A network security protection method based on big data

Abstract

The present invention relates to the field of network security technology, and in particular to a network security protection method based on big data. The method comprises the following steps: obtaining original network traffic data through a data pipeline tool; dividing the original network traffic data into time windows to obtain time window traffic data; performing clustering feature description analysis based on the time window traffic data to obtain a traffic clustering label model; generating a normal traffic baseline model based on the traffic clustering label model and the time window traffic data to obtain a normal traffic baseline model. The present invention can continuously improve the security protection capability of the defense system and build a more secure and reliable network environment by continuously evaluating the performance of the defense system, analyzing the root causes of problems, and optimizing and iterating the defense system; it solves the shortcomings of traditional methods when attackers use big data technology to attack, and improves the overall intelligence level of the defense system and its ability to resist big data attacks.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network security protection method based on big data. Background Art

[0002] With the rapid development of new technologies such as big data and artificial intelligence, the field of network security has also undergone profound changes. On the one hand, big data technology has brought new opportunities for network security protection, enabling us to mine valuable security information from massive network data and achieve more intelligent, accurate and efficient security defense. But on the other hand, big data technology has also been used by attackers, making network attacks more hidden and difficult to prevent. A traditional network security protection method based on big data has shortcomings in that attackers use big data technology to attack. Attackers will use big data technology to analyze the weaknesses of the defense system and attack in a targeted manner. For example, attackers will collect a large amount of normal network traffic data and use machine learning models to generate malicious traffic similar to normal traffic, thereby bypassing the traditional network security protection system based on big data. Summary of the invention

[0003] Based on this, it is necessary to provide a network security protection method based on big data to solve at least one of the above technical problems.

[0004] To achieve the above purpose, a network security protection method based on big data includes the following steps:

[0005] Step S1: Obtain original network traffic data through a data pipeline tool; divide the original network traffic data into time windows to obtain time window traffic data; perform clustering feature description analysis on the time window traffic data to obtain a traffic clustering label model; generate a normal traffic baseline model based on the traffic clustering label model and the time window traffic data to obtain a normal traffic baseline model;

[0006] Step S2: collect real-time traffic from network devices to obtain real-time traffic data streams; use a normal traffic baseline model to perform an abnormal probability distribution analysis on the real-time feature stream to obtain a real-time abnormal feature stream; obtain an abnormal score for historical traffic data; calculate a baseline confidence interval based on the abnormal score for historical traffic data to obtain a baseline confidence interval; perform an adaptive confidence interval adjustment based on the baseline confidence interval and the real-time abnormal feature stream to obtain an adaptive confidence interval; perform abnormal traffic marking on the real-time abnormal feature stream based on the adaptive confidence interval to obtain abnormal traffic marking data;

[0007] Step S3: infer attack intentions based on abnormal traffic mark data to obtain preliminary attack intention data; perform intelligence correlation analysis based on the preliminary attack intention data to obtain attack intention supporting data; modify the preliminary attack intention data based on the attack intention supporting data and enhance the intention to obtain attack intention enhanced data; generate a visual attack report based on the attack intention enhanced data to obtain a visual attack analysis report;

[0008] Step S4: Retrieve defense strategies according to the visualized attack analysis report to obtain a candidate defense strategy set; monitor the defense effect of the real-time traffic data flow according to the visualized attack analysis report and the candidate defense strategy set to obtain defense effect monitoring data; dynamically adjust the defense strategy according to the visualized attack analysis report and the defense effect monitoring data to obtain a dynamic defense strategy;

[0009] Step S5: Evaluate the performance of the defense system according to the dynamic defense strategy and the visualized attack analysis report to obtain a defense system performance evaluation report; perform root cause analysis according to the defense system performance evaluation report to obtain a root cause analysis report; generate a three-layer defense system optimization plan according to the root cause analysis report and perform a three-layer defense system update process to achieve network security protection.

[0010] The present invention constructs an accurate normal traffic baseline model by analyzing historical traffic data, can effectively distinguish normal and abnormal network behaviors, provide a reliable basis for subsequent anomaly detection, reduce the false alarm rate, and improve the accuracy of security protection. Real-time collection of network traffic data, and combined with the baseline model and adaptive confidence interval for anomaly detection, can timely discover traffic that deviates from the normal mode, improve the accuracy and timeliness of anomaly detection, and provide candidate targets for attack tracing. Through means such as association analysis, attack map construction, and intelligence association analysis, the behavior patterns and intentions of attackers can be deeply excavated to form comprehensive and accurate attack analysis results, providing support for the response and decision-making of security incidents. According to the attack analysis results, the defense strategy is dynamically adjusted, and the defense effect is monitored in real time, which can effectively respond to the ever-changing network attack means, improve the flexibility and adaptability of the defense system, and achieve more intelligent security defense. By continuously evaluating the performance of the defense system, analyzing the root cause of the problem, and optimizing iterative optimization, the security protection capability of the defense system can be continuously improved, and a more secure and reliable network environment can be built. Through the three-layer defense structure, big data technology is used to perform traffic clustering and anomaly identification in the border defense layer (step S1), big data technology is used to perform anomaly detection and attack tracing in the active defense layer (step S2-step S3), and dynamic defense strategy adjustment and continuous defense optimization based on big data are performed in the adaptive defense layer (step S4-step S5), which effectively solves the problem of attackers using big data technology to carry out covert attacks and evade traditional defenses, and realizes the accurate discovery and tracing of unknown threats and complex attacks. Therefore, the present invention provides a network security protection method based on big data. It solves the shortcomings of a traditional network security protection method based on big data when attackers use big data technology to attack, and improves the overall intelligence level of the defense system and the ability to resist big data attacks.

[0011] Preferably, step S1 comprises the following steps:

[0012] Step S11: obtaining original network traffic data through a data pipeline tool; dividing the original network traffic data into time windows to obtain time window traffic data; performing clustering feature description analysis on the time window traffic data to obtain a traffic clustering label model;

[0013] Step S12: using the traffic clustering label model to score the abnormal behavior of the time window traffic data to obtain the time window abnormality score;

[0014] Step S13: performing abnormal flow judgment on the time window flow data according to the time window abnormal score and a preset abnormal score threshold to obtain abnormal flow judgment data;

[0015] Step S14: fitting a probability distribution model according to the abnormal flow judgment data and defining a normal flow range according to a preset confidence interval to obtain normal flow range data;

[0016] Step S15: Generate a normal traffic baseline model based on the normal traffic range data to obtain a normal traffic baseline model.

[0017] The present invention efficiently obtains raw traffic data from network devices through data pipeline tools, and divides it according to time windows, providing a structured data basis for subsequent feature analysis and model building, and improving data processing efficiency. By using the traffic clustering label model to score abnormal behavior of traffic data in the time window, it is possible to effectively identify traffic that deviates from the normal mode, provide a quantitative basis for subsequent abnormal traffic judgment, and improve the accuracy of abnormal detection. By comparing the time window abnormal score with the preset threshold, it is possible to quickly determine whether the traffic data in each time window is abnormal, achieve preliminary screening of abnormal traffic, reduce the pressure of subsequent analysis and processing, and improve detection efficiency. By fitting the probability distribution model of normal traffic data and determining the normal traffic range according to the preset confidence interval, the characteristic distribution of normal traffic can be more accurately described, providing a reliable basis for the construction of subsequent baseline models, and reducing the false alarm rate. According to the normal traffic range data, a more accurate normal traffic baseline model can be constructed to distinguish normal and abnormal traffic, improve the accuracy and reliability of subsequent abnormal detection, and provide effective support for network security protection.

[0018] Preferably, step S11 includes the following steps:

[0019] Step S111: Aggregate the original data of the network device through the data pipeline tool to obtain the original network flow data; perform flow data preprocessing on the original network flow data to obtain preprocessed flow data;

[0020] Step S112: Reconstruct the session according to the pre-processed traffic data to obtain session data; divide the time window according to the session data to obtain time window traffic data;

[0021] Step S113: extracting features and performing feature selection on the time window traffic data to obtain a feature vector data set; performing traffic clustering analysis and modeling on the feature vector data set to obtain a traffic clustering model;

[0022] Step S114: Perform clustering feature description analysis based on the traffic clustering model and the feature vector data set to obtain a traffic clustering label model.

[0023] The present invention can efficiently aggregate raw traffic data from multiple network devices through data pipeline tools, and perform preprocessing operations such as data cleaning, deduplication, format conversion, etc., eliminate data noise and redundant information, and improve the efficiency and accuracy of subsequent analysis. Through session reconstruction, scattered data packets are restored to complete network communication sessions, which helps to understand network behavior more comprehensively; and time window division divides continuous session data into multiple time segments, which is convenient for analysis and comparison in the time dimension and improves the sensitivity of anomaly detection. By extracting features from time window traffic data, the raw data can be converted into more abstract and representative feature vectors for subsequent analysis; and feature selection can screen out features with higher contribution to traffic clustering analysis, reduce data dimensions, and improve model training efficiency and generalization ability. By analyzing the traffic clustering model and feature vector data set, the traffic characteristics of each cluster cluster can be deeply understood, the network behavior pattern represented by it can be identified, and a more accurate classification basis can be provided for subsequent anomaly detection and attack tracing, thereby improving the pertinence and effectiveness of security protection.

[0024] Preferably, step S2 comprises the following steps:

[0025] Step S21: collect real-time traffic of network devices through a data pipeline tool to obtain a real-time traffic data stream; extract streaming features from the real-time traffic data stream to obtain a real-time feature stream;

[0026] Step S22: using the normal traffic baseline model to calculate the degree of deviation of the real-time traffic behavior and perform abnormal probability distribution analysis on the real-time feature flow to obtain the real-time abnormal feature flow;

[0027] Step S23: Obtain anomaly scores of historical traffic data; perform baseline confidence interval calculation based on anomaly scores of historical traffic data to obtain a baseline confidence interval; perform adaptive confidence interval adjustment based on the baseline confidence interval and the real-time abnormal feature flow to obtain an adaptive confidence interval;

[0028] Step S24: performing time series analysis on the real-time abnormal feature flow according to the adaptive confidence interval and marking the abnormal pattern to obtain abnormal pattern marking data;

[0029] Step S25: performing abnormal event aggregation on the abnormal pattern marking data to obtain an abnormal event list; performing abnormal event classification on the abnormal event list and performing abnormal traffic marking to obtain abnormal traffic marking data.

