Network security dynamic early warning method and system based on multi-source data fusion

Abstract

The invention discloses a network security dynamic early warning method and system based on multi-source data fusion, particularly relates to the technical field of network security monitoring and early warning, and evaluates the network protection quality and measures the protection strength and effectiveness by fusing multi-source data; building an attack probability prediction model based on the long-short-term memory network, and obtaining the attack probability of the network in a future time period T; analyzing the user operation behavior, and identifying an abnormal behavior parameter which is not consistent with the normal behavior mode; inputting the abnormal behavior parameters into an operation behavior analysis model to obtain an operation behavior abnormal index; the problems of one-sided information, inaccurate evaluation, inaccurate prediction and slow response are effectively solved, and dynamic early warning of the network security situation is realized; and when the Anx is lower than the security threshold, an early warning mechanism is triggered immediately, so that efficient and comprehensive technical support is provided for network security management, and the stability and security of a network environment are ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of network security monitoring and early warning, and more specifically, to a network security dynamic early warning method and system based on multi-source data fusion. Background Art

[0002] With the rapid development of information technology, security threats in cyberspace are becoming increasingly severe. The means of cyber attacks are not only diverse but also continuously evolving, becoming more complex and covert. Traditional network security early warning methods can no longer meet current security needs. The existing network security early warning systems can monitor and respond to network security incidents to a certain extent.

[0003] However, in actual use, it still has many shortcomings, such as technical problems such as one-sided information, inaccurate assessment, inaccurate prediction and untimely response in existing network security warnings.

[0004] The network security dynamic early warning method based on multi-source data fusion is a comprehensive network security protection strategy. It aims to integrate data from different sources and use advanced data processing technology and algorithms to achieve real-time, comprehensive and accurate monitoring and prediction of network security situation, thereby improving the efficiency and effectiveness of network security protection. Summary of the invention

[0005] In order to overcome the above-mentioned defects of the prior art, the present invention provides a network security dynamic early warning method and system based on multi-source data fusion to solve the problems raised in the above-mentioned background technology.

[0006] To achieve the above object, the present invention provides the following technical solution: a network security dynamic early warning method based on multi-source data fusion, comprising the following steps:

[0007] Step 1: Collect data: Obtain key indicators of network protection quality by collecting system configuration, security vulnerability information, and security event records; obtain historical attack records, network monitoring, and user behavior time series data from security logs and intrusion monitoring systems; and identify abnormal behavior parameters that do not conform to normal behavior patterns by analyzing user operation behaviors;

[0008] Step 2: Data preprocessing: remove duplicate data, invalid data, and noise data; convert data from different sources and formats into a unified format and normalize it for subsequent analysis;

[0009] Step 3: Input the key indicators of network protection quality into the network protection quality analysis model and output the network protection quality index NPQ; the network protection quality index reflects the strength and effectiveness of network protection;

[0010] Step 4: Build an attack probability prediction model based on the long short-term memory network, input historical attack records, network monitoring and user behavior time series data into the attack probability prediction model, and output the attack probability in the future time period T;

[0011] Step 5: Input the abnormal behavior parameters into the operation behavior analysis model, and output the operation behavior abnormality index CY, which reflects the abnormal degree of user behavior and potential security risks; the abnormal behavior parameters include the severity and frequency of the abnormal behavior and the identity information of the network visitor corresponding to the abnormal behavior;

[0012] Step 6: Combined analysis to obtain the network security coefficient: Combined analysis of the network protection quality index, attack probability and operation behavior abnormality index to obtain the network security coefficient Anx, which reflects the overall level and potential risks of network security; dynamic warning is performed based on the network security coefficient. When Anx is lower than the preset security threshold, the network security warning mechanism is triggered.

[0013] Preferably, the time period T is dynamically adjusted according to changes in the network environment and security status; the time period T represents a specific length of time, and the selection of the time length depends on the requirements of the application scenario, the availability of data, and the predictive ability of the model.

