A network security management system which manages an object node belonging to an intranet, the network security management system comprising:
- an information collecting device configured to collect node information of each object node which is transmitted when each object node performs a login operation, the node information including domain information, computer name information and account information;
- a type determining device which is in signal connection with the information collecting device, the type determining device being configured to perform a comparison between the node information received by the information collection device and a node management list to determine a node type belonging to each object node that performs the login operation in the network security management system, wherein the node management list is with permission domain information, permission computer name information and permission account information respectively corresponding to each node type, and the comparison between the node information and the node management list is performed by respectively comparing the node information to the permission domain information, the node information to the permission computer name information and the node information to the permission account information to obtain a compared result so as to determine the node type of the object node as the node type of the object node is found in the node management list, or to determine the object node of the object is not in the node management list as the object node is not found with any corresponding node type in the node management list;
- an event management device which is in signal connection with the type determining device, the event management device being configured to determine a login event of the object node based on the compared result from the type determining device so as to perform a corresponding management operation to the object node, wherein the management operation includes an operation to decide whether the object node has an operating privilege, or to give to the object node the operating privilege corresponding to the node type of the object node;
- and
- a computer identifying device which is in signal connection with the event management device, the computer identifying device being configured to:
- inquiry the object node in the node management list by a management regulation to obtain a universally unique identifier data of the object node;
- save a computer identifying information on a basis of the universally unique identifier data;
- and
- compare the computer identifying information with a previously saved computer identifying information to determine whether the computer identifying information matches the previously saved computer identifying information;
- wherein, in response to the computer identifying information not matching the previously saved computer identifying information, the event management device:
- determines that a computer hardware associated with the object node has been changed manually;
- determines the event as an anomalous computer fake event;
- and
- informs that real-time supervision should be performed.