Computer network security situation awareness method and system

Abstract

The invention relates to the technical field of network security analysis, in particular to a computer network security situation awareness method and system, and the method comprises the following steps: collecting the login time, login position and equipment type of a user and the operation activity data after login, calculating the behavior feature value of the user according to the collected parameters, and calculating the behavior feature value of the user; and analyzing the relation and the variation amplitude among the behavior parameters and the behavior mode of each user, and establishing user behavior reference data. According to the invention, by establishing the user behavior reference, analyzing the login frequencies at different time and geographic positions and establishing the dynamic login probability model, the judgment of the login behavior is more real-time and personalized. By comparing the login data captured in real time with the reference behavior, the abnormal login behavior can be quickly identified, and the accuracy of safety protection is remarkably enhanced. A time window is set, an abnormal behavior threshold value is adjusted through flow and behavior relevance, and the perception and response speed of potential threats is effectively improved.

Description

Technical Field

[0001] The present invention relates to the technical field of network security analysis, and in particular to a computer network security situation awareness method and system. Background Art

[0002] The field of network security analysis technology is used to protect computer networks from unauthorized access, attacks, damage or other security threats. The field includes but is not limited to threat detection, traffic analysis, vulnerability management and response strategies. Using various software tools and analysis technologies, such as intrusion detection systems (IDS), intrusion prevention systems (IPS) and security information and event management (SIEM) systems, monitor network activities, identify potential security incidents in real time, analyze abnormal behavior, and take measures to prevent or mitigate the impact of security attacks.

[0003] Among them, the computer network security situation awareness method is a branch of network security analysis, which involves the use of comprehensive technologies to collect, analyze and evaluate network security data to obtain the global security status of the network. The purpose of this method is to improve the visibility and transparency of the network and help the security team understand and respond to various security threats in a timely manner. By monitoring network traffic and behavior in real time, the state awareness system can identify abnormal behavior, discover potential security vulnerabilities and intrusion attempts, so that the security team can respond quickly and take appropriate security measures.

[0004] When identifying abnormal behaviors, the existing technologies can analyze them by real-time monitoring of network traffic and behaviors. However, they are prone to false positives or omissions in complex network environments and diverse attack methods. Its fixed analysis mode makes it difficult to distinguish between normal and abnormal behaviors of different users at different times and geographical locations, resulting in insufficient accuracy and difficulty in responding quickly. In addition, the existing technologies are difficult to adapt quickly when encountering a constantly changing network environment. This reduces the efficiency of identifying potential threats, increases the exposure time of network risks, and results in attacks not being blocked or identified in a timely manner, affecting the overall network security protection effect. Summary of the invention

[0005] The purpose of the present invention is to solve the shortcomings of the prior art and to propose a computer network security situation awareness method and system.

[0006] In order to achieve the above object, the present invention adopts the following technical solution: a computer network security situation awareness method, comprising the following steps:

[0007] S1: Collect the user's login time, login location, device type and post-login operation activity data, calculate the user's behavior feature value based on the collected parameters, analyze the connection and change range between the behavior parameters, as well as each user's behavior pattern, and establish user behavior benchmark data;

[0008] S2: Based on the user behavior benchmark data, calculate the user's login frequency during working hours and non-working hours, and in various geographical locations, apply the statistical results to conditional analysis, and generate a dynamic login probability model by weighting the conditional information;

[0009] S3: applying the real-time captured attempted login data to the dynamic login probability model, calculating the probability value of the login data under the current environment and time, comparing it with the behavior feature value of the user behavior benchmark data, identifying the login attempt behavior with a probability lower than the benchmark mode, and generating an abnormal login mark;

[0010] S4: Based on the abnormal login identifier, define a time window for network behavior analysis, monitor and analyze network traffic during working and non-working hours, adjust the threshold of abnormal behavior according to the correlation between behavior in multiple time periods and abnormal login, and generate network behavior analysis results.