[0014] Preferably, the abnormal operation behavior index CY is obtained in the following manner:

[0015] Let the total number of abnormal behaviors detected be n, and i represent the sequence number of the abnormal behaviors;

[0016] The severity of the i-th abnormal behavior is recorded as yci;

[0017] The frequency of the i-th abnormal behavior occurring within a certain time window is recorded as pyi;

[0018] Obtain the identity information of the network visitor corresponding to the ith abnormal behavior, retrieve the credit adjustment factor based on the identity credit of the network visitor, and use the credit adjustment factor to amplify or reduce the impact of the abnormal behavior; record the credit adjustment factor of the network visitor corresponding to the ith abnormal behavior as xfi;

[0019] Operant Behavior Analysis Model The abnormal operation behavior index CY was calculated.

[0020] Preferably, the credit adjustment factor is obtained by: setting evaluation indicators and initial credit score values ​​for identity credit, the evaluation indicators including login success rate and operation compliance; assigning corresponding credit score weights to different evaluation indicators, the credit score weights reflecting the importance of the evaluation indicators in the identity credit evaluation; updating the network visitor's identity credit comprehensive score based on the evaluation indicators and credit score weights; and determining the corresponding identity credit adjustment factor based on the identity credit comprehensive score.

[0021] Preferably, the network protection quality index NPQ is obtained in the following manner:

[0022] Obtain key indicators of network protection quality, the key indicators at least including firewall efficiency, intrusion detection rate, and encryption technology;

[0023] Assume that the number of key indicators of network protection quality is m, and j is used to represent the sequence number of key indicators; the actual measured value of the jth key indicator is recorded as sc-j, the optimal value of the jth key indicator is recorded as max_U, and the worst value of the jth key indicator is recorded as max_N; wj is used to represent the weight of the jth key indicator. Through the network protection quality analysis model The network protection quality index NPQ is calculated, where Form(·) represents a linear normalization function, which is used to convert the value in the brackets to the interval of 0 to 1, and α represents an optional adjustment factor, which is used to adjust the nonlinear effect of the index value on NPQ.

[0024] Preferably, the process of building the attack probability prediction model includes the following steps:

[0025] Step S11: Automatically collect time series data from multiple data sources. The time series data includes historical attack records, network monitoring, and user behavior. Automatic collection reduces manual intervention and ensures data comprehensiveness and timeliness.

[0026] Step S12: remove duplicate, missing and erroneous data, process timestamps to ensure data continuity, identify and process outliers, and obtain preprocessed time series data; divide the preprocessed time series data into a training set and a validation set;

[0027] Step S13: According to the correlation data analysis, basic features related to the predicted attack probability are selected from the pre-processed time series data, wherein the basic features include at least the attack frequency, the trend of a specific attack type, the network traffic change rate, the abnormal user behavior ratio, and the abnormal user behavior frequency; the basic features are derived, and the statistics of the basic features in the sliding window are calculated to capture the dynamic characteristics of the time series;

[0028] Step S14, data conversion and encoding: for categorical features, use encoding to convert to numerical type; for numerical features, perform linear normalization processing;

[0029] Step S15, clarify that the prediction task is time series prediction; select the long short-term memory network as the initialization model, use the cross-validation method to adjust the long short-term memory network hyperparameters, such as learning rate, hidden layer size, and number of iterations; train the long short-term memory network on the training set, monitor the loss function during the training process and the performance indicators on the validation set, and output the trained attack probability prediction model;

[0030] Step S16: Based on the validation set, obtain the evaluation index of the attack probability prediction model, and adjust the parameters of the model according to the evaluation index;

[0031] Step S17, output and deployment: deploy the trained attack probability prediction model to the production environment, receive multi-source data input in real time, and predict future attack probabilities.

[0032] Preferably, the network protection quality index, attack probability and operation behavior abnormality index are jointly analyzed and the formula The network security coefficient Anx is calculated, where γ and δ represent adjustment parameters, which are used to control the sensitivity of the attack probability and the abnormal operation behavior index to the network security coefficient respectively; the network security coefficient is converted into a threat level, and corresponding measures are taken based on the threat level.