[0030] The present invention collects network traffic data in real time through a data pipeline tool and performs streaming feature extraction, which can timely capture the changing trend of network traffic, provide real-time data support for subsequent anomaly detection, and improve the timeliness of security protection. Using the normal traffic baseline model to perform abnormal probability distribution analysis on the real-time feature flow, it can effectively identify the real-time traffic that deviates from the normal mode, provide candidate targets for subsequent attack tracing, and improve the efficiency of security incident discovery. By analyzing the abnormal scores of historical traffic data, calculating the baseline confidence interval, and adaptively adjusting according to the real-time abnormal feature flow, it can better adapt to the dynamic changes of network traffic, improve the accuracy and robustness of anomaly detection, and reduce false positives and missed reports. Based on the adaptive confidence interval, the real-time abnormal feature flow is analyzed in time series, and the abnormal pattern library is used for matching or clustering analysis, which can identify potential attack patterns, provide important clues for subsequent attack intention inference, and improve the accuracy of attack identification. By aggregating abnormal pattern labeling data with similar characteristics into abnormal events and classifying them, it is possible to associate scattered abnormal behaviors to form a more complete view of attack events, provide richer information for subsequent attack tracing and defense strategy formulation, and improve the efficiency of handling security incidents.

[0031] Preferably, step S23 includes the following steps:

[0032] Step S231: Obtain anomaly scores of historical traffic data; construct anomaly score time series for the anomaly scores of historical traffic data to obtain anomaly score time series;

[0033] Step S232: performing time series smoothing processing on the anomaly score time series to obtain an anomaly score smoothed time series;

[0034] Step S233: performing time series decomposition on the abnormal score smoothed time series to obtain time series decomposition data, wherein the time series decomposition data includes trend component data, seasonal component data and residual component data;

[0035] Step S234: Calculate the baseline confidence interval based on the trend component data and the seasonal component data to obtain the baseline confidence interval;

[0036] Step S235: performing random fluctuation analysis of residual components of real-time flow according to residual component data and real-time abnormal characteristic flow to obtain random fluctuation data of residual components;

[0037] Step S236: performing adaptive confidence interval adjustment according to the baseline confidence interval, the residual component random fluctuation data and the preset adjustment parameters to obtain an adaptive confidence interval.

[0038] The present invention constructs the anomaly score of historical traffic data into a time series, which can intuitively show the trend of the anomaly score changing over time, and provide a basis for subsequent analysis and prediction. By smoothing the anomaly score time series, the interference of random fluctuations on trend judgment can be eliminated, so that the time series can more clearly reflect the long-term change law of the anomaly score, and improve the accuracy of subsequent analysis. The smoothed anomaly score time series is decomposed into trend components, seasonal components and residual components, and the abnormal fluctuation laws on different time scales can be studied respectively, providing a basis for building a more accurate baseline confidence interval. According to the trend component and seasonal component data, the fluctuation range of the anomaly score in the future can be predicted, and a baseline confidence interval can be constructed to provide a reference for judging whether the real-time traffic is abnormal. By analyzing the residual component of real-time traffic, the random fluctuation situation after eliminating trend and seasonal factors can be captured, and the abnormal degree of current network traffic can be more sensitively reflected. Combined with the random fluctuation situation of the baseline confidence interval and the residual component of real-time traffic, the confidence interval is adaptively adjusted, which can better adapt to the dynamic changes of network traffic, improve the accuracy and timeliness of anomaly detection, and reduce false positives and false negatives.

[0039] Preferably, step S3 comprises the following steps:

[0040] Step S31: performing abnormal event correlation according to the abnormal traffic mark data to obtain abnormal event correlation data; constructing an attack graph for the abnormal event correlation data to obtain an attack graph;

[0041] Step S32: performing attack pattern matching on the attack graph and the preset attack pattern library to obtain matching attack pattern data; performing attack intention inference based on the matching attack pattern data to obtain preliminary attack intention data;

[0042] Step S33: performing intelligence correlation analysis based on the preliminary attack intention data to obtain attack intention supporting data; performing attack intention correction and intention enhancement on the preliminary attack intention data based on the attack intention supporting data to obtain attack intention enhanced data;

[0043] Step S34: performing attack target identification according to the attack intention enhancement data to obtain attack target data; performing impact range assessment according to the attack target data to obtain potential impact range data;

[0044] Step S35: Perform risk level assessment based on the attack intention enhancement data, the attack target data, and the potential impact range data to obtain attack event risk level data;

[0045] Step S36: Generate a visualized attack report based on the attack event risk level data, attack target data, attack target data, potential impact range data, and attack intention enhancement data to obtain a visualized attack analysis report.

[0046] The present invention integrates discrete abnormal traffic tag data into a more complete attack event through association analysis, and constructs an attack map, which can intuitively display the correlation between attack behaviors, help to more comprehensively understand the attack process, and improve the efficiency of security event analysis. Matching the attack map with the known attack pattern library can quickly identify the attack techniques and tactics used by the attacker, and infer the attacker's initial intention based on the matched attack pattern, providing direction guidance for subsequent in-depth analysis. By correlating the initial attack intention with external threat intelligence, more abundant attacker background information, attack tool details, etc. can be obtained, thereby verifying, correcting and enhancing the initial attack intention, and forming a more accurate and comprehensive attack intention judgment. According to the enhanced attack intention information, combined with the contextual information of the attack event, the attacker's ultimate goal can be more accurately identified, and the impact range caused by the successful attack can be evaluated, providing a basis for formulating a more targeted defense strategy. According to factors such as attack intention, attack target, and potential impact range, the risk level of the attack event is evaluated, which can help quickly determine the degree of harm of the attack event, give priority to high-risk security events, and improve the efficiency of security event response. By presenting key information of attack events, including attack intent, attack path, attack target, risk level, etc., in a visual way, we can understand attack events more intuitively and quickly, and improve the efficiency of handling and communicating security incidents.

[0047] Preferably, step S33 includes the following steps:

[0048] Step S331: Identify the intelligence requirements of the preliminary attack intention data to obtain a threat intelligence requirement list;

[0049] Step S332: performing a multi-source intelligence search on a preset threat intelligence database according to the threat intelligence requirement list to obtain a candidate threat intelligence set;

[0050] Step S333: performing intelligence credibility evaluation on the candidate threat intelligence set to obtain a threat intelligence credibility score set;

[0051] Step S334: performing intelligence correlation analysis on the preliminary attack intention data and the threat intelligence credibility score set to obtain attack intention supporting data;

[0052] Step S335: modify the initial attack intention data according to the attack intention supporting data and enhance the intention to obtain attack intention enhanced data.

[0053] The present invention analyzes the preliminary attack intention data, clarifies what intelligence information needs to be further obtained to corroborate or overturn the preliminary judgment, and forms a structured threat intelligence demand list, which can improve the pertinence and efficiency of subsequent intelligence retrieval and avoid blindly collecting invalid information. According to the threat intelligence demand list, relevant information can be retrieved from multiple threat intelligence databases to collect more comprehensive intelligence data, avoid information islands, and improve the integrity and accuracy of intelligence analysis. The credibility assessment of the candidate threat intelligence set can effectively identify low-quality information such as false intelligence and outdated intelligence, improve the reliability of intelligence analysis, and avoid interference from misleading information. The preliminary attack intention data and the threat intelligence after credibility assessment are associated and analyzed, and the association relationship hidden between different data sources can be discovered, and deeper attack clues can be excavated, providing a more sufficient basis for the correction and enhancement of the attack intention. According to the results of the intelligence association analysis, the preliminary attack intention is corrected and enhanced, and a more accurate and complete attack intention judgment can be obtained, which provides a more reliable basis for subsequent attack target identification, impact range assessment, etc., and improves the effectiveness of security incident response.

[0054] Preferably, step S4 comprises the following steps:

[0055] Step S41: Prioritize attack events according to the visualized attack analysis report to obtain a queue of attack events to be processed; determine defense targets according to the queue of attack events to be processed to obtain a list of defense targets;

[0056] Step S42: performing defense strategy retrieval according to the defense target list and the preset defense strategy library to obtain a candidate defense strategy set;

[0057] Step S43: predicting the strategy effect of the candidate defense strategy set according to the visualized attack analysis report to obtain a defense strategy effect prediction set;

[0058] Step S44: performing strategy deployment processing on the candidate defense strategy set according to the defense strategy effect prediction set to obtain a deployed defense strategy;

[0059] Step S45: monitoring the defense effect of the real-time traffic data flow according to the deployed defense strategy to obtain defense effect monitoring data;

[0060] Step S46: dynamically adjust the deployed defense strategy according to the visualized attack analysis report, the preset defense strategy library, and the defense effect monitoring data to obtain a dynamic defense strategy.

[0061] The present invention prioritizes attack events according to attack analysis reports and determines targets that need to be focused on defense, so that limited security resources can be concentrated on defending high-risk attacks, thereby improving the efficiency and pertinence of security protection. According to the defense target and the preset defense strategy library, retrieval can be performed to quickly screen out effective defense strategies, shorten the defense strategy formulation time, and improve the security response speed. Through attack simulation, threat intelligence analysis and other methods, the effect of candidate defense strategies is predicted, and the defense effects of different strategies can be evaluated, invalid strategies can be avoided, and the effectiveness of security protection can be improved. According to the strategy effect prediction results, the optimal strategy is selected for deployment, which can maximize the role of the defense strategy, improve the attack interception success rate, and reduce security risks. Real-time monitoring of the execution of the deployed defense strategy can timely discover problems such as defense failure and false alarms, provide a basis for subsequent strategy adjustments, and ensure the effectiveness of the defense system. According to the attack analysis report, the defense strategy library and the defense effect monitoring data, the deployed defense strategy is dynamically adjusted to adapt to the changing attack means and network environment, improve the flexibility and adaptability of the defense system, and achieve more intelligent security defense.

[0062] Preferably, step S5 comprises the following steps:

[0063] Step S51: Record defense events according to the dynamic defense strategy and the visual attack analysis report to obtain defense event log data;

[0064] Step S52: performing a defense system performance evaluation on the defense event log data to obtain a defense system performance evaluation report;

[0065] Step S53: performing a root cause analysis according to the defense system performance evaluation report to obtain a root cause analysis report;

[0066] Step S54: Generate a three-layer defense system optimization plan based on the problem root cause analysis report to obtain a three-layer defense system optimization plan;

[0067] Step S55: Perform a three-layer defense system update process according to the three-layer defense system optimization solution to achieve network security protection.

