Cloud collaborative real-time traffic data visualization analysis method and system

Abstract

The invention discloses a cloud collaborative real-time traffic data visualization analysis method and system, and the method comprises the steps: carrying out the traffic data classification of obtained historical traffic data through a traffic classification model, determining the correlation degree between each type of traffic data and each type of security situation through a gray correlation degree method, and determining the sensitivity of each type of traffic data; classifying the preprocessed real-time traffic data by using a traffic classification model, determining the stability of the traffic data by using a weighting method based on the information entropy of the classified traffic data, and visually displaying the stability of the traffic data; and determining a security situation prediction result based on the information entropy of the classified traffic data and the security situation prediction model, evaluating the final security situation prediction result based on the security situation evaluation index system, and visually displaying the security situation evaluation result. According to the method, the accuracy, the real-time performance and the comprehensiveness of network security situation awareness and evaluation are remarkably improved.

Description

Technical Field

[0001] The present invention relates to the technical field of data visualization monitoring, and specifically to a cloud-coordinated real-time traffic data visualization analysis method and system. Background Art

[0002] With the rapid development of computer network technology, especially the booming of cloud computing, big data, Internet of Things and other technologies, data flow analysis systems have become an indispensable infrastructure for all walks of life, and are widely used in many fields such as enterprise operation monitoring, network security protection, and user behavior analysis. However, the widespread application of this technology is also accompanied by unprecedented network security challenges, and its complexity and severity are becoming increasingly prominent.

[0003] In terms of network traffic data visualization monitoring, although existing technical means can achieve intuitive display of data, there are still obvious deficiencies in in-depth analysis and real-time response. Specifically, the current system often finds it difficult to accurately capture subtle changes in network traffic, making it impossible to effectively conduct comprehensive monitoring of traffic status and real-time assessment of network health. This limitation directly leads to the difficulty of accurately matching the protection strategies of security devices such as firewalls with actual threats, reducing the accuracy and efficiency of overall protection. At the same time, due to the lack of real-time performance, it is difficult for the system to detect and respond to potential network attacks in a timely manner, laying hidden dangers for security incidents such as data leakage and service interruption. Summary of the invention

[0004] The purpose of the present invention is to provide a cloud-coordinated real-time traffic data visualization analysis method and system, which can perform real-time analysis of traffic data, timely discover and respond to potential network attacks, and reduce the occurrence of security incidents such as data leakage and service interruption.

[0005] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0006] A cloud-based collaborative real-time traffic data visualization analysis method, the steps of which include:

[0007] Use the traffic classification model to classify the historical traffic data, and use the grey correlation method to determine the correlation between each type of traffic data and each security situation, and determine the sensitivity of each type of traffic data;

[0008] Collect traffic data in real time and pre-process the collected traffic data;

[0009] The pre-processed traffic data is classified using the traffic classification model. Based on the information entropy of the classified traffic data, the stability of the traffic data is determined using a weighted method, and the stability of the traffic data is visualized.

[0010] Determine abnormal traffic data based on the information entropy of the classified traffic data and predict the first security situation based on the correlation between each type of traffic data and each security situation;

[0011] Input the real-time collected traffic data into the security situation prediction model to perform security situation prediction, determine the type of the second security situation, take the intersection of the first security situation and the second security situation, and determine the final security situation prediction result;

[0012] Based on the security situation assessment index system, the final security situation prediction result is evaluated and the security situation assessment result is visualized; the security situation assessment index system includes vulnerability assessment index, disaster recovery assessment index, threat assessment index and stability assessment index.

[0013] In the aforementioned cloud-based collaborative real-time traffic data visualization analysis method, the traffic classification model execution steps include:

[0014] Calculate the information entropy of each preprocessed traffic data;

[0015] The pre-processed traffic data is segmented, cleaned, and vectorized to obtain a grayscale traffic map sequence;

[0016] The grayscale flow map sequence is input into the first convolutional layer, and the spatial features are extracted using a two-dimensional convolution filter variant, and the temporal features are aggregated along the time dimension using a one-dimensional convolution filter variant. The spatial feature map and the temporal feature map after the average pooling operation are reduced in dimension are sent to a fully connected layer, and the output is normalized by the Softmax function to obtain a weight coefficient matrix. The spatiotemporal features and the weight coefficient matrix are combined to obtain the first spatiotemporal features.

[0017] The fused first spatiotemporal features are input into the second convolutional layer, and the spatial features are extracted using a two-dimensional convolutional filter variant, and the temporal features are aggregated along the time dimension using a one-dimensional convolutional filter variant. The spatial feature map and the temporal feature map after the average pooling operation are reduced in dimension are sent to a fully connected layer, and the output is normalized by the Softmax function to obtain a weight coefficient matrix. The spatiotemporal features and the weight coefficient matrix are combined to obtain the fused second spatiotemporal features.

[0018] The information entropy corresponding to the second spatiotemporal feature is fused using the LC operation to obtain the third spatiotemporal feature;

[0019] After weighted adjustment of the third spatiotemporal feature using the channel attention mechanism, it is input into the fully connected layer and then outputs the final traffic data classification result.