[0033] To achieve the above object, the present invention provides the following technical solution: a network security dynamic early warning system based on multi-source data fusion, comprising:

[0034] The data collection module obtains key indicators of network protection quality by collecting system configuration, security vulnerability information, and security event records; obtains historical attack records, network monitoring, and user behavior time series data from security logs and intrusion monitoring systems; and identifies abnormal behavior parameters that do not conform to normal behavior patterns by analyzing user operation behaviors;

[0035] Data preprocessing module removes duplicate data, invalid data and noise data; converts data from different sources and formats into a unified format and normalizes it for subsequent analysis;

[0036] The network protection quality analysis module is used to input the key indicators of network protection quality into the network protection quality analysis model and output the network protection quality index NPQ;

[0037] The short-term attack probability prediction module builds an attack probability prediction model based on the long short-term memory network, inputs historical attack records, network monitoring and user behavior time series data into the attack probability prediction model, and outputs the attack probability in the future time period T;

[0038] A user abnormal behavior analysis module, used to input abnormal behavior parameters into an operation behavior analysis model and output an operation behavior abnormality index CY, wherein the abnormal behavior parameters include the severity and frequency of the abnormal behavior and the identity information of the network visitor corresponding to the abnormal behavior;

[0039] The network security comprehensive assessment module jointly analyzes the network protection quality index, attack probability and operation behavior abnormality index to obtain the network security coefficient Anx, and performs dynamic warning based on the network security coefficient.

[0040] Preferably, the process of obtaining the network security factor Anx includes:

[0041] Assume that the total number of abnormal behaviors detected is n, and i is used to represent the order of abnormal behaviors; the severity of the i-th abnormal behavior is recorded as yci, which is a numerical value evaluated based on predefined rules or machine learning models; the frequency of the i-th abnormal behavior in a certain time window is recorded as pyi; the credit adjustment factor of the network visitor corresponding to the i-th abnormal behavior is recorded as xfi; through the operation behavior analysis model The abnormal operation behavior index CY is calculated;

[0042] Assume that the number of key indicators of network protection quality is m, and j is used to represent the sequence number of key indicators; the actual measured value of the jth key indicator is recorded as sc-j, the optimal value of the jth key indicator is recorded as max_U, and the worst value of the jth key indicator is recorded as max_N; wj is used to represent the weight of the jth key indicator. Through the network protection quality analysis model The network protection quality index NPQ is calculated, where Form(·) represents a linear normalization function, which is used to convert the value in the brackets to the interval of 0 to 1, and α represents an optional adjustment factor, which is used to adjust the nonlinear effect of the index value on NPQ;

[0043] Deploy the trained attack probability prediction model to the production environment, receive multi-source data input in real time, and output the predicted attack probability YP within time T;

[0044] By formula The network security coefficient Anx is calculated, where γ and δ represent adjustment parameters, which are used to control the sensitivity of the attack probability and the abnormal operation behavior index to the network security coefficient respectively; the network security coefficient is converted into a threat level, and corresponding measures are taken based on the threat level.

[0045] Technical effects and advantages of the present invention:

[0046] (1) The network security dynamic early warning method based on multi-source data fusion provided by the present invention obtains key indicators of network protection quality by collecting system configuration, security vulnerability information, and security event records; inputs the key indicators of network protection quality into the network protection quality analysis model, and outputs the network protection quality index NPQ; the network protection quality index reflects the strength and effectiveness of network protection; builds an attack probability prediction model based on a long short-term memory network, inputs historical attack records, network monitoring, and user behavior time series data into the attack probability prediction model, and outputs the attack probability in the future time period T; analyzes user operation behavior to identify abnormal behavior parameters that do not conform to normal behavior patterns; inputs the abnormal behavior parameters into the operation behavior analysis model, Output the operation behavior abnormality index CY, which reflects the abnormal degree of user behavior and potential security risks; the abnormal behavior parameters include the severity and frequency of the abnormal behavior and the identity information of the network visitor corresponding to the abnormal behavior; jointly analyze the network protection quality index, attack probability and operation behavior abnormality index to obtain the network security coefficient Anx, which reflects the overall level and potential risks of network security; based on the network security coefficient, dynamic early warning is carried out, and when Anx is lower than the preset security threshold, the network security early warning mechanism is triggered, which effectively solves the technical problems in network security early warning, such as one-sided information, inaccurate evaluation, inaccurate prediction and untimely response, and provides strong support for the comprehensive and efficient management of network security.

[0047] (2) The network security dynamic early warning method based on multi-source data fusion provided by the present invention dynamically adjusts the attack probability in time period T according to changes in the network environment and security status. In security scenarios that require rapid response, time period T is set to a shorter time so that the system can quickly identify and respond to potential attack threats. When the system detects abnormal behavior or potential threats, time period T is shortened to update the attack probability prediction more frequently, thereby responding to security incidents more quickly. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 This is a flow chart of the network security dynamic early warning method of the present invention.

