CN116980185A - Network security defense system based on cloud computing - Google Patents

Abstract

The invention discloses a network security defense system based on cloud computing, which relates to the field of network security technology and includes a cloud storage module, an IP verification module, a data transmission module, an attack monitoring module and a security assessment module; when a network IP accesses a computer When accessing internal data, the IP verification module is used to verify the network IP; when a malicious IP access is detected, the data isolation module is used to isolate the computer's internal data information and generate an alarm command for prompting. The internal data information of the computer encounters illegal intrusion; the data monitoring module is used to monitor and manage the marked internal data and external data; the cloud storage module is used to store internal data through cloud storage technology; the present invention uses the data monitoring module and IP The verification module performs security management from both the inside and outside of the computer, which can avoid the leakage of important information of the computer's internal data and achieve double protection.

Description

A network security defense system based on cloud computing

Technical field

The invention relates to the field of network security technology, specifically a network security defense system based on cloud computing.

Background technique

With the rapid development and in-depth application of computer science and technology, changes in cyberspace are constantly changing and affecting people's lifestyles; because people are increasingly dependent on the Internet, many businesses and individuals are involved in the Internet. Confidential information, therefore network security issues have always been an important topic in the process of technological development.

At present, the existing network security system usually uses the computer's own firewall to check the data entering the computer to determine whether the data entering the computer has security risks. Its security performance is average, it lacks good data interaction functions, and it is difficult to function Good data extraction, data processing and data presentation work, but at the same time, it is impossible to reasonably select the corresponding storage block for data storage according to the storage status of the storage block and the network attack situation, thereby improving data storage security; based on the above shortcomings, the present invention proposes a A network security defense system based on cloud computing.

Contents of the invention

The present invention aims to solve at least one of the technical problems existing in the prior art. To this end, the present invention proposes a network security defense system based on cloud computing.

In order to achieve the above object, according to the first embodiment of the present invention, a network security defense system based on cloud computing is proposed, including a cloud storage module, an IP verification module, a data transmission module, an attack monitoring module and a security assessment module;

When a network IP accesses the internal data of the computer, the IP verification module is used to verify the network IP; if the network IP is within the whitelist range, data access permissions are granted to users matching the network IP. ; And send identity verification information to users whose access IP matches; if the verification is passed, provide data services to users with data access rights;

The data transmission module is used to transmit external data and internal data of the computer, and send the marked internal data and external data to the data monitoring module for monitoring and management;

When external data is allowed to enter the internal environment of the computer, the external data is automatically marked as internal data; the cloud storage module is used to store the internal data through cloud storage technology; wherein the cloud storage module includes several storage devices. Block, the specific storage steps are as follows:

Obtain the remaining memory of each storage block and mark it as Ny; automatically obtain the safety deviation coefficient WX of the storage block from the cloud platform; use the formula CPy=(Ny×r1)/(WX×r2) to calculate the storage block Store the allocation value CPy, where r1 and r2 are the preset coefficient factors;

The storage block with the largest storage value CPy is selected as the selected block; the cloud storage module is used to store the received internal data in the selected block.

Further, the specific verification steps of the IP verification module include:

S1: According to the specific requirements of the computer, set the network IP and access rights allowed to access the computer, and generate a unique network access whitelist for the computer;

S2: Obtain the malicious IP group library for computer network access; analyze the time, space characteristics and maliciousness of the existing computer network access IPs, and finally generate the malicious IP group library;

S3: Assign fixed IP with data access rights to designated users;

S4: Obtain the network IP of the accessed computer and mark it as the access IP; compare and verify whether the access IP is within the whitelist range;

S5: If the accessed IP is not in the whitelist, determine whether the accessed IP has illegal intrusion into the website; that is, compare and verify whether the accessed IP is in the malicious IP library;

If the access IP is not in the malicious IP group library, access is denied; if the access IP is in the malicious IP group library, access is denied and the access IP address is queried to track the user's network service traces.