[0011] As a further solution of the present invention, the step of obtaining the user's behavior feature value is specifically as follows:

[0012] S111: Collect the user's login time, login location, device type and post-login operation activity data through network monitoring, GPS or IP address resolution and clickstream analysis to generate initial user behavior data;

[0013] S112: According to the initial user behavior data, the formula is used:

[0014]

[0015] Calculate the user behavior characteristic value C;

[0016] Where i is the index of the operation, f i is the frequency of the ith operation, d i is the device type weight of the ith operation, t i is the time weight of the ith operation, l i is the geographical location weight of the ith operation, p i is the activity weight of the ith operation, and N is the total number of operations by the user during the analysis period;

[0017] S113: According to the user behavior characteristic value, by setting a behavior characteristic threshold, evaluating the user behavior, identifying anomalies or potential risks in the behavior pattern, and establishing user behavior benchmark data.

[0018] As a further solution of the present invention, the steps of calculating the user's login frequency during working hours and non-working hours, and in various geographical locations are specifically as follows:

[0019] S211: extracting login time, location, device type and operation activity data from the user behavior benchmark data, including records of working and non-working hours, and login information of geographic location, and performing time synchronization and location verification to obtain user behavior analysis results;

[0020] S212: According to the user behavior analysis result, the formula is used:

[0021]

[0022] Calculate the user's login frequency P at a specified time t', geographic location l', security level s, and normalization factor h login (t',l',s,h);

[0023] Where j is the index representing a single login event, N' is the total number of login events considered, and g j is the number of logins in the jth event, α t' is the adjustment coefficient at time t', β l' is the adjustment coefficient for the geographical location l', γs is the adjustment coefficient for the security level s, and h is the normalization factor.

[0024] As a further solution of the present invention, the step of acquiring the weighted condition information is specifically as follows:

[0025] S221: Identify login behaviors that are inconsistent with normal patterns based on login time and geographic location, analyze security risks, and generate abnormal activity identification results;

[0026] S222: According to the abnormal activity identification result and the login frequency, the formula is used:

[0027]

[0028] Calculate the average value Pdynamic of weighted login frequency under multiple conditions and build a dynamic login probability model;

[0029] Where k is the condition index, representing a combination of time and geographic location, and M is the total number of conditions considered. is the login frequency under the k-th condition, and wk is the weight of the k-th condition.

[0030] As a further solution of the present invention, the step of obtaining the probability value of the calculated login data under the current environment and time is specifically:

[0031] S311: applying the real-time captured login attempt data to the dynamic login probability model, monitoring and recording all login attempt activities in real time through network monitoring, the real-time data is transmitted to the dynamic login probability model, and the model updates its output according to the new data to obtain an updated dynamic login probability model;

[0032] S312: According to the updated dynamic login probability model, the formula is used:

[0033]

[0034] Calculate the probability value Pcurrent of the current login attempt calculated under the specified environment and time;

[0035] Among them, Rt is the match degree between the time of the current login attempt and the known risk time, Ls

[0036] is the match degree between the login attempt location and the known risk location, Dc

[0037] is the matching degree between the equipment used and the equipment with known risks, and Sf is the adjustment factor of the current security level.

[0038] As a further solution of the present invention, the step of obtaining the login attempt behavior with a recognition probability lower than the benchmark mode is specifically:

[0039] S321: Compare and analyze the behavior feature value of the current login attempt with the probability value of the current login attempt, and evaluate the consistency between the current login attempt and the regular user behavior with reference to the difference in the values ​​and the change trend of the behavior pattern, and generate a risk rating result;

[0040] S322: According to the risk rating result, the formula is used:

[0041]

[0042] Calculate the deviation ratio Pcompare between the behavior feature value of the current login attempt and the benchmark behavior feature value;

[0043] S323: Based on the deviation ratio information, after the recognition probability value deviates from the normal behavior pattern, the login attempt is marked as abnormal, and the associated information is recorded to generate an abnormal login identifier.