[0068] The present invention forms complete defense event log data by recording the execution of dynamic defense strategies and key information in attack analysis reports, which can provide detailed data basis for subsequent defense system performance evaluation and optimization. By analyzing the defense event log data and evaluating various performance indicators of the defense system, such as defense success rate, false alarm rate, response time, etc., the operation status of the defense system can be fully understood, and potential security risks and improvement directions can be found. For the problems found in the defense system performance evaluation, in-depth root cause analysis is carried out, such as analyzing the root causes of attack omissions and false alarms, the crux of the problem can be found, and a basis for formulating effective optimization plans is provided. According to the results of the root cause analysis of the problem, a targeted three-layer defense system optimization plan is formulated, such as optimizing the boundary defense strategy, updating the active defense model, improving the adaptive defense mechanism, etc., which can effectively improve the overall security protection capability of the defense system. According to the optimization plan, the defense system is updated, such as updating the security device configuration, upgrading the software version, adjusting the policy parameters, etc., the optimization plan can be implemented, and the security protection effect of the defense system can be effectively improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0069] Figure 1 It is a flowchart of the steps of the network security protection method based on big data;

[0070] Figure 2 for Figure 1 Detailed implementation steps of step S2 in the flowchart;

[0071] Figure 3 for Figure 1 Detailed implementation steps of step S3 in FIG.

[0072] The purpose, features and advantages of the present invention will be further described with reference to the accompanying drawings in conjunction with the embodiments. DETAILED DESCRIPTION

[0073] The technical method of the present invention is described clearly and completely below in conjunction with the accompanying drawings. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by technicians in this field without creative work are within the scope of protection of the present invention.

[0074] In addition, the accompanying drawings are only schematic illustrations of the present invention and are not necessarily drawn to scale. The same reference numerals in the figures represent the same or similar parts, and their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities. The functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor methods and / or microcontroller methods.

[0075] It should be understood that, although the terms "first", "second", etc. may be used herein to describe various units, these units should not be limited by these terms. These terms are used only to distinguish one unit from another unit. For example, without departing from the scope of the exemplary embodiments, the first unit may be referred to as the second unit, and similarly the second unit may be referred to as the first unit. The term "and / or" used herein includes any and all combinations of one or more of the listed associated items.

[0076] To achieve this, please refer to Figures 1 to 3 , a network security protection method based on big data, comprising the following steps:

[0077] Step S1: Obtain original network traffic data through a data pipeline tool; divide the original network traffic data into time windows to obtain time window traffic data; perform clustering feature description analysis on the time window traffic data to obtain a traffic clustering label model; generate a normal traffic baseline model based on the traffic clustering label model and the time window traffic data to obtain a normal traffic baseline model;

[0078] Step S2: collect real-time traffic from network devices to obtain real-time traffic data streams; use a normal traffic baseline model to perform an abnormal probability distribution analysis on the real-time feature stream to obtain a real-time abnormal feature stream; obtain an abnormal score for historical traffic data; calculate a baseline confidence interval based on the abnormal score for historical traffic data to obtain a baseline confidence interval; perform an adaptive confidence interval adjustment based on the baseline confidence interval and the real-time abnormal feature stream to obtain an adaptive confidence interval; perform abnormal traffic marking on the real-time abnormal feature stream based on the adaptive confidence interval to obtain abnormal traffic marking data;

[0079] Step S3: infer attack intentions based on abnormal traffic mark data to obtain preliminary attack intention data; perform intelligence correlation analysis based on the preliminary attack intention data to obtain attack intention supporting data; modify the preliminary attack intention data based on the attack intention supporting data and enhance the intention to obtain attack intention enhanced data; generate a visual attack report based on the attack intention enhanced data to obtain a visual attack analysis report;

[0080] Step S4: Retrieve defense strategies according to the visualized attack analysis report to obtain a candidate defense strategy set; monitor the defense effect of the real-time traffic data flow according to the visualized attack analysis report and the candidate defense strategy set to obtain defense effect monitoring data; dynamically adjust the defense strategy according to the visualized attack analysis report and the defense effect monitoring data to obtain a dynamic defense strategy;

[0081] Step S5: Evaluate the performance of the defense system according to the dynamic defense strategy and the visualized attack analysis report to obtain a defense system performance evaluation report; perform root cause analysis according to the defense system performance evaluation report to obtain a root cause analysis report; generate a three-layer defense system optimization plan according to the root cause analysis report and perform a three-layer defense system update process to achieve network security protection.

[0082] The present invention constructs an accurate normal traffic baseline model by analyzing historical traffic data, can effectively distinguish normal and abnormal network behaviors, provide a reliable basis for subsequent anomaly detection, reduce the false alarm rate, and improve the accuracy of security protection. Real-time collection of network traffic data, and combined with the baseline model and adaptive confidence interval for anomaly detection, can timely discover traffic that deviates from the normal mode, improve the accuracy and timeliness of anomaly detection, and provide candidate targets for attack tracing. Through means such as association analysis, attack map construction, and intelligence association analysis, the behavior patterns and intentions of attackers can be deeply excavated to form comprehensive and accurate attack analysis results, providing support for the response and decision-making of security incidents. According to the attack analysis results, the defense strategy is dynamically adjusted, and the defense effect is monitored in real time, which can effectively respond to the ever-changing network attack means, improve the flexibility and adaptability of the defense system, and achieve more intelligent security defense. By continuously evaluating the performance of the defense system, analyzing the root cause of the problem, and optimizing iterative optimization, the security protection capability of the defense system can be continuously improved, and a more secure and reliable network environment can be built. Through the three-layer defense structure, big data technology is used to perform traffic clustering and anomaly identification in the border defense layer (step S1), big data technology is used to perform anomaly detection and attack tracing in the active defense layer (step S2-step S3), and dynamic defense strategy adjustment and continuous defense optimization based on big data are performed in the adaptive defense layer (step S4-step S5), which effectively solves the problem of attackers using big data technology to carry out covert attacks and evade traditional defenses, and realizes the accurate discovery and tracing of unknown threats and complex attacks. Therefore, the present invention provides a network security protection method based on big data. It solves the shortcomings of a traditional network security protection method based on big data when attackers use big data technology to attack, and improves the overall intelligence level of the defense system and the ability to resist big data attacks.

[0083] In the embodiment of the present invention, reference Figure 1 The above is a schematic diagram of the steps of the network security protection method based on big data of the present invention. In this example, the network security protection method based on big data includes the following steps:

[0084] Step S1: Obtain original network traffic data through a data pipeline tool; divide the original network traffic data into time windows to obtain time window traffic data; perform clustering feature description analysis on the time window traffic data to obtain a traffic clustering label model; generate a normal traffic baseline model based on the traffic clustering label model and the time window traffic data to obtain a normal traffic baseline model;

[0085] In the embodiment of the present invention, the data pipeline tool is used to collect raw traffic data from network devices and divide it into preset time windows. Then, a clustering algorithm is used to analyze the traffic characteristics in each time window to generate a traffic clustering label model. Finally, based on the model and historical traffic data, a normal traffic baseline model is constructed to distinguish normal and abnormal network behaviors.

[0086] Step S2: collect real-time traffic from network devices to obtain real-time traffic data streams; use a normal traffic baseline model to perform an abnormal probability distribution analysis on the real-time feature stream to obtain a real-time abnormal feature stream; obtain an abnormal score for historical traffic data; calculate a baseline confidence interval based on the abnormal score for historical traffic data to obtain a baseline confidence interval; perform an adaptive confidence interval adjustment based on the baseline confidence interval and the real-time abnormal feature stream to obtain an adaptive confidence interval; perform abnormal traffic marking on the real-time abnormal feature stream based on the adaptive confidence interval to obtain abnormal traffic marking data;

[0087] In the embodiment of the present invention, the real-time traffic data of the network device is continuously collected and stream feature extraction is performed. The real-time feature flow is compared with the normal traffic baseline model to identify the real-time abnormal feature flow with a large degree of deviation. At the same time, the anomaly score of the historical traffic data is analyzed, the baseline confidence interval is calculated, and the confidence interval is adaptively adjusted according to the abnormal situation of the real-time traffic, and finally the real-time abnormal feature flow that exceeds the confidence interval is marked.

[0088] Step S3: infer attack intentions based on abnormal traffic mark data to obtain preliminary attack intention data; perform intelligence correlation analysis based on the preliminary attack intention data to obtain attack intention supporting data; modify the preliminary attack intention data based on the attack intention supporting data and enhance the intention to obtain attack intention enhanced data; generate a visual attack report based on the attack intention enhanced data to obtain a visual attack analysis report;

[0089] In the embodiment of the present invention, multiple abnormal events belonging to the same attack behavior are associated based on abnormal traffic data, and an attack graph is constructed using a graph database. The attack graph is matched with a preset attack pattern library to infer the initial intention of the attacker. Then, relevant intelligence information is retrieved from the threat intelligence database, the initial attack intention is corrected and enhanced, and finally a visual attack analysis report containing information such as the attack timeline, attack path, and attack target is generated.

[0090] Step S4: Retrieve defense strategies according to the visualized attack analysis report to obtain a candidate defense strategy set; monitor the defense effect of the real-time traffic data flow according to the visualized attack analysis report and the candidate defense strategy set to obtain defense effect monitoring data; dynamically adjust the defense strategy according to the visualized attack analysis report and the defense effect monitoring data to obtain a dynamic defense strategy;

[0091] In the embodiment of the present invention, attack events are prioritized according to the visual attack analysis report, and specific targets that need to be defended are determined. Then, candidate defense strategies are retrieved according to the defense targets and the preset defense strategy library, and the strategy effects are predicted using methods such as attack simulation and threat intelligence analysis. The strategy with the best expected effect is selected for deployment, and the defense effect is monitored in real time. Finally, the defense strategy is dynamically adjusted according to the attack analysis report and defense effect monitoring data to achieve adaptive defense.

[0092] Step S5: Perform a defense system performance evaluation based on the dynamic defense strategy and the visualized attack analysis report to obtain a defense system performance evaluation report; perform a problem root cause analysis based on the defense system performance evaluation report to obtain a problem root cause analysis report; generate a three-layer defense system optimization plan based on the problem root cause analysis report and perform a three-layer defense system update process to achieve network security protection;

[0093] In the embodiment of the present invention, the execution of the dynamic defense strategy and the attack event information are recorded to generate defense event log data. The performance of the defense system is evaluated based on these data, such as the defense success rate, false alarm rate, etc. The root cause analysis is performed for the deficiencies of the defense system found, such as analyzing the reasons for missed attacks and false alarms. Finally, based on the results of the root cause analysis, an optimization plan for the three-layer defense system is formulated and implemented, such as updating the defense strategy, upgrading security equipment, etc., to continuously improve the security protection capabilities of the defense system.

[0094] Step S11: obtaining original network traffic data through a data pipeline tool; dividing the original network traffic data into time windows to obtain time window traffic data; performing clustering feature description analysis on the time window traffic data to obtain a traffic clustering label model;

[0095] Step S12: using the traffic clustering label model to score the abnormal behavior of the time window traffic data to obtain the time window abnormality score;

[0096] Step S13: performing abnormal flow judgment on the time window flow data according to the time window abnormal score and a preset abnormal score threshold to obtain abnormal flow judgment data;

[0097] Step S14: fitting a probability distribution model according to the abnormal flow judgment data and defining a normal flow range according to a preset confidence interval to obtain normal flow range data;

[0098] Step S15: Generate a normal traffic baseline model based on the normal traffic range data to obtain a normal traffic baseline model.