Further, the internal data is the data running in the internal environment of the computer; the external data is the data running in the external environment of the computer; when the internal data is sent to the external environment, the internal data that needs to be sent is marked; when the external data enters When entering the computer's internal environment, mark the external data that needs to enter the internal environment.

Further, when a network IP access in the malicious IP group library is detected, the data isolation module is used to isolate the computer's internal data information and generate an alarm instruction to prompt that the computer's internal data information has encountered illegal intrusion.

Further, the specific working steps of the data monitoring module are:

Extract feature data from the marked internal data and external data through the feature data extraction module, and compare and match the extracted feature data with the preset feature data pre-existing in the database, specifically as follows:

V1: Compare and match the feature data extracted from the marked internal data with the feature points of sensitive data in the internal data stored in the internal data feature database;

If there are no identical characteristics, the internal data is allowed to be sent to the external environment; if there are the same characteristics, the internal data is stopped from being sent to the external environment;

V2: Compare and match the feature data extracted from the marked external data with the feature points of the virus data in the external data stored in the external data feature database;

If there are no identical characteristics, the external data is allowed to be sent to the internal environment; if there are the same characteristics, the external data is stopped from being sent to the internal environment.

Further, the database includes an internal data feature database and an external data feature database; the internal data feature database is used to store feature points of sensitive data in internal data; and the external data feature data is used to store virus data in external data. Feature points.

Further, the attack monitoring module is connected to each storage block and is used to monitor network attacks on each storage block; when it is detected that the storage block is attacked by a network, the timing starts; when no network attack is detected again when, stop timing; the specific monitoring steps are:

The time period between the start and stop timing of statistics is the attack duration period; the duration of the attack duration period is marked as the attack duration Tc;

The number of network attacks within the statistical attack duration period is C1. Network attacks include virus attacks, email attacks, IP attacks and redundant data attacks;

The number of types of statistical network attacks is Z1; the attack value GM is calculated using the formula GM=Tc×g1+C1×g2+Z1×g3, where g1, g2, and g3 are all preset coefficient factors;

The attack monitoring module is used to fuse the attack duration period and the corresponding attack value GM to obtain network attack records, and to time-stamp the network attack records and store them in the cloud platform.

Further, the security assessment module is used to evaluate the security deviation coefficient of the storage block based on the network attack records with timestamps stored in the cloud platform, specifically as follows:

Based on the timestamp, count the network attack records of the same storage block within the preset time period;

Count the number of network attacks in the corresponding storage block as attack frequency P1, mark the attack value in each network attack record as Gi; compare Gi with the attack threshold;

The number of times Gi is greater than the attack threshold is counted as C2. When Gi is greater than the attack threshold, the difference between Gi and the attack threshold is obtained and summed to obtain the total super attack value CZ. Use the formula Cg=C2×a1+CZ×a2 to calculate the super attack value. Attack coefficient Cg, where a1 and a2 are both preset scaling factors;

The safety deviation coefficient WX of the corresponding storage block is calculated using the formula WA=P1×a3+Cg×a4, where a3 and a4 are both preset scaling factors; the safety assessment module is used to calculate the safety deviation coefficient WX of the storage block Timestamp and store to cloud platform.

Compared with the prior art, the beneficial effects of the present invention are:

1. In the present invention, when a network IP accesses the internal data of the computer, the IP verification module is used to verify the network IP; when the IP verification module detects that a malicious IP accesses the network IP in the library, the IP verification module uses the data The isolation module isolates the computer's internal data information and generates alarm instructions to prompt the computer's internal data information to encounter illegal intrusions; the data transmission module is used to transmit the computer's external data and internal data, and send the marked internal data and external data to The data monitoring module performs monitoring and management; the present invention simultaneously performs security management from the inside and outside of the computer through the data monitoring module and the IP verification module, which can avoid the leakage of important information of the computer's internal data, and can also prevent viruses from damaging the computer's internal data information. attack to achieve double protection;