[0049] Figure 2 This is a structural block diagram of the network security dynamic early warning system of the present invention. DETAILED DESCRIPTION

[0050] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0051] The following description of at least one exemplary embodiment is merely illustrative in nature and is in no way intended to limit the present application, its application, or uses.

[0052] Technologies, methods, and equipment known to ordinary technicians in the relevant art may not be discussed in detail, but where appropriate, the technologies, methods, and equipment should be considered as part of the specification.

[0053] Example 1

[0054] See also Figure 1 The present invention provides a flow chart of a network security dynamic early warning method. Figure 1 A network security dynamic early warning method based on multi-source data fusion is shown, characterized in that it includes the following steps:

[0055] Step 1: Collect data: Obtain key indicators of network protection quality by collecting system configuration, security vulnerability information, and security event records; obtain historical attack records, network monitoring, and user behavior time series data from security logs and intrusion monitoring systems; and identify abnormal behavior parameters that do not conform to normal behavior patterns by analyzing user operation behaviors;

[0056] Step 2: Data preprocessing: Remove duplicate data, invalid data (such as data with incorrect format or missing key fields) and noisy data; convert data from different sources and formats into a unified format and normalize it for subsequent analysis; store the preprocessed data in the data center;

[0057] Step 3: Input the key indicators of network protection quality into the network protection quality analysis model and output the network protection quality index NPQ; the network protection quality index reflects the strength and effectiveness of network protection;

[0058] Step 4: Build an attack probability prediction model based on the long short-term memory network, input historical attack records, network monitoring and user behavior time series data into the attack probability prediction model, and output the attack probability in the future time period T;

[0059] Step 5: Input the abnormal behavior parameters into the operation behavior analysis model, and output the operation behavior abnormality index CY, which reflects the abnormal degree of user behavior and potential security risks; the abnormal behavior parameters include the severity and frequency of the abnormal behavior and the identity information of the network visitor corresponding to the abnormal behavior;

[0060] Step 6: Combined analysis to obtain the network security coefficient: Combined analysis of the network protection quality index, attack probability and operation behavior abnormality index to obtain the network security coefficient Anx, which reflects the overall level and potential risks of network security; dynamic warning is performed based on the network security coefficient. When Anx is lower than the preset security threshold, the network security warning mechanism is triggered.

[0061] What needs to be further explained in the embodiments of the present invention is that the time period T is not fixed, but is dynamically adjusted according to changes in the network environment and security status; the time period T represents a specific length of time, such as the next hour, the next 24 hours, the next week, etc., and the selection of the time length depends on the needs of the application scenario, the availability of data, and the predictive ability of the model; for example, in security scenarios that require rapid response, the time period T is set to a shorter time so that the system can quickly identify and respond to potential attack threats; when the system detects abnormal behavior or potential threats, the time period T is shortened to update the attack probability prediction more frequently, thereby responding to security incidents more quickly; and in scenarios where real-time requirements are not high, the time period T is relatively long.

[0062] It needs to be further explained in the embodiment of the present invention that the method of obtaining the abnormal operation behavior index CY is:

[0063] Let the total number of abnormal behaviors detected be n, and i represent the sequence number of the abnormal behaviors;

[0064] The severity of the i-th abnormal behavior is recorded as yci, which is a numerical value evaluated based on predefined rules or machine learning models;

[0065] The frequency of the i-th abnormal behavior occurring within a certain time window is recorded as pyi;

[0066] Obtain the identity information of the network visitor corresponding to the ith abnormal behavior, retrieve the credit adjustment factor based on the identity credit of the network visitor, and the credit adjustment factor is used to amplify or reduce the impact of the abnormal behavior; record the credit adjustment factor of the network visitor corresponding to the ith abnormal behavior as xfi; for example, for a high-credit user, the factor may be close to 1 or slightly less than 1, and for a low-credit user, the factor may be greater than 1;

[0067] Operant Behavior Analysis Model The abnormal operation behavior index CY was calculated.

