The invention relates to the technical field of
network security, in particular to a
network security digital substitute protection method and
system, and the method comprises the following steps: monitoring and recording network activities in real
time based on a
data stream from a railway network, including an
equipment state and communication abnormity, analyzing normal and abnormal
network behavior modes through employing an LSTM network, extracting behavior characteristics, and carrying out the protection of the
network security digital substitute. And establishing a network virtual copy. According to the invention, by monitoring the data flow of the railway network in real time and recording the
equipment state and the communication abnormity, the network security dynamic state is effectively captured, the instant response capability to the abnormal behavior is improved, the LSTM network is utilized to analyze and extract the behavior characteristics of the
complex network, the analysis of the complex data mode is enhanced, the efficient identification of unknown threats is ensured, and the security of the network is improved. Through the automatic behavior deviation identification configuration and the
emergency response instruction set, potential threats can be quickly and accurately handled, the probability of network security accidents is reduced, efficient risk management is realized, and the security performance of a railway network is greatly improved.