2. In the present invention, when external data is allowed to enter the internal environment of the computer, the external data is automatically marked as internal data; the cloud storage module is used to store internal data through cloud storage technology; wherein the cloud storage module includes several storage areas block; obtain the remaining memory of each storage block and mark it as Ny; calculate the storage allocation value CPy of the storage block based on the safety deviation coefficient WX of the storage block, and select the storage block with the largest storage allocation value CPy as the selected block ; The cloud storage module is used to store the received internal data into the selected block; the present invention can reasonably select the corresponding storage block for data storage according to the storage status of the storage block and the network attack situation, thereby improving data storage security.

Description of the drawings

In order to explain the embodiments of the present invention or the technical solutions in the prior art more clearly, the drawings needed to be used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings in the following description are only These are some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without exerting creative efforts.

Figure 1 is a system block diagram of a cloud computing-based network security defense system of the present invention.

Detailed ways

The technical solution of the present invention will be clearly and completely described below with reference to the embodiments. Obviously, the described embodiments are only some of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts fall within the scope of protection of the present invention.

As shown in Figure 1, a network security defense system based on cloud computing includes a cloud storage module, IP verification module, data isolation module, data transmission module, feature data extraction module, data monitoring module, database, attack monitoring module, Cloud platform and security assessment module;

The cloud storage module is used to store the internal data of the computer through cloud storage technology; the internal data is the data running in the internal environment of the computer; the external data is the data running in the external environment of the computer;

When a network IP accesses the internal data of the computer, the IP verification module is used to verify the network IP. The specific verification steps include:

S1: According to the specific requirements of the computer, set the network IP and access rights allowed to access the computer, and generate a unique network access whitelist for the computer;

S2: Obtain the malicious IP group library for computer network access; analyze the time, space characteristics and maliciousness of the existing computer network access IPs, and finally generate the malicious IP group library;

S3: Assign fixed IP with data access rights to designated users;

S4: Obtain the network IP of the accessed computer and mark it as the access IP; compare and verify whether the access IP is within the whitelist range;

S41: If the access IP is within the whitelist range, grant data access permission to the user whose access IP matches;

S42: Send identity verification information to users whose access IP matches; if the verification is passed, provide data services to users with data access rights;

S5: If the accessed IP is not in the whitelist, determine whether the accessed IP has illegal intrusion into the website; that is, compare and verify whether the accessed IP is in the malicious IP library;

S51: If the access IP is not in the malicious IP group library, access is denied;

S52: If the access IP is in the malicious IP group library, access will be denied and the access IP address will be queried to track the user's network service traces;

When the IP verification module detects access to a network IP in the malicious IP group library, the data isolation module is used to isolate the computer's internal data information and generate an alarm command to prompt that the computer's internal data information has encountered illegal intrusion;

The invention improves the object-oriented security of the computer's internal data information by strictly restricting the authority requirements for acquiring the internal data information of the computer. Cooperating with the active isolation function of the data isolation module, it can effectively prevent the theft of the computer's internal data information and ensure the data information. In addition, by tracking the IP addresses of suspicious users, users who steal computer internal data information can be pursued, providing a safe operating environment for data information;

The data transmission module is used to transmit external data and internal data of the computer; specifically includes:

When internal data is sent to the external environment, the internal data that needs to be sent is marked; when external data enters the internal environment of the computer, the external data that needs to enter the internal environment is marked;

The data transmission module is used to send the marked internal data and external data to the data monitoring module for monitoring and management. The specific working steps are:

Extract feature data from the marked internal data and external data through the feature data extraction module;

Compare and match the extracted feature data with the preset feature data stored in the database, specifically as follows:

V1: Compare and match the feature data extracted from the marked internal data with the feature points of sensitive data in the internal data stored in the internal data feature database;