[0068] What needs to be further explained in the embodiments of the present invention is that the credit adjustment factor is obtained in the following manner: setting evaluation indicators and initial credit score values ​​for identity credit, the evaluation indicators including login success rate, operation compliance, and initial credit score value; assigning corresponding credit score weights to different evaluation indicators, the credit score weights reflecting the importance of the evaluation indicators in the identity credit evaluation; updating the identity credit comprehensive score of the network visitor according to the evaluation indicators and the credit score weights; determining the corresponding identity credit adjustment factor according to the identity credit comprehensive score; the higher the identity credit comprehensive score, the smaller the adjustment factor (i.e., the impact of abnormal behavior is reduced); the lower the identity credit comprehensive score, the larger the adjustment factor (i.e., the impact of abnormal behavior is amplified).

[0069] It needs to be further explained in the embodiment of the present invention that the network protection quality index NPQ is obtained in the following manner:

[0070] Obtain key indicators of network protection quality, the key indicators at least including firewall efficiency, intrusion detection rate, and encryption technology;

[0071] Assume that the number of key indicators of network protection quality is m, and j is used to represent the sequence number of key indicators; the actual measured value of the jth key indicator is recorded as sc-j, the optimal value of the jth key indicator is recorded as max_U, and the worst value of the jth key indicator is recorded as max_N; wj is used to represent the weight of the jth key indicator. Through the network protection quality analysis model The network protection quality index NPQ is calculated, where Form(·) represents a linear normalization function, which is used to convert the value in the brackets to the interval of 0 to 1. α represents an optional adjustment factor, which is used to adjust the nonlinear effect of the index value on NPQ. When α=1, it indicates a linear relationship. When α>1, it indicates that the penalty for deviation from the optimal value is increased. When 0<α<1, it indicates that the penalty for deviation from the optimal value is reduced. The adjustment factor is adjusted according to the actual situation to better reflect the influence of different indicators on NPOI.

[0072] It needs to be further explained in the embodiment of the present invention that the process of building the attack probability prediction model includes the following steps:

[0073] Step S11: Automatically collect time series data from multiple data sources. The time series data includes historical attack records, network monitoring, and user behavior. Automatic collection reduces manual intervention and ensures data comprehensiveness and timeliness.

[0074] Explanation: The historical attack records refer to the records of historical network security attack events, including attack type, time, impact scope, and source IP address information; the network monitoring data refers to data collected through network monitoring tools, and network monitoring data includes network traffic, session information, and connection attempt records; network monitoring data can reflect normal and abnormal modes of network activity; the user behavior data refers to the user's behavior data on the network, including login activities, file access, and system operation behavior data. Abnormal user behavior is often a sign of attack activity.

[0075] Step S12: remove duplicate, missing and erroneous data, process timestamps to ensure data continuity, identify and process outliers, and obtain preprocessed time series data; divide the preprocessed time series data into a training set and a validation set;

[0076] Step S13: According to the correlation data analysis, basic features related to the predicted attack probability are selected from the pre-processed time series data, wherein the basic features include at least the attack frequency, the trend of a specific attack type, the network traffic change rate, the abnormal user behavior ratio, and the abnormal user behavior frequency; the basic features are derived, and the statistics (mean, standard deviation, maximum value) of the basic features in the sliding window are calculated to capture the dynamic characteristics of the time series;

[0077] Explanation: The correlation data analysis is used to analyze the correlation between each feature and the target variable (ie, attack probability), and to determine which features are most helpful in predicting the attack probability through statistical methods (such as correlation coefficient, chi-square test).

[0078] Step S14, data conversion and encoding: for categorical features, use encoding (such as one-hot encoding, label encoding or target encoding) to convert them into numerical types; for numerical features, perform linear normalization processing;

[0079] Step S15: clarify that the prediction task is time series prediction (such as predicting the probability of an attack within the next few hours); select the long short-term memory network as the initialization model, and use the cross-validation method to adjust the long short-term memory network hyperparameters, such as learning rate, hidden layer size, and number of iterations; train the long short-term memory network on the training set, monitor the loss function during the training process and the performance indicators on the validation set, and output the trained attack probability prediction model;

[0080] Explanation: During the training process, early stopping or regularization technology is used to prevent overfitting; the loss function is a cross entropy loss function of the predicted attack probability YP and the actual attack probability SP;

[0081] Step S16: Based on the validation set, obtain evaluation indicators of the attack probability prediction model, such as accuracy, recall rate, F1 score, and area under the AUC-ROC curve; adjust the parameters of the model (such as learning rate and regularization coefficient) through the evaluation indicators;

[0082] Step S17, output and deployment: deploy the trained attack probability prediction model to the production environment, receive multi-source data input in real time, and predict future attack probabilities.

