A method for real-time detection of cyberspace security situation

Abstract

The invention discloses a cyberspace security situation real-time detection method. The method comprises the following steps: original characteristic extraction that original network data packet characteristics are obtained from a network, multi-scale entropy calculations that sample entropy of an original data packet characteristic sequence is calculated at different time scales, detector training that a mature immunization detector is trained and generated by utilizing a sample entropy characteristic vector and a negative-selection algorithm at the different time scales, network threat security detection that a network sample is detected by utilizing the trained mature immunization detector at the different time scales, cyberspace security situation calculations that cyberspace security situations at the different time scales and different network layers, and situation visualization that the cyberspace security situations are expressed by different colors of curve charts at different time and the different network layers. The time scales considered in the method is relatively comprehensive, the fusion level is high, a situation assessment result is relatively accurate, a complex characteristics of a network behavior can be described, and the whole process of a network threat behavior can be carved in a fine-grained manner.

Description

technical field [0001] The invention relates to the technical field of information security, in particular to a method for real-time detection of cyberspace security situation. Background technique [0002] With the continuous development of the scale and application fields of the Internet, its basic and overall status is gradually enhanced. At the same time, cyber attacks and destructive behaviors are increasing day by day, and they are gradually showing the characteristics of strict organization, profit-oriented behavior and direct target. However, the existing network security protection mainly relies on single-point security devices such as virus detection, intrusion detection, and firewalls. Due to the lack of effective cooperation among them, the effectiveness of various security devices cannot be fully utilized. Network security issues have become an issue that affects the Internet and The main problems in the development of various applications. Cyberspace Security...

AI Technical Summary

Problems solved by technology

According to the information entropy theory, if there are abnormal behaviors in the sample sequence, the randomness of the sequence will be reduced, resulting in a decrease in the sample entropy that measures the complexity of the structure. Complexity characteristics, overcome the problem of inaccurate network behavior analysis under a single space-time scale

Images