[0099] The present invention efficiently obtains raw traffic data from network devices through data pipeline tools, and divides it according to time windows, providing a structured data basis for subsequent feature analysis and model building, and improving data processing efficiency. By using the traffic clustering label model to score abnormal behavior of traffic data in the time window, it is possible to effectively identify traffic that deviates from the normal mode, provide a quantitative basis for subsequent abnormal traffic judgment, and improve the accuracy of abnormal detection. By comparing the time window abnormal score with the preset threshold, it is possible to quickly determine whether the traffic data in each time window is abnormal, achieve preliminary screening of abnormal traffic, reduce the pressure of subsequent analysis and processing, and improve detection efficiency. By fitting the probability distribution model of normal traffic data and determining the normal traffic range according to the preset confidence interval, the characteristic distribution of normal traffic can be more accurately described, providing a reliable basis for the construction of subsequent baseline models, and reducing the false alarm rate. According to the normal traffic range data, a more accurate normal traffic baseline model can be constructed to distinguish normal and abnormal traffic, improve the accuracy and reliability of subsequent abnormal detection, and provide effective support for network security protection.

[0100] In an embodiment of the present invention, Apache Kafka is used to build a data pipeline to collect raw network traffic data in real time from network sensors, such as data packet header information, traffic size, timestamp, etc. Flink is used to process the data stream in real time, and the data stream is divided according to a 5-minute time window to obtain the time window traffic data. For the traffic data in each time window, Spark is used to describe and analyze the clustering characteristics, for example, the DBSCAN algorithm is used to cluster according to the source IP, destination IP, port, protocol and other characteristics, and the traffic statistical characteristics of each cluster cluster are calculated, such as the average data packet size, number of connections, access frequency, etc., and finally a traffic clustering label model is generated. Based on the traffic clustering label model, the traffic data in each time window is scored for abnormal behavior. For example, the degree of deviation of the traffic statistical characteristics of the cluster cluster to which each data packet belongs from the historical average characteristics of the cluster cluster is calculated, and different abnormal scores are assigned according to the degree of deviation. The greater the deviation, the higher the abnormal score, and finally the time window abnormal score is obtained. An abnormal score threshold is set in advance, for example, 0.8. The abnormal score of each time window is compared with the threshold. If the anomaly score of a certain time window exceeds the preset threshold, the traffic data in the time window is judged to be abnormal, otherwise it is judged to be normal, and finally the abnormal traffic judgment data is obtained. A probability distribution model is fitted for the traffic data judged to be normal, for example, the characteristics of normal traffic data are modeled using a Gaussian mixture model (GMM). According to the preset confidence interval, such as the 95% confidence interval, the upper and lower bounds of the normal traffic range are determined, that is, the data points within this range are considered to be normal traffic, and finally the normal traffic range data is obtained. Based on the normal traffic range data, a normal traffic baseline model is constructed. For example, the upper and lower bounds of the normal traffic range can be used as the threshold of the baseline model, or a machine learning algorithm can be used to train the traffic data within the normal traffic range to obtain a classification model that can identify normal traffic as a normal traffic baseline model.

[0101] Preferably, step S11 includes the following steps:

[0102] Step S111: Aggregate the original data of the network device through the data pipeline tool to obtain the original network flow data; perform flow data preprocessing on the original network flow data to obtain preprocessed flow data;

[0103] Step S112: Reconstruct the session according to the pre-processed traffic data to obtain session data; divide the time window according to the session data to obtain time window traffic data;

[0104] Step S113: extracting features and performing feature selection on the time window traffic data to obtain a feature vector data set; performing traffic clustering analysis and modeling on the feature vector data set to obtain a traffic clustering model;

[0105] Step S114: Perform clustering feature description analysis based on the traffic clustering model and the feature vector data set to obtain a traffic clustering label model.

[0106] The present invention can efficiently aggregate raw traffic data from multiple network devices through data pipeline tools, and perform preprocessing operations such as data cleaning, deduplication, format conversion, etc., eliminate data noise and redundant information, and improve the efficiency and accuracy of subsequent analysis. Through session reconstruction, scattered data packets are restored to complete network communication sessions, which helps to understand network behavior more comprehensively; and time window division divides continuous session data into multiple time segments, which is convenient for analysis and comparison in the time dimension and improves the sensitivity of anomaly detection. By extracting features from time window traffic data, the raw data can be converted into more abstract and representative feature vectors for subsequent analysis; and feature selection can screen out features with higher contribution to traffic clustering analysis, reduce data dimensions, and improve model training efficiency and generalization ability. By analyzing the traffic clustering model and feature vector data set, the traffic characteristics of each cluster cluster can be deeply understood, the network behavior pattern represented by it can be identified, and a more accurate classification basis can be provided for subsequent anomaly detection and attack tracing, thereby improving the pertinence and effectiveness of security protection.

[0107] In an embodiment of the present invention, raw network traffic data is collected from multiple network devices (such as firewalls, intrusion detection systems, etc.), including data packet header information, network protocol type, traffic size, timestamp, etc. The collected raw data is preprocessed, such as data cleaning, deduplication, format conversion, etc., to remove invalid data and redundant information, and convert the data into a unified format to obtain preprocessed traffic data. According to the five-tuple information (source IP address, source port, destination IP address, destination port, protocol type) in the preprocessed traffic data, the session is reconstructed, that is, multiple data packets belonging to the same network connection are combined into a complete session flow. Then, according to the preset time window size, the continuous session data is divided into multiple time window traffic data, and each time window contains all session data within the time period. Feature extraction is performed on the traffic data in each time window, such as counting the duration of each session, the number of data packets, the total number of bytes, the average data packet size, the ratio of inflow and outflow data packets, and converting these features into numerical vectors to construct a feature vector data set. The feature vector data set is reduced in dimension using feature selection algorithms (such as information gain, chi-square test, etc.), and features with high contribution to traffic clustering analysis are screened out to obtain a streamlined feature vector data set. Finally, a suitable clustering algorithm is selected to perform traffic clustering analysis modeling on the streamlined feature vector data set to obtain a traffic clustering model, and traffic data with similar features are divided into the same cluster cluster. According to the traffic clustering model, cluster feature description analysis is performed on the traffic data in each time window. For example, the statistical features of the traffic data in each cluster cluster (such as average session duration, average number of packets, average total number of bytes, etc.) are counted, and the differences between each feature in different cluster clusters are analyzed to identify the typical traffic pattern of each cluster cluster. According to the analysis results, each cluster cluster is labeled, for example, a cluster cluster with short sessions and small packets as the main features is labeled as a "scanning attack" label, and a cluster cluster with long sessions and large traffic as the main features is labeled as a "data leakage" label, etc., and finally a traffic cluster label model is obtained.

[0108] Preferably, step S2 comprises the following steps:

[0109] Step S21: collect real-time traffic of network devices through a data pipeline tool to obtain a real-time traffic data stream; extract streaming features from the real-time traffic data stream to obtain a real-time feature stream;

[0110] Step S22: using the normal traffic baseline model to calculate the degree of deviation of the real-time traffic behavior and perform abnormal probability distribution analysis on the real-time feature flow to obtain the real-time abnormal feature flow;

[0111] Step S23: Obtain anomaly scores of historical traffic data; perform baseline confidence interval calculation based on anomaly scores of historical traffic data to obtain a baseline confidence interval; perform adaptive confidence interval adjustment based on the baseline confidence interval and the real-time abnormal feature flow to obtain an adaptive confidence interval;

[0112] Step S24: performing time series analysis on the real-time abnormal feature flow according to the adaptive confidence interval and marking the abnormal pattern to obtain abnormal pattern marking data;

[0113] Step S25: performing abnormal event aggregation on the abnormal pattern marking data to obtain an abnormal event list; performing abnormal event classification on the abnormal event list and performing abnormal traffic marking to obtain abnormal traffic marking data.

[0114] The present invention collects network traffic data in real time through a data pipeline tool and performs streaming feature extraction, which can timely capture the changing trend of network traffic, provide real-time data support for subsequent anomaly detection, and improve the timeliness of security protection. Using the normal traffic baseline model to perform abnormal probability distribution analysis on the real-time feature flow, it can effectively identify the real-time traffic that deviates from the normal mode, provide candidate targets for subsequent attack tracing, and improve the efficiency of security incident discovery. By analyzing the abnormal scores of historical traffic data, calculating the baseline confidence interval, and adaptively adjusting according to the real-time abnormal feature flow, it can better adapt to the dynamic changes of network traffic, improve the accuracy and robustness of anomaly detection, and reduce false positives and missed reports. Based on the adaptive confidence interval, the real-time abnormal feature flow is analyzed in time series, and the abnormal pattern library is used for matching or clustering analysis, which can identify potential attack patterns, provide important clues for subsequent attack intention inference, and improve the accuracy of attack identification. By aggregating abnormal pattern labeling data with similar characteristics into abnormal events and classifying them, it is possible to associate scattered abnormal behaviors to form a more complete view of attack events, provide richer information for subsequent attack tracing and defense strategy formulation, and improve the efficiency of handling security incidents.

[0115] As an example of the present invention, refer to Figure 2 As shown, in this example, step S2 includes:

[0116] Step S21: collect real-time traffic of network devices through a data pipeline tool to obtain a real-time traffic data stream; extract streaming features from the real-time traffic data stream to obtain a real-time feature stream;

[0117] In the embodiment of the present invention, real-time traffic data is continuously collected from network devices (such as switch mirror ports), and the raw data is parsed into a structured data stream, including timestamp, source IP address, destination IP address, port number, protocol type, packet size, etc. Streaming feature extraction is performed on the real-time traffic data stream, such as calculating the total number of traffic bytes per second, average packet size, number of connections, and proportion of traffic of different protocol types, to generate a real-time feature stream.

[0118] Step S22: using the normal traffic baseline model to calculate the degree of deviation of the real-time traffic behavior and perform abnormal probability distribution analysis on the real-time feature flow to obtain the real-time abnormal feature flow;

[0119] In an embodiment of the present invention, the real-time feature flow is compared with the normal traffic baseline model. For example, the degree of deviation of each feature value from the normal range of the corresponding feature in the baseline model is calculated, or the real-time feature flow is predicted using the baseline model, and the difference between the predicted value and the actual value is calculated. An abnormal probability distribution analysis is performed based on the degree of deviation or the size of the difference, and the abnormal score of each feature flow data point is calculated to identify real-time abnormal feature flows with a large degree of deviation and a high probability of abnormality.

