Data collection and analysis method and system for graded protection evaluation based on offline form

Abstract

The invention relates to a method and system for collecting, analyzing, and evaluating data for graded protection based on an offline form, belonging to the technical field of data processing for graded protection of network security. And fill in the report; based on the application knowledge base, the collected data is verified, parsed, and cleaned, and then the structured data retrieval engine is nested; the structured data is calculated and analyzed, and the security recommendations are matched according to the risk points; the construction of the report ontology database is completed, based on Elements such as report master and attribute index call the base block library to generate reports. The invention aims at improving the operational efficiency of the assessment and evaluation of the guarantee, quantifying the results of risk analysis, reducing the intervention of manual judgment, and avoiding the leakage of distributed data. Informatization support means to ensure the work before and after the evaluation.

Description

technical field [0001] The invention relates to the technical field of network security graded protection data processing, and aims to provide an offline form-based graded protection evaluation data collection and analysis method and system. Background technique [0002] On June 1, 2017, the "Internet Security Law of the People's Republic of China" was officially implemented, and the hierarchical protection work has now embarked on the process of legalization. In this context, Graded Protection 2.0 came into being, and on May 13, 2019, the State Administration for Market Regulation and the National Standardization Administration officially issued the "Basic Requirements for Graded Protection of Information Security Technology Network Security" (GB / T 22239-2019) and other national standards, marking the country's entry into the 2.0 era of information security technology and network security protection. [0003] On the basis of 1.0, Level Protection 2.0 pays more attention t...

AI Technical Summary

Problems solved by technology

Under the MLPS 2.0 evaluation index system, the index composition is more diverse, the evaluation objects cover a wider range, and the evaluation report is more closely related, which increases the complexity of the evaluation work and evaluation data analysis process

[0004] In response to this situation, some institutions use Excel calculation tables or commercial evaluation tools to carry out equal guarantee evaluation work and evaluation data analysis work; however, the current existing technical means have the following problems: (1) The import function of offline electronic forms is not supported, The data collected offline must be entered manually, which reduces the efficiency of the overall evaluation work; (2) Risk analysis model is not adopted, the risk level is based on human subjective decision-making, and the subjective intervention of personnel is too strong, which affects the accuracy of risk analysis and evaluation quality; (3) The data collected offline is distributed on different PCs. Considering that people are the weakest link in network security, sensitive data is prone to the risk of information leakage; (4) The data summary analysis is completed by the report compilers, and the statistical analysis results are relatively one-sided , which is not conducive to comprehensive analysis of the industry's network security situation; (5) Commercial evaluation tools must install a set of client and database on each PC, and each PC needs to be paid and authorized before it can be used, which increases the high cost of the enterprise ;(6) For the method of using Excel to calculate the form, the accuracy of the calculation result depends on the logical judgment of the personnel, resulting in the fluctuation of the final calculation result and risk judgment

Images