[0083] It is necessary to further explain in the embodiment of the present invention that the network protection quality index, the attack probability and the operation behavior abnormality index are jointly analyzed, and the formula The network security coefficient Anx is calculated, where γ and δ represent adjustment parameters, which are respectively used to control the sensitivity of the attack probability and the operation behavior abnormality index to the network security coefficient; adjustments are made according to actual conditions to reflect the importance of various factors in different network environments; the greater the attack probability, the smaller the network security coefficient Anx; the greater the operation behavior abnormality index, the smaller the network security coefficient Anx; the greater the protection quality, the greater the network security coefficient Anx.

[0084] It is necessary to further explain in the embodiment of the present invention that the network security coefficient is converted into a threat level, and the value range [0, 1] of the network security coefficient is divided into several intervals, each interval corresponding to a threat level; for example:

[0085] When the network security coefficient belongs to [0.8, 1.0], it corresponds to a low threat level, indicating that the network security situation in the future time T is good;

[0086] When the network security coefficient belongs to [0.4, 0.8), it corresponds to the medium threat level, indicating that the network security situation in the future time T needs attention;

[0087] When the network security coefficient belongs to [0.2, 0.4), it corresponds to a high threat level, indicating that protective measures need to be taken for the network security situation in the future time T;

[0088] When the network security coefficient belongs to [0.0, 0.2), it corresponds to an extremely high threat level, indicating that the network security situation in the future time T is in an emergency state and network protection resources need to be increased immediately.

[0089] For example, assume that the network protection quality index NPQ = 0.7, which is a medium protection quality; the predicted attack probability YP = 0.3, which is a low attack probability; the operation behavior abnormality index CY = 0.2, which is a low operation behavior abnormality, and set γ = 2 and δ = 1.5, and γ and δ are adjusted according to the actual situation. According to the threat level classification, this network security factor corresponds to a medium threat level, and network administrators need to pay real-time attention to the network security factor.

[0090] Example 2

[0091] See also Figure 2 The embodiment of the present invention provides a network security dynamic early warning system based on multi-source data fusion, including:

[0092] The data collection module obtains key indicators of network protection quality by collecting system configuration, security vulnerability information, and security event records; obtains historical attack records, network monitoring, and user behavior time series data from security logs and intrusion monitoring systems; and identifies abnormal behavior parameters that do not conform to normal behavior patterns by analyzing user operation behaviors;

[0093] Data preprocessing module removes duplicate data, invalid data and noise data; converts data from different sources and formats into a unified format and normalizes it for subsequent analysis;

[0094] The network protection quality analysis module is used to input the key indicators of network protection quality into the network protection quality analysis model and output the network protection quality index NPQ;

[0095] The short-term attack probability prediction module builds an attack probability prediction model based on the long short-term memory network, inputs historical attack records, network monitoring and user behavior time series data into the attack probability prediction model, and outputs the attack probability in the future time period T;

[0096] A user abnormal behavior analysis module, used to input abnormal behavior parameters into an operation behavior analysis model and output an operation behavior abnormality index CY, wherein the abnormal behavior parameters include the severity and frequency of the abnormal behavior and the identity information of the network visitor corresponding to the abnormal behavior;

[0097] The network security comprehensive assessment module jointly analyzes the network protection quality index, attack probability and operation behavior abnormality index to obtain the network security coefficient Anx, and performs dynamic warning based on the network security coefficient.