[0120] Step S23: Obtain anomaly scores of historical traffic data; perform baseline confidence interval calculation based on anomaly scores of historical traffic data to obtain a baseline confidence interval; perform adaptive confidence interval adjustment based on the baseline confidence interval and the real-time abnormal feature flow to obtain an adaptive confidence interval;

[0121] In an embodiment of the present invention, the anomaly score of each time window (e.g., 5 minutes) in the past period of time (e.g., the past 24 hours) is obtained from the historical traffic data to construct a time series of anomaly scores of historical traffic data. The time series is smoothed using statistical methods (e.g., moving average, exponential smoothing, etc.) to eliminate random fluctuations, and a baseline confidence interval is calculated, for example, the mean of the historical anomaly score plus or minus 2 times the standard deviation is taken as the upper and lower bounds of the confidence interval. Finally, according to the baseline confidence interval and the abnormal probability distribution of the real-time abnormal feature flow at the current moment, the confidence interval is adaptively adjusted, for example, the confidence interval is appropriately relaxed during peak traffic periods, and the confidence interval is tightened during low traffic periods, so as to more accurately identify abnormal traffic.

[0122] Step S24: performing time series analysis on the real-time abnormal feature flow according to the adaptive confidence interval and marking the abnormal pattern to obtain abnormal pattern marking data;

[0123] In an embodiment of the present invention, a time series analysis is performed on the identified real-time abnormal feature stream according to an adaptive confidence interval. For example, a sliding window algorithm is used to slice the real-time abnormal feature stream, and the abnormal feature stream data points in each time window are regarded as a time series segment. An abnormal pattern recognition is performed on each time series segment, for example, a distance-based algorithm (such as a DTW algorithm) is used to match the current time series segment with a known abnormal pattern library, or a clustering algorithm is used to group the time series segments, traffic data with similar abnormal patterns are identified, and corresponding abnormal pattern labels are added to them, and finally abnormal pattern labeled data is obtained.

[0124] Step S25: performing abnormal event aggregation on the abnormal pattern mark data to obtain an abnormal event list; performing abnormal event classification on the abnormal event list and performing abnormal traffic mark to obtain abnormal traffic mark data;

[0125] In an embodiment of the present invention, the abnormal pattern marking data marked as the same abnormal pattern are aggregated according to information such as timestamp, IP address, port number, etc. to form abnormal events. For example, a large number of connection requests from the same source IP address to the same target port in a short period of time are aggregated into a "scanning attack" event. All aggregated abnormal events are sorted into an abnormal event list, and the abnormal events are classified according to event characteristics (such as the number of IP addresses involved, duration, data packet characteristics, etc.), such as DDoS attacks, port scanning, worm propagation, etc., and finally abnormal traffic marking data is obtained.

[0126] Preferably, step S23 includes the following steps:

[0127] Step S231: Obtain anomaly scores of historical traffic data; construct anomaly score time series for the anomaly scores of historical traffic data to obtain anomaly score time series;

[0128] Step S232: performing time series smoothing processing on the anomaly score time series to obtain an anomaly score smoothed time series;

[0129] Step S233: performing time series decomposition on the abnormal score smoothed time series to obtain time series decomposition data, wherein the time series decomposition data includes trend component data, seasonal component data and residual component data;

[0130] Step S234: Calculate the baseline confidence interval based on the trend component data and the seasonal component data to obtain the baseline confidence interval;

[0131] Step S235: performing random fluctuation analysis of residual components of real-time flow according to residual component data and real-time abnormal characteristic flow to obtain random fluctuation data of residual components;

[0132] Step S236: performing adaptive confidence interval adjustment according to the baseline confidence interval, the residual component random fluctuation data and the preset adjustment parameters to obtain an adaptive confidence interval.

[0133] The present invention constructs the anomaly score of historical traffic data into a time series, which can intuitively show the trend of the anomaly score changing over time, and provide a basis for subsequent analysis and prediction. By smoothing the anomaly score time series, the interference of random fluctuations on trend judgment can be eliminated, so that the time series can more clearly reflect the long-term change law of the anomaly score, and improve the accuracy of subsequent analysis. The smoothed anomaly score time series is decomposed into trend components, seasonal components and residual components, and the abnormal fluctuation laws on different time scales can be studied respectively, providing a basis for building a more accurate baseline confidence interval. According to the trend component and seasonal component data, the fluctuation range of the anomaly score in the future can be predicted, and a baseline confidence interval can be constructed to provide a reference for judging whether the real-time traffic is abnormal. By analyzing the residual component of real-time traffic, the random fluctuation situation after eliminating trend and seasonal factors can be captured, and the abnormal degree of current network traffic can be more sensitively reflected. Combined with the random fluctuation situation of the baseline confidence interval and the residual component of real-time traffic, the confidence interval is adaptively adjusted, which can better adapt to the dynamic changes of network traffic, improve the accuracy and timeliness of anomaly detection, and reduce false positives and false negatives.

[0134] In an embodiment of the present invention, the anomaly score of each time window (e.g., 5 minutes) in the past period of time is obtained from the historical traffic data. For example, the average anomaly score of each time window calculated previously is used to construct an anomaly score time series with time as the horizontal axis and the anomaly score as the vertical axis. The moving average method is used to smooth the anomaly score time series. For example, a moving window of 1 hour (i.e., 12 time windows) is used to calculate the moving average of each time point to eliminate random fluctuations in the time series and obtain a smoother anomaly score smoothed time series. The anomaly score smoothed time series is decomposed using a time series decomposition technique (e.g., STL decomposition method) to decompose it into trend components, seasonal components, and residual components. Among them, the trend component reflects the long-term change trend of the anomaly score, the seasonal component reflects the periodic fluctuation law of the anomaly score, and the residual component represents the random fluctuation part after removing the trend and seasonal components, and finally the time series decomposition data is obtained, including trend component data, seasonal component data, and residual component data. According to the trend component data and seasonal component data obtained by the time series decomposition, the confidence interval of the anomaly score at each time point in the future (e.g., the next 1 hour) is predicted. For example, the trend confidence interval and seasonal confidence interval of each future time point can be calculated respectively according to the fluctuation range of historical trend and seasonal component data, and the two can be superimposed to obtain a baseline confidence interval, which is used to characterize the expected fluctuation range of the abnormal score at each future time point under normal circumstances. According to the residual component data obtained by decomposition, a random fluctuation model of the residual component is established, such as an autoregressive moving average model (ARMA). The model is used to predict the real-time abnormal characteristic flow at the current moment to obtain the predicted value of the real-time flow residual component, and the deviation between the predicted value and the actual value is calculated as the random fluctuation data of the real-time flow residual component, which is used to characterize the abnormal fluctuation of the current network traffic. According to the baseline confidence interval, the random fluctuation data of the real-time flow residual component, and the preset adjustment parameters (for example, different adjustment coefficients are set according to the dynamic changes of the network traffic), the baseline confidence interval is adaptively adjusted. For example, when the random fluctuation of the real-time flow residual component is large, the baseline confidence interval is appropriately relaxed to reduce false alarms; otherwise, the baseline confidence interval is appropriately tightened to improve the detection sensitivity, and finally an adaptive confidence interval is obtained.

[0135] Preferably, step S3 comprises the following steps:

[0136] Step S31: performing abnormal event correlation according to the abnormal traffic mark data to obtain abnormal event correlation data; constructing an attack graph for the abnormal event correlation data to obtain an attack graph;

[0137] Step S32: performing attack pattern matching on the attack graph and the preset attack pattern library to obtain matching attack pattern data; performing attack intention inference based on the matching attack pattern data to obtain preliminary attack intention data;

[0138] Step S33: performing intelligence correlation analysis based on the preliminary attack intention data to obtain attack intention supporting data; performing attack intention correction and intention enhancement on the preliminary attack intention data based on the attack intention supporting data to obtain attack intention enhanced data;

[0139] Step S34: performing attack target identification according to the attack intention enhancement data to obtain attack target data; performing impact range assessment according to the attack target data to obtain potential impact range data;

[0140] Step S35: Perform risk level assessment based on the attack intention enhancement data, the attack target data, and the potential impact range data to obtain attack event risk level data;

[0141] Step S36: Generate a visualized attack report based on the attack event risk level data, attack target data, attack target data, potential impact range data, and attack intention enhancement data to obtain a visualized attack analysis report.

[0142] The present invention integrates discrete abnormal traffic tag data into a more complete attack event through association analysis, and constructs an attack map, which can intuitively display the correlation between attack behaviors, help to more comprehensively understand the attack process, and improve the efficiency of security event analysis. Matching the attack map with the known attack pattern library can quickly identify the attack techniques and tactics used by the attacker, and infer the attacker's initial intention based on the matched attack pattern, providing direction guidance for subsequent in-depth analysis. By correlating the initial attack intention with external threat intelligence, more abundant attacker background information, attack tool details, etc. can be obtained, thereby verifying, correcting and enhancing the initial attack intention, and forming a more accurate and comprehensive attack intention judgment. According to the enhanced attack intention information, combined with the contextual information of the attack event, the attacker's ultimate goal can be more accurately identified, and the impact range caused by the successful attack can be evaluated, providing a basis for formulating a more targeted defense strategy. According to factors such as attack intention, attack target, and potential impact range, the risk level of the attack event is evaluated, which can help quickly determine the degree of harm of the attack event, give priority to high-risk security events, and improve the efficiency of security event response. By presenting key information of attack events, including attack intent, attack path, attack target, risk level, etc., in a visual way, we can understand attack events more intuitively and quickly, and improve the efficiency of handling and communicating security incidents.

[0143] As an example of the present invention, refer to Figure 3As shown, in this example, step S3 includes:

[0144] Step S31: performing abnormal event correlation according to the abnormal traffic mark data to obtain abnormal event correlation data; constructing an attack graph for the abnormal event correlation data to obtain an attack graph;

[0145] In the embodiment of the present invention, the abnormal traffic data marked in step S2 is analyzed, and multiple abnormal events belonging to the same attack behavior are associated according to information such as time, IP address, port, and attack type, to construct abnormal event association data, such as associating scanning behaviors for multiple target ports from the same source IP address in the same time period. Then, the abnormal event association data is constructed into an attack graph using a graph database (such as Neo4j), in which nodes represent entities such as attackers, victims, and attack tools, and edges represent associations between attack behaviors, such as an attacker using a certain vulnerability to attack a certain server.

