Network security situation analysis method and system

Abstract

The invention relates to a network security situation analysis method and system, and the method comprises the steps: A, carrying out the SQL injection detection: obtaining a corresponding word vectoraccording to the condition whether a part with an SQL injection attack exists in a domain name, and building a model for detecting the SQL injection attack; B, DGA malicious domain name detection: extracting feature vectors in a domain name to obtain a training model, and performing cross validation on the training model to obtain precision and recall rate; C, detecting malicious scripts: detecting whether a malicious code exists in the webpage script or not through a training model; D, assessing network security situation: assessing the total situation value of all the hosts according to thesecurity level; E, predicting network security situation: outputting prediction results through an LSTM layer and a Bi-LSTM layer and three fully connected layers. The accuracy of network security situation analysis can be obviously improved, different types of network security can be tested and analyzed from multiple angles, and the comprehensiveness of network security situation analysis and prediction is effectively improved.

Description

technical field [0001] The invention relates to a method and system for network security situation analysis. Background technique [0002] Network security situational awareness was first proposed by Tim Bass in 1999. He pointed out that "the next-generation network intrusion detection system should integrate data collected from a large number of heterogeneous distributed network sensors to realize cyberspace situational awareness (Cyberspacesituational awareness)". Network security situational awareness is to extract those security factors that may affect changes in the network security situation in a specific network environment, and analyze and visualize the extracted security factor information to predict possible development trends. Network security situational awareness is a macro concept, which emphasizes the overall status and overall development trend of a network environment. It uses data fusion technology to fuse various available security factors information to...

AI Technical Summary

Problems solved by technology

For general security information, the scale is huge, and these massive data may be mixed with a lot of false positive information.

In addition, the threat information that really affects the current network security situation is likely to be submerged in the massive information and difficult to identify, and it is impossible to determine specific security threats

Images