[0020] The spatiotemporal features are expressed as: [x t ,x wh ], x trepresents the time feature graph, x wh Represents a spatial feature map;

[0021] The fusion formula of spatiotemporal features and weight coefficient matrix is: Z = [x t ,x wh ]×β; Z represents the fused features of spatiotemporal features and weight coefficient matrix, and β represents the weight coefficient matrix obtained by normalizing the output through the Softmax function.

[0022] Traffic segmentation: Network traffic is essentially a sequence of data packets transmitted continuously in time order. Each data packet contains key five-tuple information. Traffic segmentation is based on the same five-tuple information.

[0023] Traffic cleaning refers to cleaning up empty files and duplicate files.

[0024] Vector conversion is to reduce the impact of data range on the model. The samples are vectorized and converted into byte vectors with element values ​​from 0 to 255 in bytes (8 bits). Then the elements in the vector are divided by 255 to convert them into normalized byte vectors with element values ​​from 0 to 1. The normalized byte vectors are uniformly converted into grayscale images, where 1 represents black, 0 represents white, and values ​​in between represent different grayscale levels. The normalized byte value vector of length 784 will be converted into a 28×28 grayscale image.

[0025] The use of traffic classification models for classification not only takes into account the spatiotemporal characteristics of traffic data, but also takes into account that traffic data contains multidimensional data characteristics, and the information entropy value can reflect the distribution of the corresponding data characteristics. Therefore, the information entropy value is introduced as a feature into the traffic classification model for classification to improve the accuracy of traffic data classification.

[0026] In the aforementioned cloud-based collaborative real-time traffic data visualization analysis method, the information entropy is:

[0027]

[0028] In the formula, H j represents the information entropy of class j traffic data, n i represents the number of times the characteristic attribute i of the j-type traffic data appears in the random event, n represents the number of types of the characteristic attributes of the j-type traffic data, It represents the sum of the number of occurrences of all characteristic attributes of type j traffic data in random events.

[0029] The concept of information entropy comes from physics and is mainly used to analyze the degree of disorder of molecular motion within a system in thermodynamics. The lower the information entropy value, the more orderly the system. Network traffic data contains multidimensional data features, so the distribution of corresponding data features can be analyzed through the information entropy value. The traffic data is used as a discrete data source, and each attribute is calculated as a set of random events. When the information entropy value tends to 0, it proves that the traffic data is distributed in a concentrated manner.

[0030] In the aforementioned cloud-coordinated real-time traffic data visualization analysis method, the sensitivity calculation steps for each type of traffic data are as follows:

[0031] Based on the correlation between each type of traffic data and each security situation, determine the weight of each type of traffic data in a security situation. The sum of the weights of each type of traffic data in a security situation is 1.

[0032] The sensitivity is obtained by adding up the corresponding weights of each type of traffic data in all security situations and dividing it by the number of security situations.

[0033] Because the impact of each type of traffic data on each security situation is different, and there may be some traffic data whose impact on the security situation does not fluctuate much, it is necessary to determine the sensitivity of traffic data to the overall security situation based on the correlation between traffic data and security situation.

[0034] In the aforementioned cloud-based collaborative real-time traffic data visualization analysis method, the stability calculation formula of the traffic data is:

[0035] sta j = l j H j ;

[0036] In the formula, sta j Indicates the stability of class j traffic data, l j represents the sensitivity of class j traffic data, H j Represents the information entropy of class j traffic data.

[0037] Because there may be some traffic data whose information entropy value fluctuates greatly but whose impact on the security situation is very small, the sensitivity of the traffic data and the information entropy value are used to determine the stability of the traffic data, that is, the stability of the current network.

[0038] The aforementioned cloud-collaborative real-time traffic data visualization analysis method regards the classified traffic data whose information entropy is greater than its corresponding security threshold as abnormal traffic data and determines the classification type corresponding to the abnormal traffic data; and regards the security situation corresponding to which the correlation between the abnormal traffic data and each security situation is greater than the threshold B as the first security situation.

[0039] The aforementioned cloud-coordinated real-time traffic data visualization analysis method adopts a neural network model, a regression prediction method, a Bayesian network model, and a long short-term memory network to construct the security situation prediction model.

[0040] In the aforementioned cloud-based collaborative real-time traffic data visualization analysis method, the security situation prediction result evaluation step includes:

[0041] The weights of vulnerability assessment index, disaster tolerance assessment index, threat assessment index and stability assessment index are determined by using the hierarchical analysis method.

[0042] Compute vulnerability assessment data, disaster recovery assessment data, threat assessment data, and stability assessment data for security situation prediction;

[0043] The vulnerability assessment data of the security situation prediction is weighted based on the weights corresponding to the vulnerability assessment indicators to obtain the final vulnerability assessment result;

[0044] The disaster recovery assessment data of the security situation prediction is weighted based on the weights corresponding to the disaster recovery assessment indicators to obtain the final disaster recovery assessment result;

[0045] The threat assessment data of the security situation prediction is weighted based on the weights corresponding to the threat assessment indicators to obtain the final threat assessment result;

[0046] The stability assessment data of the security situation prediction is weighted based on the weights corresponding to the stability assessment indicators to obtain the final stability assessment result.