[0146] Step S32: performing attack pattern matching on the attack graph and the preset attack pattern library to obtain matching attack pattern data; performing attack intention inference based on the matching attack pattern data to obtain preliminary attack intention data;

[0147] In an embodiment of the present invention, the attack graph is matched with a predefined attack pattern library, which contains feature descriptions of various known attacks, such as attack steps, attack techniques, attack targets, etc. For example, a graph similarity algorithm (such as SimRank algorithm) can be used to calculate the similarity between the attack graph and each pattern in the attack pattern library, and matching attack pattern data with a similarity exceeding a preset threshold can be screened out, such as identifying that the attack graph contains known attack patterns such as SQL injection attacks and cross-site scripting attacks. Based on the matched attack pattern data, combined with the specific attack paths and attack techniques in the attack graph, the initial attack intention of the attacker is inferred, such as the attacker trying to obtain database permissions, control the target server, etc., and the initial attack intention data is obtained.

[0148] Step S33: performing intelligence correlation analysis based on the preliminary attack intention data to obtain attack intention supporting data; performing attack intention correction and intention enhancement on the preliminary attack intention data based on the attack intention supporting data to obtain attack intention enhanced data;

[0149] In an embodiment of the present invention, according to the preliminary attack intention data, relevant intelligence information is retrieved from a threat intelligence database (such as VirusTotal, AlienVault OTX, etc.), such as malware analysis reports related to the attacker's IP address, domain name, and attack tools, attack event descriptions, etc., to obtain attack intention supporting data. Then, the attack intention supporting data is analyzed using natural language processing technology to extract key information, such as the attacker's identity, attack target, attack motive, etc., and is associated with the preliminary attack intention data for analysis, such as determining whether the supporting data supports the inference of the preliminary attack intention, whether there are new attack clues, etc. Finally, according to the results of the association analysis, the preliminary attack intention data is corrected and enhanced, such as confirming the attacker's identity, clarifying the specific target of the attack, supplementing the potential motive of the attack, etc., to obtain attack intention enhanced data.

[0150] Step S34: performing attack target identification according to the attack intention enhancement data to obtain attack target data; performing impact range assessment according to the attack target data to obtain potential impact range data;

[0151] In the embodiment of the present invention, attack target identification is performed based on attack intention enhancement data, combined with attack paths and attack target information in the attack map, such as determining the server that the attacker ultimately wants to control, the data to be stolen, etc., to obtain attack target data. Then, based on the attack target data, combined with the network topology, asset information, etc., the impact range caused by a successful attack is evaluated, such as which servers will be affected, which data will be leaked, etc., to obtain potential impact range data.

[0152] Step S35: Perform risk level assessment based on the attack intention enhancement data, the attack target data, and the potential impact range data to obtain attack event risk level data;

[0153] In an embodiment of the present invention, a risk level assessment of an attack event is performed based on attack intention enhancement data, attack target data, and potential impact range data in combination with a predefined risk assessment model. For example, based on factors such as the importance of the attack target, the size of the potential impact range, and the degree of harm of the attack intention, the risk level of the attack event is divided into three levels: low, medium, and high, to obtain attack event risk level data.

[0154] Step S36: Generate a visual attack report based on the attack event risk level data, attack target data, attack target data, potential impact range data, and attack intention enhancement data to obtain a visual attack analysis report;

[0155] In the embodiment of the present invention, a visual attack analysis report is generated based on the attack event risk level data, attack target data, potential impact range data, and attack intention enhancement data. The report displays key information of the attack event in the form of charts, maps, etc., such as attack timeline, attack path, attacker portrait, attack target, potential impact range, risk level, etc., so as to quickly understand the overall situation of the attack event and take corresponding defense measures.

[0156] Preferably, step S33 includes the following steps:

[0157] Step S331: Identify the intelligence requirements of the preliminary attack intention data to obtain a threat intelligence requirement list;

[0158] Step S332: performing a multi-source intelligence search on a preset threat intelligence database according to the threat intelligence requirement list to obtain a candidate threat intelligence set;

[0159] Step S333: performing intelligence credibility evaluation on the candidate threat intelligence set to obtain a threat intelligence credibility score set;

[0160] Step S334: performing intelligence correlation analysis on the preliminary attack intention data and the threat intelligence credibility score set to obtain attack intention supporting data;

[0161] Step S335: modify the initial attack intention data according to the attack intention supporting data and enhance the intention to obtain attack intention enhanced data.

[0162] The present invention analyzes the preliminary attack intention data, clarifies what intelligence information needs to be further obtained to corroborate or overturn the preliminary judgment, and forms a structured threat intelligence demand list, which can improve the pertinence and efficiency of subsequent intelligence retrieval and avoid blindly collecting invalid information. According to the threat intelligence demand list, relevant information can be retrieved from multiple threat intelligence databases to collect more comprehensive intelligence data, avoid information islands, and improve the integrity and accuracy of intelligence analysis. The credibility assessment of the candidate threat intelligence set can effectively identify low-quality information such as false intelligence and outdated intelligence, improve the reliability of intelligence analysis, and avoid interference from misleading information. The preliminary attack intention data and the threat intelligence after credibility assessment are associated and analyzed, and the association relationship hidden between different data sources can be discovered, and deeper attack clues can be excavated, providing a more sufficient basis for the correction and enhancement of the attack intention. According to the results of the intelligence association analysis, the preliminary attack intention is corrected and enhanced, and a more accurate and complete attack intention judgment can be obtained, which provides a more reliable basis for subsequent attack target identification, impact range assessment, etc., and improves the effectiveness of security incident response.

[0163] In an embodiment of the present invention, the preliminary attack intention data obtained in the analysis step S32, such as the IP address, domain name, attack tool features, etc. used by the attacker, as well as information such as attack techniques and attack targets, clearly need to obtain further intelligence information to prove or overturn the preliminary attack intention, such as the identity of the attacker, the background of the attack organization, a detailed analysis report of the attack tool, the vulnerability information of the attack target, etc. These intelligence requirements are organized into a threat intelligence requirement list, for example, including the IP address, domain name, file hash value, etc. that need to be queried. According to the threat intelligence requirement list, intelligence retrieval is performed from a pre-configured multi-source threat intelligence database. These databases may include open source threat intelligence libraries (such as VirusTotal, AlienVaultOTX, etc.), commercial threat intelligence platforms, internal security event libraries, etc. By matching and querying the information in the threat intelligence requirement list with each database, relevant threat intelligence data is obtained, and all retrieved intelligence data are summarized into a candidate threat intelligence set. The candidate threat intelligence set is evaluated for intelligence credibility. For example, a credibility score can be assigned to each piece of intelligence data based on factors such as the reliability of the intelligence source, the timeliness of the intelligence, and the relevance of the intelligence to the current attack event. For example, a numerical value between 0 and 1 can be used to represent the higher the intelligence credibility. Finally, a threat intelligence credibility score set is obtained. The preliminary attack intention data is associated with the threat intelligence credibility score set. For example, the entity information (such as IP address, domain name, etc.) involved in the preliminary attack intention data can be matched with the threat intelligence data to find out whether there is overlap or association. If it is found that some threat intelligence data is highly correlated with the preliminary attack intention and has a high credibility score, it can be regarded as attack intention supporting data. According to the attack intention supporting data, the preliminary attack intention data is corrected and enhanced. For example, if the supporting data shows that a certain IP address belongs to a known attack organization, the attacker identity can be corrected from "unknown" to the attack organization; if the supporting data reveals that there is a specific vulnerability in the target system, the attack intention can be enhanced from "trying to obtain permissions" to "exploiting the vulnerability to obtain permissions". Finally, more complete, accurate and detailed attack intention enhanced data is obtained.

[0164] Preferably, step S4 comprises the following steps:

[0165] Step S41: Prioritize attack events according to the visualized attack analysis report to obtain a queue of attack events to be processed; determine defense targets according to the queue of attack events to be processed to obtain a list of defense targets;

[0166] Step S42: performing defense strategy retrieval according to the defense target list and the preset defense strategy library to obtain a candidate defense strategy set;

[0167] Step S43: predicting the strategy effect of the candidate defense strategy set according to the visualized attack analysis report to obtain a defense strategy effect prediction set;

[0168] Step S44: performing strategy deployment processing on the candidate defense strategy set according to the defense strategy effect prediction set to obtain a deployed defense strategy;

[0169] Step S45: monitoring the defense effect of the real-time traffic data flow according to the deployed defense strategy to obtain defense effect monitoring data;

[0170] Step S46: dynamically adjust the deployed defense strategy according to the visualized attack analysis report, the preset defense strategy library, and the defense effect monitoring data to obtain a dynamic defense strategy.

[0171] The present invention prioritizes attack events according to attack analysis reports and determines targets that need to be focused on defense, so that limited security resources can be concentrated on defending high-risk attacks, thereby improving the efficiency and pertinence of security protection. According to the defense target and the preset defense strategy library, retrieval can be performed to quickly screen out effective defense strategies, shorten the defense strategy formulation time, and improve the security response speed. Through attack simulation, threat intelligence analysis and other methods, the effect of candidate defense strategies is predicted, and the defense effects of different strategies can be evaluated, invalid strategies can be avoided, and the effectiveness of security protection can be improved. According to the strategy effect prediction results, the optimal strategy is selected for deployment, which can maximize the role of the defense strategy, improve the attack interception success rate, and reduce security risks. Real-time monitoring of the execution of the deployed defense strategy can timely discover problems such as defense failure and false alarms, provide a basis for subsequent strategy adjustments, and ensure the effectiveness of the defense system. According to the attack analysis report, the defense strategy library and the defense effect monitoring data, the deployed defense strategy is dynamically adjusted to adapt to the changing attack means and network environment, improve the flexibility and adaptability of the defense system, and achieve more intelligent security defense.