[0044] As a further solution of the present invention, the step of obtaining the threshold value for adjusting abnormal behavior is specifically as follows:

[0045] S411: defining a time window for network behavior analysis, including determining a key monitoring period according to a network activity pattern and generating a monitoring time list;

[0046] S412: According to the monitoring time list and abnormal login identification, the formula is used:

[0047]

[0048] Calculate the adjusted abnormal behavior threshold Tadjust and generate network behavior analysis results;

[0049] Among them, Tbase is the basic threshold and Q is the adjustment coefficient.

[0050] A computer network security situation awareness system, the computer network security situation awareness system is used to execute the above-mentioned computer network security situation awareness method, the system comprises:

[0051] The data collection module collects the user's login time, login location, device type and post-login operation activity data, integrates the data into a user's behavior record, and generates initial data on user behavior characteristics;

[0052] The behavior pattern analysis module analyzes the connection and variation range between the behavior parameters based on the initial data of the user behavior characteristics, constructs the behavior pattern of each user, and generates user behavior benchmark data;

[0053] The login dynamic model module is based on the user behavior benchmark data, considers the geographic location data, integrates the login frequency and geographic location data, calculates the login frequency during working hours and non-working hours, and establishes a dynamic login probability model;

[0054] The real-time monitoring module applies the real-time captured login attempt data to the dynamic login probability model, identifies login attempts that deviate from the baseline pattern, and generates an abnormal login identifier;

[0055] The network behavior adjustment module monitors and analyzes the network traffic in working and non-working hours based on the abnormal login identifier, adjusts the correlation threshold between behaviors in multiple time periods and abnormal logins, and generates network behavior analysis results.

[0056] Compared with the prior art, the advantages and positive effects of the present invention are:

[0057] In the present invention, by establishing a user behavior benchmark, analyzing the login frequency at different times and geographical locations, and establishing a dynamic login probability model, the determination of login behavior is made more real-time and personalized. By comparing the login data captured in real time with the benchmark behavior, abnormal login behavior can be quickly identified, significantly enhancing the accuracy of security protection. By setting a time window and adjusting the abnormal behavior threshold through the correlation between traffic and behavior, the perception and response speed to potential threats are effectively improved, and it can also dynamically adapt to complex and changeable network environments, reduce false alarms, and improve the accuracy of network abnormal behavior detection. At the same time, multiple monitoring methods for abnormal logins and network traffic behaviors have achieved more comprehensive network security protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] Figure 1 It is a schematic diagram of the workflow of the present invention;

[0059] Figure 2 A flowchart of the steps for obtaining the behavior feature value of a user calculated by the present invention;

[0060] Figure 3 A flow chart of the steps for calculating the user's login frequency during working hours and non-working hours, and in various geographical locations in the present invention;

[0061] Figure 4 A flow chart of the steps for obtaining weighted condition information of the present invention;

[0062] Figure 5 A flow chart of the steps for obtaining the probability value of the login data under the current environment and time in the present invention;

[0063] Figure 6 A flow chart of the steps for obtaining login attempt behaviors with a probability lower than a baseline mode according to the present invention;

[0064] Figure 7 A flow chart of the steps for obtaining the threshold value for adjusting abnormal behavior according to the present invention. DETAILED DESCRIPTION

[0065] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0066] In the description of the present invention, it should be understood that the terms "length", "width", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside" and the like indicate positions or positional relationships based on the positions or positional relationships shown in the drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present invention. In addition, in the description of the present invention, "multiple" means two or more, unless otherwise clearly and specifically defined.

