysis result of the intelligent analysis component 41, and can also use charts to present the analysis result of the intelligent analysis component 41, but it is not limited to this.

It is worth mentioning that when the computer equipment 21 in the enterprise requires professional-level anti-virus requirements, the information security quick screening host 23 equipped with the network threat analysis module 4 and the analysis data presentation module 5 can be set up in the enterprise local area network, and the computer equipment 21 connected to the local area network can be configured so that the computer equipment 21 is informationally connected to the information security quick screening host 23, and a data collection sensor 22 with the status data collection module 3 is set in the computer equipment 21. Preferably, the data collection sensor 22 can be a program in the computer equipment 21, and the parameters of the status data collection module 3 can be set so that the status data collection module 3 can obtain the log and flow of the computer equipment 21.

Among them, different computer devices 21 are used in the enterprise, and logs and flows of different specifications are generated respectively. The intelligent analysis component 41 cannot directly perform analysis. In order to enable the intelligent analysis component 41 to monitor viruses for different computer devices 21, a data normalization parameter corresponding to the analysis characteristics of the intelligent analysis component 41 is set in the data normalization component 43, so that the data normalization component 43 can further convert the data stored in the status data collection module 3 in each computer device 21 into data that can be used by the intelligent analysis component 41, so that the intelligent analysis component 41 can analyze the logs and flows of each computer device 21, thereby achieving virus detection on multiple computer devices 21 with one information security fast screening host 23, and effectively preventing virus invasion.

In addition, an independent information security fast screening host 23 is used as the main virus detection host. When the computer device 21 crashes or is invaded by a virus, the information security fast screening system can still operate normally and send out an alarm to relevant personnel to avoid the situation where the alarm cannot be sent out. It can even block the network connection of the infected computer device 21 from the network management end to avoid the loss of corporate property.

4 and 5 , which are a second preferred embodiment of a fast information security screening system of the present invention. The second preferred embodiment is substantially the same as the first preferred embodiment, and the similarities are not described in detail here. The difference is that the fast information security screening system further includes a threat blocking module 6.

The threat blocking module 6 includes a blacklist recording component 61 connected to the analysis data presentation module 5 , a device connection blocking component 62 connected to the blacklist recording component 61 , and a program interruption operation component 63 connected to the analysis data presentation module 5 .

The intelligent analysis component 41 records the source of the intrusion attack in the blacklist recording component 61 according to the analysis result. The device connection blocking component 62 blocks the computer device 21 from connecting with other devices according to the data stored in the blacklist recording component 61. The program interruption operation component 63 interrupts the program that has abnormal operation according to the analysis result of the traffic analysis unit 412. For example, the traffic analysis unit 412 analyzes an address that sends a transmission request to the computer device 21, but always generates an error code. At this time, the intelligent analysis component 41 records the address in the blacklist recording component 61, and the device connection blocking component 62 stores the address in the firewall blacklist of each computer device 21 to block any network attack of the address in a network blocking manner. In addition, when the computer device 21 is infected, the program interruption component 63 uses forced closure of the infected program to restore the working capacity of the computer hardware by closing the abnormal program. In addition, the threat intelligence acquisition component 42 can be used to upload the address to the threat intelligence platform 7.

Preferably, the threat blocking module 6 is installed in the information security fast screening host 23, and the computer device 21 is set with permissions so that the threat blocking module 6 can control the data transmission of the computer device 21. In addition, the information security fast screening host 23 has the highest permissions, prohibiting the connected computer device 21 from accessing and setting, effectively preventing the information security fast screening system itself from being infected by viruses.

From the above description, it can be seen that the information security quick screening system of the present invention has the following effects:

1. Analyze abnormal traffic: The traffic analysis unit 412 analyzes the normal range of the working pressure and transmission data of the computer device 21 and stores it as the abnormal judgment parameter, so that the traffic analysis unit 412 can analyze the working pressure and transmission data of the computer device 21 at any time, thereby analyzing the abnormal traffic of the computer device 21 to the outside.

2. Blocking abnormal programs: The intelligent analysis component 41 records the source of the intrusion attack in the blacklist recording component 61 according to the analysis results. The device connection blocking component 62 blocks the computer device 21 from connecting with other devices according to the data stored in the blacklist recording component 61. The program interruption component 63 blocks the program in the computer device 21 that has abnormal operation according to the analysis results of the traffic analysis unit 412.

3. Immediate alarm issuance: The information security fast screening system independently sets up virus detection in an information security fast screening host 23. When the computer device 21 has been invaded by a virus and an abnormality occurs, resulting in slowness or crash, the information security fast screening system set up in the information security fast screening host 23 can still operate normally and issue an alarm to relevant personnel to avoid the situation where the alarm cannot be issued.

In summary, the information security fast screening system is independently set up on an information security fast screening host 23, which is very convenient for enterprises to set up. The computer device 21 only needs simple settings to connect to the information security fast screening host 23 and be well protected. In addition, when the computer device 21 is abnormal, the information security fast screening system can detect it and block it immediately, which can not only avoid losses to the enterprise, but also can immediately and accurately notify related equipment and personnel, so the purpose of the present invention can be achieved.