[0172] In an embodiment of the present invention, the visual attack analysis report generated in the analysis step S3 is analyzed, and the attack events are prioritized according to the risk level of the attack event, the importance of the attack target, the size of the potential impact range, etc. For example, high-risk attack events targeting core assets have a higher priority, and the ranked attack events are added to the queue of pending attack events. Then, according to the attack target information of each attack event in the queue of pending attack events, such as the IP address of the target server, the target application, etc., the specific target for which defense measures need to be taken is determined to form a defense target list, such as the server IP address to be protected, the malicious domain name to be shielded, etc. According to the defense target list, combined with the pre-defined defense strategy library, defense strategy retrieval is performed. The defense strategy library contains defense strategies for various attack types, such as traffic cleaning strategies for DDoS attacks, Web application firewall rules for SQL injection attacks, and terminal antivirus software strategies for malware. The retrieval process can match according to information such as defense target type, attack type, and attack method, and screen out all effective defense strategies to form a candidate defense strategy set. The candidate defense strategy set is predicted for strategy effect using methods such as attack simulation and threat intelligence analysis. For example, you can simulate attackers using known attack methods to attack the defense target to test whether the candidate defense strategy can effectively prevent the attack, or analyze whether the candidate defense strategy can cope with the latest attack trends based on threat intelligence. According to the prediction results, evaluate the expected effect of each candidate defense strategy, such as defense success rate, false alarm rate, missed alarm rate, etc., to form a defense strategy effect prediction set. According to the defense strategy effect prediction set, select one or more candidate defense strategies with the best expected effect for deployment. For example, you can send the selected defense strategy to the corresponding security device for configuration, or call the API interface of the security management platform to perform the corresponding defense action, and finally obtain the deployed defense strategy. According to the deployed defense strategy, monitor the defense effect of real-time traffic data flow. For example, you can monitor the execution of the defense strategy, such as how much malicious traffic is intercepted, how many attack attempts are blocked, etc., as well as the status changes of the defense target, such as whether the server is still online, whether the application is running normally, etc. Collect the monitoring data to form defense effect monitoring data, which is used to evaluate the actual effect of the defense strategy. The defense strategy deployed in step S44 is dynamically adjusted according to the visual attack analysis report generated in step S3, the pre-defined defense strategy library, and the defense effect monitoring data collected in step S45.For example, if it is found that the deployed defense strategy cannot effectively prevent the attack, a new defense strategy can be retrieved from the defense strategy library for replacement based on the attacker's latest attack methods provided in the attack analysis report; if it is found that the false alarm rate of the deployed defense strategy is too high, the defense strategy can be optimized and adjusted based on the defense effect monitoring data and normal business traffic characteristics to reduce the false alarm rate, and finally a dynamic defense strategy can be obtained to achieve adaptive defense against network attacks.

[0173] Preferably, step S5 comprises the following steps:

[0174] Step S51: Record defense events according to the dynamic defense strategy and the visual attack analysis report to obtain defense event log data;

[0175] Step S52: performing a defense system performance evaluation on the defense event log data to obtain a defense system performance evaluation report;

[0176] Step S53: performing a root cause analysis according to the defense system performance evaluation report to obtain a root cause analysis report;

[0177] Step S54: Generate a three-layer defense system optimization plan based on the problem root cause analysis report to obtain a three-layer defense system optimization plan;

[0178] Step S55: Perform a three-layer defense system update process according to the three-layer defense system optimization solution to achieve network security protection.

[0179] The present invention forms complete defense event log data by recording the execution of dynamic defense strategies and key information in attack analysis reports, which can provide detailed data basis for subsequent defense system performance evaluation and optimization. By analyzing the defense event log data and evaluating various performance indicators of the defense system, such as defense success rate, false alarm rate, response time, etc., the operation status of the defense system can be fully understood, and potential security risks and improvement directions can be found. For the problems found in the defense system performance evaluation, in-depth root cause analysis is carried out, such as analyzing the root causes of attack omissions and false alarms, the crux of the problem can be found, and a basis for formulating effective optimization plans is provided. According to the results of the root cause analysis of the problem, a targeted three-layer defense system optimization plan is formulated, such as optimizing the boundary defense strategy, updating the active defense model, improving the adaptive defense mechanism, etc., which can effectively improve the overall security protection capability of the defense system. According to the optimization plan, the defense system is updated, such as updating the security device configuration, upgrading the software version, adjusting the policy parameters, etc., the optimization plan can be implemented, and the security protection effect of the defense system can be effectively improved.

[0180] In an embodiment of the present invention, the execution of the dynamic defense strategy in step S4 is collected, such as the specific traffic information of the triggering strategy rules, the intercepted attack behavior, the alarm information, etc., and the attack event information recorded in the visual attack analysis report, such as the attack type, attack time, attack target, etc. This information is associated, and the defense action and defense result taken by the defense system for each attack event are recorded to form detailed defense event log data, such as recording that a certain defense strategy successfully intercepted a DDoS attack from a specific IP address. The defense event log data is analyzed to evaluate the overall performance of the defense system. For example, indicators such as the defense success rate, the attack false alarm rate, the attack missed alarm rate, and the defense response time can be counted, and the differences in the defense effects of different attack types and different defense strategies can be analyzed, and finally a defense system performance evaluation report is formed, such as showing the defense success rate and average response time of various attack types in the past period of time. For the deficiencies of the defense system found in the defense system performance evaluation report, such as the defense success rate is lower than expected, the false alarm rate is too high, and the root cause analysis of the problem is performed. For example, the reasons for missed attacks can be analyzed, such as whether they are caused by incorrect rule configuration or insufficient security device performance. The reasons for false alarms can also be analyzed, such as whether they are caused by normal traffic characteristics being too similar to attack traffic characteristics or by overly strict defense strategies. By deeply analyzing the root causes of the problem, a root cause analysis report is formed, such as pointing out that the high missed rate of a certain type of attack is due to the lack of the latest defense strategy for this type of attack. According to the root cause analysis report, a targeted three-layer defense system optimization plan is formulated. For example, for the border defense layer, the traffic collection strategy can be optimized, the traffic analysis model can be updated, and the anomaly detection rules can be adjusted; for the active defense layer, the attack intent identification algorithm can be optimized, the threat intelligence library can be expanded, and the attack tracing mechanism can be improved; for the adaptive defense layer, the defense strategy library can be optimized, the defense effect prediction model can be improved, and the dynamic adjustment efficiency of the defense strategy can be improved. Finally, a three-layer defense system optimization plan containing specific optimization measures is formed. For example, for the problem of high missed rate of a certain type of attack, optimization measures such as updating relevant defense strategies and strengthening the performance of security devices are proposed. According to the formulated three-layer defense system optimization plan, the defense system is updated. For example, you can update the defense strategy configuration of security devices, upgrade the algorithm model of the traffic analysis engine, expand the data source of the threat intelligence database, etc. By implementing the optimization plan, the overall security protection capability of the defense system can be improved. For example, after updating the defense strategy, the false alarm rate of a certain type of attack is effectively reduced, and the overall security of the defense system is improved.

[0181] Preferably, step S53 includes the following steps:

[0182] Step S531: collecting problem instances according to the defense system performance evaluation report to obtain a problem instance data set;

[0183] Step S532: searching for similar cases based on the problem instance data set to obtain a similar case list;

[0184] Step S533: Perform multi-angle correlation analysis based on the problem instance data set, the similar case list and the defense event log data to obtain a problem correlation analysis diagram;

[0185] Step S534: Make a root cause hypothesis and verify the root cause based on the problem association analysis diagram and the similar case list to obtain a verified root cause list;

[0186] Step S535: Generate a problem root cause analysis report based on the verified root cause list, the problem association analysis diagram, and the problem instance data set to obtain a problem root cause analysis report.

[0187] The present invention collects specific defense system performance problems from the defense system performance evaluation report and forms a structured data set, which can provide clear problem descriptions and related information for subsequent root cause analysis, thereby improving analysis efficiency. By searching data sources such as historical problem libraries and security knowledge bases, cases similar to the current problem can be found, and historical experience can be used to provide reference directions for root cause analysis, avoid repeated analysis, and improve problem solving efficiency. Problem instances, similar cases, and defense event log data are analyzed in association, and a problem association analysis diagram is constructed, which can more comprehensively understand the context information of the problem, discover the potential association relationship between the problems, and provide more abundant clues for the root cause hypothesis. Root cause hypotheses are made based on the problem association analysis diagram and similar case information, and verified by collecting evidence, which can gradually eliminate interference factors, find the real root cause of the problem, and improve the accuracy of root cause analysis. The verified root cause, problem association analysis diagram, problem instance information, etc. are integrated to generate a structured analysis report, which can clearly present the problem analysis process and conclusions, provide guidance for subsequent defense system optimization, and improve the effectiveness of security protection.

[0188] In the embodiment of the present invention, the defense system performance problems that need to be focused on are extracted from the defense system performance evaluation report, such as the defense success rate of a certain type of attack is lower than expected, and some security devices frequently have false alarms. For each problem, relevant detailed information is collected, such as problem description, attack type involved, security device with problems, relevant time range, etc., to form a problem instance data set, and each instance represents a defense system performance problem to be analyzed. Using text similarity algorithm or case reasoning technology, similar cases are retrieved from data sources such as historical problem database, security knowledge base, network security forum, etc. according to the collected problem instance data set. For example, the description text of the problem instance can be matched with the existing case description in the database, or the key features of the problem instance can be extracted and compared with the cases in the case library, and historical cases similar to the current problem instance can be screened out to form a similar case list. Combined with the problem instance data set, the similar case list, and the defense event log data, multi-angle correlation analysis is performed. For example, the correlation between the occurrence time of the problem instance, the attack type involved, the triggered defense strategy and other information and the defense event log data can be analyzed, and the common features and differences between the problem instance and similar cases can also be analyzed. Using tools such as graph databases, the association analysis results are visualized as a problem association analysis graph. For example, the nodes in the graph represent problem instances, similar cases, defense events, etc., and the edges represent the associations between them. Based on the problem association analysis graph and the root cause analysis information provided in the similar case list, hypotheses are made about the potential root causes of the problem instances. For example, if multiple similar cases point to a configuration error of a security device, it can be assumed that the current problem is also caused by the configuration error of the security device. Then, based on the hypothesized root cause, relevant evidence is collected for verification, such as checking the configuration parameters of the security device and analyzing the abnormal information in the defense event log data. Finally, the verified root causes are screened out to form a list of verified root causes. Based on the verified root cause list, the constructed problem association analysis graph, and the problem instance data set, a problem root cause analysis report is automatically generated. The report should clearly describe the specific manifestations of each problem, analyze the potential root causes of the problem, list the evidence supporting the root cause analysis, and propose corresponding solutions or improvement suggestions for each root cause, such as suggesting to modify the configuration parameters of the security device and update the defense policy rule base. Finally, a structured, readable, and instructive problem root cause analysis report is formed.

[0189] The present invention constructs an accurate normal traffic baseline model by analyzing historical traffic data, can effectively distinguish normal and abnormal network behaviors, provide a reliable basis for subsequent anomaly detection, reduce the false alarm rate, and improve the accuracy of security protection. Real-time collection of network traffic data, and combined with the baseline model and adaptive confidence interval for anomaly detection, can timely discover traffic that deviates from the normal mode, improve the accuracy and timeliness of anomaly detection, and provide candidate targets for attack tracing. Through means such as association analysis, attack map construction, and intelligence association analysis, the behavior patterns and intentions of attackers can be deeply excavated to form comprehensive and accurate attack analysis results, providing support for the response and decision-making of security incidents. According to the attack analysis results, the defense strategy is dynamically adjusted, and the defense effect is monitored in real time, which can effectively respond to the ever-changing network attack means, improve the flexibility and adaptability of the defense system, and achieve more intelligent security defense. By continuously evaluating the performance of the defense system, analyzing the root cause of the problem, and optimizing iterative optimization, the security protection capability of the defense system can be continuously improved, and a more secure and reliable network environment can be built. Through the three-layer defense structure, big data technology is used to perform traffic clustering and anomaly identification in the border defense layer (step S1), big data technology is used to perform anomaly detection and attack tracing in the active defense layer (step S2-step S3), and dynamic defense strategy adjustment and continuous defense optimization based on big data are performed in the adaptive defense layer (step S4-step S5), which effectively solves the problem of attackers using big data technology to carry out covert attacks and evade traditional defenses, and realizes the accurate discovery and tracing of unknown threats and complex attacks. Therefore, the present invention provides a network security protection method based on big data. It solves the shortcomings of a traditional network security protection method based on big data when attackers use big data technology to attack, and improves the overall intelligence level of the defense system and the ability to resist big data attacks.