[0067] See also Figure 1 The present invention provides a technical solution: a computer network security situation awareness method, comprising the following steps:

[0068] S1: Collect the user's login time, login location, device type and post-login operation activity data, calculate the user's behavior feature value based on the collected parameters, analyze the connection and change range between the behavior parameters, as well as each user's behavior pattern, and establish user behavior benchmark data;

[0069] S2: Based on user behavior benchmark data, calculate the user's login frequency during working hours and non-working hours, and in various geographical locations, apply the statistical results to conditional analysis, and generate a dynamic login probability model by weighting the conditional information;

[0070] S3: Apply the real-time captured login attempt data to the dynamic login probability model, calculate the probability value of the login data under the current environment and time, compare it with the behavior feature value of the user behavior benchmark data, identify the login attempt behavior with a probability lower than the benchmark mode, and generate an abnormal login mark;

[0071] S4: Based on the abnormal login identification, define the time window for network behavior analysis, monitor and analyze the network traffic during working and non-working hours, adjust the threshold of abnormal behavior according to the correlation between the behavior in multiple time periods and abnormal login, and generate network behavior analysis results;

[0072] User behavior benchmark data includes users' frequently used login time periods, frequently used login locations and device types, and categories of major activities after login. The dynamic login probability model includes probability factors based on time periods, geographic location sensitivity factors, and impact assessments of user device preferences. Abnormal login identification includes login attempt information under probability thresholds, login attempt information with abnormal time and location, and login attempt information that does not match commonly used devices. Network behavior analysis results include an overview of network activities classified by time periods, comparative statistics of abnormal login behavior and normal behavior, and threshold adjustment information based on behavior pattern recognition.

[0073] See also Figure 2 , the specific steps for calculating the user's behavior feature value are:

[0074] S111: Collect the user's login time, login location, device type and post-login operation activity data, including capturing the login time and device type through network monitoring. Geographic location information is obtained through location services on the user's device such as GPS or through IP address resolution. Operation activity data is obtained through front-end tracking technologies such as clickstream analysis and behavior tagging. Each user operation is recorded in the data log, including the type of operation and the specific time of execution. All collected data is encrypted through a security protocol and transmitted to the database, where it is cleaned and normalized to ensure the accuracy and consistency of the data and generate initial user behavior data;

[0075] S112: Based on the initial user behavior data, use the formula:

[0076]

[0077] Calculate the user behavior characteristic value C;

[0078] Among them, C reflects the user's behavior pattern in a specific monitoring period, i is the index of the operation, and fi

[0079] is the frequency of the ith operation, directly obtained from the behavior log data, and di is the ith

[0080] The device type weight for this operation is a preset weight based on the security attributes of the device (such as company equipment, personal equipment). Devices with higher security levels receive higher weights. ti is the i-th device type.

[0081] The time weight of the operation is obtained by analyzing the overlap between the specific time of the user's login and the working time. The operation during the working time is given a higher weight.

[0082] The geographical location weight of the operation is assigned different weights according to the safety of the operation location. Pi is the i-th

[0083] The activity weight of the operation is scored according to the risk level of the operation, N

[0084] is the total number of actions taken by the user during the analysis period;

[0085] If the user performs the following operations within a week:

[0086] During working hours (high weight 1.2), the company computer (weight 1.5) was used to perform system configuration (high-risk operation, weight 3), with an operation frequency of 4 times.

[0087] Using personal devices (weight 1.0) to browse the web during non-working hours (weight 0.8) (low-risk operation, weight 1), with an operation frequency of 6 times.

[0088] Calculate the behavior characteristic value:

[0089]

[0090] The calculation result is used to indicate the possibility that the user has engaged in high-risk behavior during the monitoring period.

[0091] S113: Based on the user behavior feature value, the analysis of user behavior includes the identification of behavior patterns and risk assessment. By setting a threshold, it is determined whether the behavior is abnormal. For example, if the behavior feature value exceeds 2.5, it is considered that the user may have a security risk. Using this data, time series analysis can be performed to observe the changing trend of user behavior over time, especially the differences in behavior in different time periods and locations. This analysis helps the security team identify potential unauthorized operations or attack behaviors, and then adjust security policies, such as enhancing monitoring of high-risk time periods and operations, ensuring timely response to potential security threats, thereby protecting the overall security of the network environment and establishing user behavior baseline data.