If there are no identical characteristics, the internal data is allowed to be sent to the external environment; if there are the same characteristics, the internal data is stopped from being sent to the external environment;

V2: Compare and match the feature data extracted from the marked external data with the feature points of the virus data in the external data stored in the external data feature database;

If there are no identical characteristics, the external data is allowed to be sent to the internal environment; if there are the same characteristics, the external data is stopped from being sent to the internal environment;

The database includes an internal data feature database and an external data feature database; the internal data feature database is used to store feature points of sensitive data in internal data; the external data feature data is used to store feature points of virus data in external data;

The present invention simultaneously performs security management from the inside and outside of the computer through the data monitoring module and the IP verification module, which can avoid the leakage of important information of the computer's internal data, and can also prevent viruses from attacking the computer's internal data information to achieve double protection;

When external data is allowed to enter the internal environment of the computer, the external data is automatically marked as internal data; the cloud storage module is used to store internal data through cloud storage technology; among them, the cloud storage module includes several storage blocks, and the specific storage steps as follows:

Obtain the remaining memory of each storage block and mark it as Ny; automatically obtain the safety deviation coefficient WX of the storage block from the cloud platform; use the formula CPy=(Ny×r1)/(WX×r2) to calculate the storage block Store the allocation value CPy, where r1 and r2 are the preset coefficient factors;

The storage block with the largest storage value CPy is selected as the selected block; the cloud storage module is used to store the received internal data in the selected block; the present invention can reasonably select the corresponding storage block according to the storage status and network attack situation. Storage blocks are used for data storage, thereby improving data storage security;

The attack monitoring module is connected to each storage block and is used to monitor network attacks on each storage block; when it is detected that the storage block is under network attack, the timing starts; when no network attack is detected again, the timing is stopped; The specific monitoring steps are:

The time period between the start and stop timing of statistics is the attack duration period; the duration of the attack duration period is marked as the attack duration Tc;

The number of network attacks within the statistical attack duration period is C1. Network attacks include virus attacks, email attacks, IP attacks, and redundant data attacks, etc.;

The number of types of statistical network attacks is Z1; the attack value GM is calculated using the formula GM=Tc×g1+C1×g2+Z1×g3, where g1, g2, and g3 are all preset coefficient factors;

The attack monitoring module is used to fuse the attack duration period and the corresponding attack value GM to obtain network attack records and time-stamp the network attack records and store them in the cloud platform;

The security assessment module is connected to the cloud platform and is used to evaluate the security deviation coefficient of storage blocks based on the network attack records with timestamps stored in the cloud platform, specifically as follows:

Based on the timestamp, count the network attack records of the same storage block within the preset time period;

Count the number of network attacks in the corresponding storage block as attack frequency P1, mark the attack value in each network attack record as Gi; compare Gi with the attack threshold;

The number of times Gi is greater than the attack threshold is counted as C2. When Gi is greater than the attack threshold, the difference between Gi and the attack threshold is obtained and summed to obtain the total super attack value CZ. Use the formula Cg=C2×a1+CZ×a2 to calculate the super attack value. Attack coefficient Cg, where a1 and a2 are both preset scaling factors;

The safety deviation coefficient WX of the corresponding storage block is calculated using the formula WA=P1×a3+Cg×a4, where a3 and a4 are both preset scaling factors; the safety assessment module is used to time the safety deviation coefficient WX of the storage block Click and save to the cloud platform.

The above formulas are all numerical calculations after removing the dimensions. The formula is a formula closest to the real situation obtained by collecting a large amount of data for software simulation. The preset parameters and preset thresholds in the formula are set by those skilled in the field according to the actual situation. Or obtain a large amount of data through simulation.