[0190] Therefore, the embodiments should be regarded as illustrative and non-restrictive from all points, and the scope of the present invention is limited by the appended claims rather than the above description, and it is therefore intended that all changes falling within the meaning and range of equivalent elements of the application documents are included in the present invention.

[0191] The above description is only a specific embodiment of the present invention, so that those skilled in the art can understand or implement the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but should conform to the widest scope consistent with the principles and novel features invented herein.

Claims

1. A network security protection method based on big data, characterized in that: The following steps are involved: Step S1: obtaining original network traffic data through a data pipeline tool; dividing the original network traffic data into time windows to obtain time window traffic data; A clustering feature description analysis is performed according to the time window traffic data to obtain a traffic clustering label model; a normal traffic baseline model is generated according to the traffic clustering label model and the time window traffic data to obtain a normal traffic baseline model; step S1 includes the following steps: Step S11: obtaining original network traffic data through a data pipeline tool; dividing the original network traffic data into time windows to obtain time window traffic data; performing clustering feature description analysis on the time window traffic data to obtain a traffic clustering label model; Step S11 includes the following steps: Step S111: Aggregate the original data of the network device through the data pipeline tool to obtain the original network flow data; perform flow data preprocessing on the original network flow data to obtain preprocessed flow data; Step S112: Reconstruct the session according to the pre-processed traffic data to obtain session data; divide the time window according to the session data to obtain time window traffic data; Step S113: extracting features and performing feature selection on the time window traffic data to obtain a feature vector data set; performing traffic clustering analysis and modeling on the feature vector data set to obtain a traffic clustering model; Step S114: performing clustering feature description analysis based on the traffic clustering model and the feature vector data set to obtain a traffic clustering label model; Step S12: using the traffic clustering label model to score the abnormal behavior of the time window traffic data to obtain the time window abnormality score; Step S13: performing abnormal flow judgment on the time window flow data according to the time window abnormal score and a preset abnormal score threshold to obtain abnormal flow judgment data; Step S14: fitting a probability distribution model according to the abnormal flow judgment data and defining a normal flow range according to a preset confidence interval to obtain normal flow range data; Step S15: Generate a normal flow baseline model according to the normal flow range data to obtain a normal flow baseline model; Step S2: collect real-time traffic from network devices to obtain real-time traffic data streams; use a normal traffic baseline model to perform an abnormal probability distribution analysis on the real-time feature stream to obtain a real-time abnormal feature stream; obtain an abnormal score for historical traffic data; calculate a baseline confidence interval based on the abnormal score for historical traffic data to obtain a baseline confidence interval; perform an adaptive confidence interval adjustment based on the baseline confidence interval and the real-time abnormal feature stream to obtain an adaptive confidence interval; perform abnormal traffic marking on the real-time abnormal feature stream based on the adaptive confidence interval to obtain abnormal traffic marking data; Step S3: infer attack intentions based on abnormal traffic mark data to obtain preliminary attack intention data; perform intelligence correlation analysis based on the preliminary attack intention data to obtain attack intention supporting data; modify the preliminary attack intention data based on the attack intention supporting data and enhance the intention to obtain attack intention enhanced data; generate a visual attack report based on the attack intention enhanced data to obtain a visual attack analysis report; Step S4: Retrieve defense strategies according to the visualized attack analysis report to obtain a candidate defense strategy set; monitor the defense effect of the real-time traffic data flow according to the visualized attack analysis report and the candidate defense strategy set to obtain defense effect monitoring data; dynamically adjust the defense strategy according to the visualized attack analysis report and the defense effect monitoring data to obtain a dynamic defense strategy; Step S5: Evaluate the performance of the defense system according to the dynamic defense strategy and the visualized attack analysis report to obtain a defense system performance evaluation report; perform root cause analysis according to the defense system performance evaluation report to obtain a root cause analysis report; generate a three-layer defense system optimization plan according to the root cause analysis report and perform a three-layer defense system update process to achieve network security protection.

2. The network security protection method based on big data according to claim 1 is characterized in that: Step S2 includes the following steps: Step S21: collecting real-time traffic of network devices through a data pipeline tool to obtain a real-time traffic data stream; extracting streaming features from the real-time traffic data stream to obtain a real-time feature stream; Step S22: using the normal traffic baseline model to calculate the degree of deviation of the real-time traffic behavior and perform abnormal probability distribution analysis on the real-time feature flow to obtain the real-time abnormal feature flow; Step S23: Obtain anomaly scores of historical traffic data; perform baseline confidence interval calculation based on anomaly scores of historical traffic data to obtain a baseline confidence interval; perform adaptive confidence interval adjustment based on the baseline confidence interval and the real-time abnormal feature flow to obtain an adaptive confidence interval; Step S24: performing time series analysis on the real-time abnormal feature flow according to the adaptive confidence interval and marking the abnormal pattern to obtain abnormal pattern marking data; Step S25: performing abnormal event aggregation on the abnormal pattern marking data to obtain an abnormal event list; performing abnormal event classification on the abnormal event list and performing abnormal traffic marking to obtain abnormal traffic marking data.

3. The network security protection method based on big data according to claim 2 is characterized in that: Step S23 includes the following steps: Step S231: Obtain anomaly scores of historical traffic data; construct anomaly score time series for the anomaly scores of historical traffic data to obtain anomaly score time series; Step S232: performing time series smoothing processing on the anomaly score time series to obtain an anomaly score smoothed time series; Step S233: performing time series decomposition on the abnormal score smoothed time series to obtain time series decomposition data, wherein the time series decomposition data includes trend component data, seasonal component data and residual component data; Step S234: Calculate the baseline confidence interval based on the trend component data and the seasonal component data to obtain the baseline confidence interval; Step S235: performing random fluctuation analysis of residual components of real-time flow according to residual component data and real-time abnormal characteristic flow to obtain random fluctuation data of residual components; Step S236: performing adaptive confidence interval adjustment according to the baseline confidence interval, the residual component random fluctuation data and the preset adjustment parameters to obtain an adaptive confidence interval.

4. The network security protection method based on big data according to claim 1 is characterized in that: Step S3 includes the following steps: Step S31: performing abnormal event correlation according to the abnormal traffic mark data to obtain abnormal event correlation data; constructing an attack graph for the abnormal event correlation data to obtain an attack graph; Step S32: performing attack pattern matching on the attack graph and the preset attack pattern library to obtain matching attack pattern data; performing attack intention inference based on the matching attack pattern data to obtain preliminary attack intention data; Step S33: performing intelligence correlation analysis based on the preliminary attack intention data to obtain attack intention supporting data; performing attack intention correction and intention enhancement on the preliminary attack intention data based on the attack intention supporting data to obtain attack intention enhanced data; Step S34: performing attack target identification according to the attack intention enhancement data to obtain attack target data; performing impact range assessment according to the attack target data to obtain potential impact range data; Step S35: Perform risk level assessment based on the attack intention enhancement data, the attack target data, and the potential impact range data to obtain attack event risk level data; Step S36: Generate a visual attack report based on the attack event risk level data, attack target data, attack target data, potential impact range data, and attack intention enhancement data to obtain a visual attack analysis report.

5. The network security protection method based on big data according to claim 4 is characterized in that: Step S33 includes the following steps: Step S331: Identify the intelligence requirements of the preliminary attack intention data to obtain a threat intelligence requirement list; Step S332: performing a multi-source intelligence search on a preset threat intelligence database according to the threat intelligence requirement list to obtain a candidate threat intelligence set; Step S333: performing intelligence credibility evaluation on the candidate threat intelligence set to obtain a threat intelligence credibility score set; Step S334: performing intelligence correlation analysis on the preliminary attack intention data and the threat intelligence credibility score set to obtain attack intention supporting data; Step S335: modify the initial attack intention data according to the attack intention supporting data and enhance the intention to obtain attack intention enhanced data.

6. The network security protection method based on big data according to claim 1 is characterized in that: Step S4 includes the following steps: Step S41: Prioritize attack events according to the visualized attack analysis report to obtain a queue of attack events to be processed; determine defense targets according to the queue of attack events to be processed to obtain a list of defense targets; Step S42: performing defense strategy retrieval according to the defense target list and the preset defense strategy library to obtain a candidate defense strategy set; Step S43: predicting the strategy effect of the candidate defense strategy set according to the visualized attack analysis report to obtain a defense strategy effect prediction set; Step S44: performing strategy deployment processing on the candidate defense strategy set according to the defense strategy effect prediction set to obtain a deployed defense strategy; Step S45: monitoring the defense effect of the real-time traffic data flow according to the deployed defense strategy to obtain defense effect monitoring data; Step S46: dynamically adjust the deployed defense strategy according to the visualized attack analysis report, the preset defense strategy library, and the defense effect monitoring data to obtain a dynamic defense strategy.

7. The network security protection method based on big data according to claim 1 is characterized in that: Step S5 includes the following steps: Step S51: Record defense events according to the dynamic defense strategy and the visual attack analysis report to obtain defense event log data; Step S52: performing a defense system performance evaluation on the defense event log data to obtain a defense system performance evaluation report; Step S53: performing a root cause analysis according to the defense system performance evaluation report to obtain a root cause analysis report; Step S54: Generate a three-layer defense system optimization plan based on the problem root cause analysis report to obtain a three-layer defense system optimization plan; Step S55: Perform a three-layer defense system update process according to the three-layer defense system optimization solution to achieve network security protection.

8. The network security protection method based on big data according to claim 7 is characterized in that: Step S53 includes the following steps: Step S531: collecting problem instances according to the defense system performance evaluation report to obtain a problem instance data set; Step S532: searching for similar cases based on the problem instance data set to obtain a similar case list; Step S533: Perform multi-angle correlation analysis based on the problem instance data set, the similar case list and the defense event log data to obtain a problem correlation analysis diagram; Step S534: Make a root cause hypothesis and verify the root cause based on the problem association analysis diagram and the similar case list to obtain a verified root cause list; Step S535: Generate a problem root cause analysis report based on the verified root cause list, the problem association analysis diagram, and the problem instance data set to obtain a problem root cause analysis report.

Images