[0092] See also Figure 3 , the specific steps for calculating the user's login frequency during working hours and non-working hours, and in various geographical locations are as follows:

[0093] S211: Extract login time, login location, device type and corresponding operation activity data from the user behavior benchmark data. Specifically, the data is collected from the user behavior log, including records of working hours and non-working hours, and login information of users from different geographical locations. During the collection process, each piece of data is synchronized by time and verified by location to ensure its accuracy and consistency, and obtain the user behavior analysis results;

[0094] S212: Based on the results of user behavior analysis, use the formula:

[0095]

[0096] Calculate the user's login frequency P at a specified time t', geographic location l', security level s, and normalization factor h login (t',l',s,h);

[0097] Where j is the index, representing a single login event, N'

[0098] is the total number of login events considered, is the total number of events under specific time and location conditions, g j is the number of logins in the jth event, directly calculated from the user login data, αt’ is the adjustment factor for time t', calculated based on the changes in the user's login behavior during that specific time period, and determined by analyzing the deviation of previously collected data from the expected pattern, β l ' is the adjustment factor for the geographic location l', calculated based on the location's security level and usage frequency, and determined by evaluating the login frequency and related security events of each location in the previously collected data, γ s is the adjustment coefficient of the security level s, which is set according to the security certification level of the system. A higher security level obtains a higher coefficient. h is the normalization factor, which is used to balance abnormal data and enhance the stability of the prediction. It is adjusted by comparing the average login frequency in the previously collected data with the current data;

[0099] If a user logs in 30 times during work hours from a high-security office location using a computer, the total number of work days is 20, and the adjustment factor for previously collected data is 0.95, then the work time login frequency at the office location can be calculated as follows:

[0100]

[0101] The calculation results provide a quantitative indicator that is extremely important for security situation awareness.

[0102] See also Figure 4 , the specific steps for obtaining weighted condition information are:

[0103] S221: applying the user's login frequency to conditional analysis, including data screening and analysis operations, comparing the login frequency with previously collected data, identifying login behaviors that are different from normal patterns based on login time and geographic location, analyzing security risks or abnormal activities, and generating abnormal activity identification results;

[0104] S222: Based on the abnormal activity identification results and login frequency, the formula is used:

[0105]

[0106] Calculate the average value Pdynamic of weighted login frequency under multiple conditions and build a dynamic login probability model;

[0107] Among them, the value of Pdynamic is used to reflect the overall security situation of the user's login behavior under different conditions, k

[0108] is a conditional index, representing different combinations of time and geographical location.

[0109] is the total number of conditions considered, indicating the number of different time and location combinations included in the analysis, determined by statistically analyzing the number of different time and location combinations in the data collected previously. is the login frequency under the kth condition, considering the number of logins and possible login opportunities of the user under this condition, w k is the kth

[0110] The weight of each condition is set according to the security importance of the time and location. A condition with a high weight indicates that the login behavior under this condition needs more attention.

[0111] There are three different login conditions:

[0112] Login during working hours (high-risk time), login frequency Weight w1=1.5.

[0113] Logins during off-hours (low-risk times), login frequency Weight w2=0.5.

[0114] Holiday logins (medium risk time), login frequency Weight w3 = 1.0.

[0115] Calculate Pdynamic:

[0116]

[0117] If the base value is 0.5

[0118] , used to determine whether the user's login behavior exceeds the normal security range. The calculated Pdynamic≈0.3833

[0119] ,The result is lower than the benchmark value, indicating that under all the conditions considered, the user's login behavior is generally at an acceptable security risk level.,It shows that the current security measures are relatively sufficient and have not reached a high risk level that causes security concerns.

[0120] See also Figure 5 , the specific steps for calculating the probability value of login data in the current environment and time are:

[0121] S311: applying the real-time captured login attempt data to the dynamic login probability model, monitoring and recording all login attempt activities in real time through network monitoring, including login time, geographic location, device type used, and other relevant context information, and transmitting the real-time data to the dynamic login probability model. The model updates its output according to the new data, providing updated probability estimates for subsequent analysis, ensuring that the model can immediately reflect login behaviors in the current network environment, and obtaining an updated dynamic login probability model;

[0122] S312: According to the updated dynamic login probability model, the formula is used:

[0123]

[0124] Calculate the probability value Pcurrent of the current login attempt calculated under the specified environment and time;

[0125] Where Rt is the match between the time of the current login attempt and the known high-risk time, Ls

[0126] is the match degree between the login attempt location and known high-risk locations, Dc

[0127] Is the match between the equipment used and known high-risk equipment, Rt, LS, Dc

[0128] Both are obtained by comparing real-time data with risk profiles in a security database.