However, the above are only two preferred embodiments of the present invention, and should not be used to limit the scope of implementation of the present invention. In other words, any simple equivalent changes and modifications made according to the scope of the patent application of the present invention and the content of the invention description are still within the scope of the present patent.

21        Computer equipment 22        Data collection sensor 23        Security fast screening host 24        User end 3          Status data collection module 31        Log recording component 32        Traffic statistics component 4          Network threat analysis module 41        Intelligent analysis component 411      Log analysis unit 412      Traffic analysis unit 42        Threat intelligence acquisition component 43        Data normalization component 5          Analysis data presentation module 51        Event notification component 52        Data visualization component 6          Threat blocking module 61       Blacklist recording component 62        Device connection blocking component 63        Program interruption component 7          Threat intelligence platform

FIG1 is a schematic diagram of a system setting, which is a first preferred embodiment of a security fast screening system of the present invention, illustrating the setting state of the security fast screening system; FIG2 is a schematic diagram of a functional module setting, which illustrates the setting state of the functional module in the security fast screening system in the first preferred embodiment; FIG3 is a schematic diagram of a functional component setting, which illustrates the setting state of an intelligent analysis component in the security fast screening system in the first preferred embodiment; FIG4 is a schematic diagram of a functional module setting, which is a second preferred embodiment of a security fast screening system of the present invention, illustrating the setting state of the security fast screening system; and FIG5 is a schematic diagram of a functional component setting, illustrating the setting of a threat blocking module in the information security fast screening system in the second preferred embodiment.

3: Status data collection module

31: Log record component

32: Traffic statistics component

4: Network threat analysis module

41: Intelligent analysis components

42: Threat Intelligence Acquisition Components

43: Data Normalization Component

5: Analysis data presentation module

51: Event notification component

52: Data visualization component

7: Threat intelligence platform

Claims (5)

A quick screening system for information security is connected to a computer device and includes: a state data collection module, including a log recording component connected to the computer device, and a traffic statistics component connected to the computer device; a network threat analysis module, including an intelligent analysis component connected to the state data collection module, a threat intelligence acquisition component connected to the intelligent analysis component and storing threat intelligence data, and a device connection blocking component connected to the blacklist recording component, the intelligent analysis component has a log analysis unit and a traffic analysis unit, the log analysis unit analyzes the data stored in the log recording component according to the threat intelligence data The data is collected by the computer device to determine whether the computer device is in an intrusion state. An abnormal judgment parameter is set in the traffic analysis unit. The traffic analysis unit analyzes the data stored in the traffic statistics component according to the abnormal judgment parameter to determine whether the program in the computer device is in an abnormal operation state. The threat intelligence acquisition component maintains a connection with a threat intelligence platform. The threat intelligence acquisition component updates the threat intelligence data from the threat intelligence platform; An analysis data presentation module connected to the intelligent analysis component to output the analysis result of the intelligent analysis component; A threat blocking module, including a blacklist recording component connected to the analysis data presentation module, the intelligent analysis component records the source of the intrusion attack in the blacklist recording component according to the analysis result, and the device connection blocking component blocks the computer device from connecting to other devices according to the data stored in the blacklist recording component; and A threat blocking module, including a program interruption operation component connected to the analysis data presentation module, the program interruption operation component interrupts the program that has abnormal operation status according to the analysis result of the traffic analysis unit; The traffic analysis unit can analyze the situation where an address sends a transmission request to the computer device and the computer device always generates an error code. The intelligent analysis component records the address in the blacklist recording component, and the threat intelligence acquisition component uploads the address to the threat intelligence platform; The abnormal judgment parameter is the normal range of the working pressure and transmission data of the computer device. The traffic analysis unit analyzes the working pressure and transmission data of the computer device, so that when the working pressure and transmission data of the computer device exceed the abnormal judgment parameter, the data is reported through the analysis data presentation module. The information security fast screening system as described in claim 1, wherein the network threat analysis module further includes a data normalization component connected to the state data collection module and the intelligent analysis component, and a data normalization parameter corresponding to the analysis characteristics of the intelligent analysis component is set in the data normalization component so that the data normalization component converts the data stored in the state data collection module into data that can be used by the intelligent analysis component. As described in claim 1, the information security fast screening system, wherein the analysis data presentation module includes an event notification component connected to the network threat analysis module, and the event notification component outputs the analysis results of the intelligent analysis component to the outside. As described in claim 1, the information security fast screening system, wherein the analysis data presentation module includes a data visualization component connected to the network threat analysis module, and the data visualization component outputs the analysis results of the intelligent analysis component on a computer screen. As described in claim 1, the network threat analysis module and the analysis data presentation module are arranged in a security fast screening host, the status data collection module is arranged in the computer device, and the security fast screening system further includes a transmission channel arranged between the computer device and the security fast screening host, and the transmission channel is used for data transmission between the computer device and the security fast screening host.