Working principle of the invention:

A network security defense system based on cloud computing. When working, when a network IP accesses the internal data of the computer, the IP verification module is used to verify the network IP; when the IP verification module detects a malicious IP group When the network IP in the library is accessed, the data isolation module is used to isolate the computer's internal data information and generate alarm instructions to prompt the computer's internal data information to encounter illegal intrusions; the data transmission module is used to transmit the computer's external data and internal data, and Send the marked internal data and external data to the data monitoring module for monitoring and management; extract the feature data from the marked internal data and external data through the feature data extraction module; compare the extracted feature data with the presets pre-existing in the database The characteristic data is compared and matched; if there are no identical characteristics, transmission is allowed; if there are identical characteristics, data transmission is suspended; the present invention uses a data monitoring module and an IP verification module to simultaneously perform security management from the inside and outside of the computer, which can avoid computer Important information of internal data is leaked, and it can also prevent viruses from attacking the internal data information of the computer to achieve double protection;

When external data is allowed to enter the internal environment of the computer, the external data is automatically marked as internal data; the cloud storage module is used to store internal data through cloud storage technology; among them, the cloud storage module includes several storage blocks; obtain each The remaining memory of the storage block is marked as Ny; the storage allocation value CPy of the storage block is calculated based on the safety deviation coefficient WX of the storage block, and the storage block with the largest storage allocation value CPy is selected as the selected block; the cloud storage module uses In order to store the received internal data in the selected block, the present invention can reasonably select the corresponding storage block for data storage according to the storage status of the storage block and the network attack situation, thereby improving data storage security.

In the description of this specification, reference to the terms "one embodiment," "example," "specific example," etc., means that a particular feature, structure, material, or characteristic described in connection with the embodiment or example is included in at least one aspect of the invention. in an embodiment or example. In this specification, schematic representations of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials or characteristics described may be combined in any suitable manner in any one or more embodiments or examples.

The preferred embodiments of the invention disclosed above are only intended to help illustrate the invention. The preferred embodiments do not describe all details, nor do they limit the invention to specific implementations. Obviously, many modifications and variations are possible in light of the contents of this specification. These embodiments are selected and described in detail in this specification to better explain the principles and practical applications of the present invention, so that those skilled in the art can better understand and utilize the present invention. The invention is limited only by the claims and their full scope and equivalents.

Claims (8)