[0129] It is the adjustment factor of the current security level, which is used to adjust the probability value according to the actual situation;

[0130] Set parameters Pdynamic=0.4, current time matching degree Rt=0.7, location matching degree Ls=0.5, device matching degree Dc=0.6, and security level factor Sf=1.1.

[0131] Calculate Pcurrent:

[0132]

[0133] If the safety reference value is 0.7

[0134] , used to determine whether a login attempt may be abnormal or high risk. The calculated Pcurrent≈0.807 exceeds the baseline value of 0.7

[0135] , indicating that the probability of this login attempt is higher than the normal threshold under the current environment and time, which may indicate high risk or abnormal behavior. It indicates that further investigation and action are required, which may require security warnings or immediate intervention to prevent potential security threats.

[0136] See also Figure 6 , the steps for obtaining login attempts with a recognition probability lower than the baseline mode are as follows:

[0137] S321: Compare and analyze the behavior feature value of the current login attempt with the probability value of the current login attempt, and evaluate the consistency between the current login attempt and the regular user behavior with reference to the difference in the values ​​and the change trend of the behavior pattern, and generate a risk rating result;

[0138] S322: Based on the risk rating results, use the formula:

[0139]

[0140] Calculate the deviation ratio Pcompare between the behavior feature value of the current login attempt and the benchmark behavior feature value;

[0141] Among them, Pcompare is used to identify abnormal login attempts;

[0142] It is known that Pcurrent=0.807 and C=2.64.

[0143] Calculate Pcompare:

[0144]

[0145] Benchmark value setting and result explanation:

[0146] If the abnormality judgment threshold is set to 0.2, the calculated Pcompare = 0.694, far exceeding the threshold of 0.2

[0147] , which clearly indicates that the behavioral feature value of the current login attempt is significantly different from the baseline pattern. This high deviation ratio indicates that the current login attempt may be an abnormal behavior and requires further inspection and response by the security team.

[0148] S323: Based on the deviation ratio information, after the recognition probability value deviates from the normal behavior pattern, this login attempt is marked as abnormal, and the associated information is recorded, including the time, location, device used, and user account information of the login attempt. These records provide the necessary data for further behavior analysis and pattern recognition. At the same time, these abnormal tags can also be used to improve model accuracy, enhance the model's ability to predict potential threats in the future, help continuously optimize network security situation awareness, and generate abnormal login identification.

[0149] See also Figure 7 , the specific steps for obtaining the threshold value for adjusting abnormal behavior are:

[0150] S411: Define the time window for network behavior analysis, including determining key monitoring periods based on network activity patterns, ensuring that the time window covers key stages of working hours and non-working hours, so as to effectively utilize resources for data collection and preliminary traffic monitoring, and generate a monitoring time list;

[0151] S412: According to the monitoring time list and abnormal login identification, the formula is used:

[0152]

[0153] Calculate the adjusted abnormal behavior threshold Tadjust and generate network behavior analysis results;

[0154] Among them, Tbase

[0155] It is the basic threshold, which is determined based on past network behavior analysis and security event logs, and reflects the abnormal identification standard set under normal conditions.

[0156] is an adjustment factor that reflects the sensitivity to changes in the current network environment and is used to adjust the threshold based on the frequency and severity of abnormal login attempts;

[0157] Set parameters: Tbase=0.2, Pcompare=0.5, Q=0.1.