[0098] It needs to be further explained in the embodiment of the present invention that the process of obtaining the network security factor Anx includes:

[0099] Assume that the total number of abnormal behaviors detected is n, and i is used to represent the order of abnormal behaviors; the severity of the i-th abnormal behavior is recorded as yci, which is a numerical value evaluated based on predefined rules or machine learning models; the frequency of the i-th abnormal behavior in a certain time window is recorded as pyi; the credit adjustment factor of the network visitor corresponding to the i-th abnormal behavior is recorded as xfi; through the operation behavior analysis model The abnormal operation behavior index CY is calculated;

[0100] Assume that the number of key indicators of network protection quality is m, and j is used to represent the sequence number of key indicators; the actual measured value of the jth key indicator is recorded as sc-j, the optimal value of the jth key indicator is recorded as max_U, and the worst value of the jth key indicator is recorded as max_N; wj is used to represent the weight of the jth key indicator. Through the network protection quality analysis model The network protection quality index NPQ is calculated, where Form(·) represents a linear normalization function, which is used to convert the value in the brackets to the interval of 0 to 1, and α represents an optional adjustment factor, which is used to adjust the nonlinear effect of the index value on NPQ;

[0101] Deploy the trained attack probability prediction model to the production environment, receive multi-source data input in real time, and output the predicted attack probability YP within time T;

[0102] By formula The network security coefficient Anx is calculated, where γ and δ represent adjustment parameters, which are used to control the sensitivity of the attack probability and the abnormal operation behavior index to the network security coefficient respectively; the network security coefficient is converted into a threat level, and corresponding measures are taken based on the threat level.

[0103] Finally: The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A network security dynamic early warning method based on multi-source data fusion, characterized in that: The following steps are involved: Step 1: Collect data: Obtain key indicators of network protection quality by collecting system configuration, security vulnerability information, and security event records; obtain historical attack records, network monitoring, and user behavior time series data from security logs and intrusion monitoring systems; and identify abnormal behavior parameters that do not conform to normal behavior patterns by analyzing user operation behaviors; Step 2: Data preprocessing: remove duplicate data, invalid data, and noise data; convert data from different sources and formats into a unified format and normalize it for subsequent analysis; Step 3: Input the key indicators of network protection quality into the network protection quality analysis model and output the network protection quality index NPQ; the network protection quality index reflects the strength and effectiveness of network protection; Step 4: Build an attack probability prediction model based on the long short-term memory network, input historical attack records, network monitoring and user behavior time series data into the attack probability prediction model, and output the attack probability in the future time period T; Step 5: Input the abnormal behavior parameters into the operation behavior analysis model, and output the operation behavior abnormality index CY, which reflects the abnormal degree of user behavior and potential security risks; the abnormal behavior parameters include the severity and frequency of the abnormal behavior and the identity information of the network visitor corresponding to the abnormal behavior; Step 6: Combined analysis to obtain the network security coefficient: Combined analysis of the network protection quality index, attack probability and operation behavior abnormality index to obtain the network security coefficient Anx, which reflects the overall level and potential risks of network security; dynamic warning is performed based on the network security coefficient. When Anx is lower than the preset security threshold, the network security warning mechanism is triggered.

2. According to claim 1, a network security dynamic early warning method based on multi-source data fusion is characterized in that: The time period T is dynamically adjusted according to changes in the network environment and security status; the time period T represents a specific length of time, and the selection of the time length depends on the needs of the application scenario, the availability of data, and the predictive ability of the model.

3. According to claim 1, a network security dynamic early warning method based on multi-source data fusion is characterized in that: The method for obtaining the abnormal operation behavior index CY is as follows: Let the total number of abnormal behaviors detected be n, and i represent the sequence number of the abnormal behaviors; The severity of the i-th abnormal behavior is recorded as yci; The frequency of the i-th abnormal behavior occurring within a certain time window is recorded as pyi; Obtain the identity information of the network visitor corresponding to the ith abnormal behavior, retrieve the credit adjustment factor based on the identity credit of the network visitor, and use the credit adjustment factor to amplify or reduce the impact of the abnormal behavior; record the credit adjustment factor of the network visitor corresponding to the ith abnormal behavior as xfi; Operant Behavior Analysis Model The abnormal operation behavior index CY was calculated.

4. A network security dynamic early warning method based on multi-source data fusion according to claim 3, characterized in that: The credit adjustment factor is obtained by: setting evaluation indicators and initial credit score values ​​for identity credit, where the evaluation indicators include login success rate and operation compliance; assigning corresponding credit score weights to different evaluation indicators, where the credit score weights reflect the importance of the evaluation indicators in identity credit evaluation; updating the identity credit comprehensive score of the network visitor based on the evaluation indicators and credit score weights; and determining the corresponding identity credit adjustment factor based on the identity credit comprehensive score.