1. A network security defense system based on cloud computing, characterized by including a cloud storage module, an IP verification module, a data transmission module, an attack monitoring module and a security assessment module; When a network IP accesses the internal data of the computer, the IP verification module is used to verify the network IP; if the network IP is within the whitelist range, data access permissions are granted to users matching the network IP. ; And send identity verification information to users whose access IP matches; if the verification is passed, provide data services to users with data access rights; The data transmission module is used to transmit external data and internal data of the computer, and send the marked internal data and external data to the data monitoring module for monitoring and management; When external data is allowed to enter the internal environment of the computer, the external data is automatically marked as internal data; the cloud storage module is used to store the internal data through cloud storage technology; wherein the cloud storage module includes several storage devices. Block, the specific storage steps are as follows: Obtain the remaining memory of each storage block and mark it as Ny; automatically obtain the safety deviation coefficient WX of the storage block from the cloud platform; use the formula CPy=(Ny×r1)/(WX×r2) to calculate the storage block Store the allocation value CPy, where r1 and r2 are the preset coefficient factors; The storage block with the largest storage value CPy is selected as the selected block; the cloud storage module is used to store the received internal data in the selected block. 2. A network security defense system based on cloud computing according to claim 1, characterized in that the specific verification steps of the IP verification module include: S1: According to the specific requirements of the computer, set the network IP and access rights allowed to access the computer, and generate a unique network access whitelist for the computer; S2: Obtain the malicious IP group library for computer network access; analyze the time, space characteristics and maliciousness of the existing computer network access IPs, and finally generate the malicious IP group library; S3: Assign fixed IP with data access rights to designated users; S4: Obtain the network IP of the accessed computer and mark it as the access IP; compare and verify whether the access IP is within the whitelist range; S5: If the accessed IP is not in the whitelist, determine whether the accessed IP has illegal intrusion into the website; that is, compare and verify whether the accessed IP is in the malicious IP library; If the access IP is not in the malicious IP group library, access is denied; if the access IP is in the malicious IP group library, access is denied and the access IP address is queried to track the user's network service traces. 3. A network security defense system based on cloud computing according to claim 1, characterized in that the internal data is data running in the internal environment of the computer; the external data is data running in the external environment of the computer; when the internal data is transmitted to When the external environment sends, the internal data that needs to be sent is marked; when the external data enters the internal environment of the computer, the external data that needs to enter the internal environment is marked. 4. A network security defense system based on cloud computing according to claim 2, characterized in that when a network IP access in a malicious IP group library is detected, the data isolation module is used to isolate the internal data information of the computer and Generate alarm instructions to prompt the computer's internal data information to be illegally intruded. 5. A network security defense system based on cloud computing according to claim 3, characterized in that the specific working steps of the data monitoring module are: Extract feature data from the marked internal data and external data through the feature data extraction module; compare and match the extracted feature data with the preset feature data pre-existing in the database, specifically as follows: V1: Compare and match the feature data extracted from the marked internal data with the feature points of sensitive data in the internal data stored in the internal data feature database; If there are no identical characteristics, the internal data is allowed to be sent to the external environment; if there are the same characteristics, the internal data is stopped from being sent to the external environment; V2: Compare and match the feature data extracted from the marked external data with the feature points of the virus data in the external data stored in the external data feature database; If there are no identical characteristics, the external data is allowed to be sent to the internal environment; if there are the same characteristics, the external data is stopped from being sent to the internal environment. 6. A network security defense system based on cloud computing according to claim 5, characterized in that the database includes an internal data feature database and an external data feature database; the internal data feature database is used to store internal data. Feature points of sensitive data; the external data feature data is used to store feature points of virus data in external data. 7. A network security defense system based on cloud computing according to claim 1, characterized in that the attack monitoring module is connected to each storage block and is used to monitor network attacks on each storage block; when When it is detected that the storage block is under network attack, the timing starts; when no network attack is detected again, the timing is stopped; the specific monitoring steps are: The time period between the start and stop timing of statistics is the attack duration period; the duration of the attack duration period is marked as the attack duration Tc; The number of network attacks within the statistical attack duration period is C1. Network attacks include virus attacks, email attacks, IP attacks and redundant data attacks; The number of types of statistical network attacks is Z1; the attack value GM is calculated using the formula GM=Tc×g1+C1×g2+Z1×g3, where g1, g2, and g3 are all preset coefficient factors; The attack monitoring module is used to fuse the attack duration period and the corresponding attack value GM to obtain network attack records, and to time-stamp the network attack records and store them in the cloud platform. 8. A network security defense system based on cloud computing according to claim 7, characterized in that the security assessment module is connected to the cloud platform and is used to perform network attacks based on time stamps stored in the cloud platform. Record the safety deviation coefficient assessment of the storage block, specifically: Based on the timestamp, count the network attack records of the same storage block within the preset time period; Count the number of network attacks in the corresponding storage block as attack frequency P1, mark the attack value in each network attack record as Gi; compare Gi with the attack threshold; The number of times Gi is greater than the attack threshold is counted as C2. When Gi is greater than the attack threshold, the difference between Gi and the attack threshold is obtained and summed to obtain the total super attack value CZ. Use the formula Cg=C2×a1+CZ×a2 to calculate the super attack value. Attack coefficient Cg, where a1 and a2 are both preset scaling factors; The safety deviation coefficient WX of the corresponding storage block is calculated using the formula WA=P1×a3+Cg×a4, where a3 and a4 are both preset scaling factors; the safety assessment module is used to calculate the safety deviation coefficient WX of the storage block Timestamp and store to cloud platform.