[0158] Calculate Tadjust:

[0159]

[0160] The results show that the adjusted threshold is 0.23, which is higher than the basic threshold of 0.2

[0161] ,It shows that in the current network environment, it is necessary to increase the threshold to adapt to the possible increase of risks.,Such dynamic adjustment helps to respond to the changes of the network environment in real time and ensure the effectiveness of the security ,policy.

[0162] A computer network security situation awareness system, which is used to execute the above-mentioned computer network security situation awareness method, and the system includes:

[0163] The data collection module collects the user's login time, login location, device type and post-login operation activity data, integrates the data into a user's behavior record, and generates initial data on user behavior characteristics;

[0164] The behavior pattern analysis module analyzes the connection and change range between behavior parameters based on the initial data of user behavior characteristics, constructs the behavior pattern of each user, and generates user behavior benchmark data;

[0165] The login dynamic model module is based on user behavior benchmark data, considers geographic location data, integrates login frequency and geographic location data, calculates login frequency during working hours and non-working hours, and establishes a dynamic login probability model;

[0166] The real-time monitoring module applies the real-time captured login attempt data to the dynamic login probability model, identifies login attempts that deviate from the baseline pattern, and generates abnormal login identification;

[0167] The network behavior adjustment module monitors and analyzes network traffic during working and non-working hours based on abnormal login identification, adjusts the correlation threshold between behaviors and abnormal logins in multiple time periods, and generates network behavior analysis results.

[0168] The above are only preferred embodiments of the present invention and are not intended to limit the present invention in other forms. Any technician familiar with the profession may use the technical contents disclosed above to change or modify them into equivalent embodiments with equivalent changes and apply them to other fields. However, any simple modification, equivalent change and modification made to the above embodiments based on the technical essence of the present invention without departing from the technical solution of the present invention still falls within the protection scope of the technical solution of the present invention.

Claims

1. A computer network security situation awareness method, characterized in that: The following steps are involved: Collect the user's login time, login location, device type and post-login operation activity data, calculate the user's behavior feature value based on the collected parameters, analyze the relationship and change range between the behavior parameters, as well as each user's behavior pattern, and establish user behavior benchmark data; Based on the user behavior benchmark data, calculate the user's login frequency during working hours and non-working hours, and in various geographical locations, apply the statistical results to conditional analysis, and generate a dynamic login probability model by weighting the conditional information; Apply the real-time captured login attempt data to the dynamic login probability model, calculate the probability value of the login data under the current environment and time, compare it with the behavior feature value of the user behavior benchmark data, identify the login attempt behavior with a probability lower than the benchmark mode, and generate an abnormal login mark; Based on the abnormal login identifier, a time window for network behavior analysis is defined, and by monitoring and analyzing network traffic during working and non-working hours, the threshold of abnormal behavior is adjusted according to the correlation between behavior in multiple time periods and abnormal logins, and network behavior analysis results are generated.

2. The computer network security situation awareness method according to claim 1 is characterized in that: The steps for obtaining the user's behavior feature value are specifically as follows: Collect the user's login time, login location, device type, and post-login operation activity data through network monitoring, GPS or IP address resolution, and clickstream analysis to generate initial user behavior data; According to the initial user behavior data, the formula is adopted: Calculate the user behavior characteristic value C; Where i is the index of the operation, f i is the frequency of the ith operation, d i is the i The device type weight of the operation, t i is the time weight of the ith operation, l i is the i The geographical location weight of the operation, p i is the activity weight of the ith operation, N is the total number of actions taken by the user during the analysis period; According to the user behavior characteristic values, by setting behavior characteristic thresholds, user behavior is evaluated, anomalies or potential risks in behavior patterns are identified, and user behavior benchmark data is established.