5. The method for dynamic network security early warning based on multi-source data fusion according to claim 1 is characterized in that: The network protection quality index NPQ is obtained in the following manner: Obtain key indicators of network protection quality, the key indicators at least including firewall efficiency, intrusion detection rate, and encryption technology; Assume that the number of key indicators of network protection quality is m, and j is used to represent the sequence number of key indicators; the actual measured value of the jth key indicator is recorded as sc-j, the optimal value of the jth key indicator is recorded as max_U, and the worst value of the jth key indicator is recorded as max_N; wj is used to represent the weight of the jth key indicator. Through the network protection quality analysis model The network protection quality index NPQ is calculated, where Form(·) represents a linear normalization function, which is used to convert the value in the brackets to the interval of 0 to 1, and α represents an optional adjustment factor, which is used to adjust the nonlinear effect of the index value on NPQ.

6. The method for dynamic network security early warning based on multi-source data fusion according to claim 1 is characterized in that: The process of building the attack probability prediction model includes the following steps: Step S11: Automatically collect time series data from multiple data sources. The time series data includes historical attack records, network monitoring, and user behavior. Automatic collection reduces manual intervention and ensures data comprehensiveness and timeliness. Step S12: remove duplicate, missing and erroneous data, process timestamps to ensure data continuity, identify and process outliers, and obtain pre-processed time series data; Divide the preprocessed time series data into training set and validation set; Step S13: According to the correlation data analysis, basic features related to the predicted attack probability are selected from the pre-processed time series data, wherein the basic features include at least the attack frequency, the trend of a specific attack type, the network traffic change rate, the abnormal user behavior ratio, and the abnormal user behavior frequency; the basic features are derived, and the statistics of the basic features in the sliding window are calculated to capture the dynamic characteristics of the time series; Step S14, data conversion and encoding: for categorical features, use encoding to convert to numerical type; for numerical features, perform linear normalization processing; Step S15, clarify that the prediction task is time series prediction; select the long short-term memory network as the initialization model, and use the cross-validation method to adjust the long short-term memory network hyperparameters; train the long short-term memory network on the training set, monitor the loss function during the training process and the performance indicators on the validation set, and output the trained attack probability prediction model; Step S16: Based on the validation set, obtain the evaluation index of the attack probability prediction model, and adjust the parameters of the model according to the evaluation index; Step S17, output and deployment: deploy the trained attack probability prediction model to the production environment, receive multi-source data input in real time, and predict future attack probability YP.

7. The method for dynamic network security early warning based on multi-source data fusion according to claim 1 is characterized in that: Combined analysis of network protection quality index, attack probability and operation behavior abnormality index, through the formula The network security coefficient Anx is calculated, where γ and δ represent adjustment parameters, which are used to control the sensitivity of the attack probability and the abnormal operation behavior index to the network security coefficient respectively; the network security coefficient is converted into a threat level, and corresponding measures are taken based on the threat level.

8. A network security dynamic early warning system based on multi-source data fusion, characterized in that: include: The data collection module collects system configuration, security vulnerability information, and security event records to obtain key indicators of network protection quality; Obtain historical attack records, network monitoring and user behavior time series data from security logs and intrusion monitoring systems; identify abnormal behavior parameters that do not conform to normal behavior patterns by analyzing user operation behaviors; Data preprocessing module removes duplicate data, invalid data and noise data; converts data from different sources and formats into a unified format and normalizes it for subsequent analysis; The network protection quality analysis module is used to input the key indicators of network protection quality into the network protection quality analysis model and output the network protection quality index NPQ; The short-term attack probability prediction module builds an attack probability prediction model based on the long short-term memory network, inputs historical attack records, network monitoring and user behavior time series data into the attack probability prediction model, and outputs the attack probability in the future time period T; A user abnormal behavior analysis module, used to input abnormal behavior parameters into an operation behavior analysis model and output an operation behavior abnormality index CY, wherein the abnormal behavior parameters include the severity and frequency of the abnormal behavior and the identity information of the network visitor corresponding to the abnormal behavior; The network security comprehensive assessment module jointly analyzes the network protection quality index, attack probability and operation behavior abnormality index to obtain the network security coefficient Anx, and performs dynamic warning based on the network security coefficient.

Images