3. The computer network security situation awareness method according to claim 2 is characterized in that: The steps for obtaining the user's login frequency during working hours and non-working hours, and in various geographical locations are specifically as follows: Extracting login time, location, device type and operation activity data from the user behavior benchmark data, including records of working and non-working hours, and login information of geographic location, and performing time synchronization and location verification to obtain user behavior analysis results; According to the user behavior analysis results, the formula is adopted: Calculate the user's login frequency P at a specified time t', geographic location l', security level s, and normalization factor h login (t',l',s,h); Where j is the index representing a single login event, N' is the total number of login events considered, and g j is the number of logins in the jth event, α t' is the adjustment coefficient at time t', β l' is the adjustment coefficient for the geographical location l', γ s is the adjustment coefficient for the security level s, and h is the normalization factor.

4. The computer network security situation awareness method according to claim 3 is characterized in that: The steps of obtaining the weighted condition information are specifically as follows: Identify login behaviors that are inconsistent with normal patterns based on login time and geographic location, analyze security risks, and generate abnormal activity identification results; According to the abnormal activity identification results and login frequency, the formula is used: Calculate the average value P of weighted login frequency under multiple conditions dynamic , build a dynamic login probability model; Where k is the condition index, representing a combination of time and geographic location, and M is the total number of conditions considered. is the login frequency under the kth condition, w k is the weight of the kth condition.

5. The computer network security situation awareness method according to claim 4 is characterized in that: The steps for obtaining the probability value of the calculated login data under the current environment and time are specifically as follows: Applying the real-time captured login attempt data to the dynamic login probability model, monitoring and recording all login attempt activities in real time through network monitoring, the real-time data is transmitted to the dynamic login probability model, and the model updates its output according to the new data to obtain an updated dynamic login probability model; According to the updated dynamic login probability model, the formula is adopted: Calculate the probability value P of the current login attempt calculated under the specified environment and time current ; Among them, R t is the match between the time of the current login attempt and the known risk time, L s is the match between the login attempt location and the known risk location, D c is the matching degree between the equipment used and the equipment with known risks, S f is the adjustment factor for the current security level.

6. The computer network security situation awareness method according to claim 5 is characterized in that: The steps for obtaining the login attempt behavior with a recognition probability lower than the benchmark mode are specifically as follows: Compare and analyze the behavior feature value of the current login attempt with the probability value of the current login attempt, and evaluate the consistency of the current login attempt with the regular user behavior by referring to the difference in the values ​​and the change trend of the behavior pattern to generate a risk rating result; Based on the risk rating results, the formula is used: Calculate the deviation ratio P between the behavior feature value of the current login attempt and the baseline behavior feature value compare ; According to the deviation ratio information, after the recognition probability value deviates from the normal behavior pattern, the login attempt is marked as abnormal, and the associated information is recorded to generate an abnormal login identifier.

7. The computer network security situation awareness method according to claim 6 is characterized in that: The steps of obtaining the threshold value for adjusting abnormal behavior are specifically as follows: Define the time window for network behavior analysis, including determining key monitoring periods based on network activity patterns and generating a monitoring time list; According to the monitoring time list and abnormal login identification, the formula is used: Calculate the adjusted abnormal behavior threshold T adjust , generate network behavior analysis results; Among them, T base is the basic threshold, and Q is the adjustment coefficient.

8. A computer network security situation awareness system, characterized in that: According to any one of claims 1 to 7, the computer network security situation awareness method comprises: The data collection module collects the user's login time, login location, device type and post-login operation activity data, integrates the data into a user's behavior record, and generates initial data on user behavior characteristics; The behavior pattern analysis module analyzes the connection and variation range between the behavior parameters based on the initial data of the user behavior characteristics, constructs the behavior pattern of each user, and generates user behavior benchmark data; The login dynamic model module is based on the user behavior benchmark data, considers the geographic location data, integrates the login frequency and geographic location data, calculates the login frequency during working hours and non-working hours, and establishes a dynamic login probability model; The real-time monitoring module applies the real-time captured login attempt data to the dynamic login probability model, identifies login attempts that deviate from the baseline pattern, and generates an abnormal login identifier; The network behavior adjustment module monitors and analyzes the network traffic in working and non-working hours based on the abnormal login identifier, adjusts the correlation threshold between the behavior in multiple time periods and the abnormal login, and generates a network behavior analysis result.

Images