[0047] Among them, you can use line graphs and stacked flow graphs to display the network security situation with a timeline; use parallel coordinate axis graphs, scatter graphs, etc. to represent the detailed data that needs to be counted in network security; you can also use 3D spherical graphics for display and overall analysis of the network status.

[0048] The present invention also includes another technical solution, a cloud-coordinated real-time traffic data visualization analysis system, comprising:

[0049] The traffic data sensitivity module is used to classify the historical traffic data using the traffic classification model, and to determine the correlation between each type of traffic data and each security situation using the grey correlation method, and to determine the sensitivity of each type of traffic data;

[0050] Data collection module, collects flow data in real time and pre-processes the collected flow data;

[0051] The stability display module uses the traffic classification model to classify the pre-processed traffic data, determines the stability of the traffic data using a weighted method based on the information entropy of the classified traffic data, and visualizes the stability of the traffic data;

[0052] The security situation prediction module determines abnormal traffic data based on the information entropy of the classified traffic data and predicts the first security situation based on the correlation between each type of traffic data and each security situation; inputs the real-time collected traffic data into the security situation prediction model to perform security situation prediction, determines the type of the second security situation, takes the intersection of the first security situation and the second security situation, and determines the final security situation prediction result;

[0053] The security situation assessment module evaluates the final security situation prediction results based on the security situation assessment indicator system and visualizes the security situation assessment results; the security situation assessment indicator system includes vulnerability assessment indicators, disaster recovery assessment indicators, threat assessment indicators and stability assessment indicators.

[0054] Compared with the prior art, the beneficial effects achieved by the present invention are:

[0055] 1. The present invention classifies historical traffic data by using a traffic classification model and analyzes the correlation between each type of traffic and different security situations in combination with the grey correlation method, which can more accurately identify the impact of different traffic types on security situations, i.e., sensitivity. This helps to more accurately consider the contribution of various types of traffic in subsequent security situation predictions.

[0056] 2. The present invention collects and preprocesses traffic data in real time, ensuring the timeliness and accuracy of the data. At the same time, the use of information entropy and weighted methods to evaluate the stability of traffic data not only improves data processing efficiency, but also helps security personnel intuitively understand the dynamic changes of network traffic through visual display. Based on the information entropy of classified traffic data to identify abnormal traffic, combined with the correlation between traffic data and security situation, potential security threats can be discovered earlier and more accurately, providing strong support for timely response and disposal.

[0057] 3. The present invention combines the preliminary prediction based on traffic classification and correlation (first security situation) with the prediction result (second security situation) obtained by inputting real-time traffic data into the security situation prediction model, and determines the final security situation prediction result by taking the intersection method. This method integrates the information of multiple prediction sources, effectively reduces the error that may be caused by a single prediction method, and improves the accuracy and reliability of the prediction results.

[0058] 4. The present invention establishes a multi-dimensional security situation assessment indicator system including vulnerability, disaster recovery, threat and stability, which can comprehensively and systematically assess the security status of the network.

[0059] 5. The technical solution of the present invention calculates the correlation between classified traffic and security situation, determines the sensitivity of each traffic number, and comprehensively uses the traffic classification model to classify the real-time traffic data. Then, the stability of the network data is determined based on the information entropy and sensitivity of the classified real-time traffic data, and the security situation prediction result is determined based on the information entropy of the classified real-time traffic data and the security situation prediction model. The predicted security situation is evaluated and displayed, which significantly improves the accuracy, real-time and comprehensiveness of network security situation perception and evaluation to a certain extent. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] The accompanying drawings are used to provide further understanding of the present invention and constitute a part of the specification. They are used to explain the present invention together with the embodiments of the present invention and do not constitute a limitation of the present invention.

[0061] Figure 1 It is a step flow chart of a cloud-based collaborative real-time traffic data visualization analysis method of the present invention. DETAILED DESCRIPTION

[0062] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0063] Example 1: A cloud-based collaborative real-time traffic data visualization analysis method, such as Figure 1 As shown, the steps include:

[0064] S1. Use the traffic classification model to classify the historical traffic data, and use the grey correlation method to determine the correlation between each type of traffic data and each security situation. Based on the correlation between each type of traffic data and each security situation, determine the weight corresponding to each type of traffic data in a security situation. The sum of the weights corresponding to each type of traffic data in a security situation is 1; add the weights corresponding to each type of traffic data in all security situations and divide it by the number of security situations to obtain the sensitivity.

[0065] The traffic classification model execution steps include:

[0066] S101, calculating the information entropy of each pre-processed traffic data; Information entropy:

[0067]

[0068] In the formula, H jrepresents the information entropy of class j traffic data, n i represents the number of times the characteristic attribute i of the j-type traffic data appears in the random event, n represents the number of types of the characteristic attributes of the j-type traffic data, It represents the sum of the number of occurrences of all characteristic attributes of type j traffic data in random events.

[0069] S102: Segment, clean and vector-convert the pre-processed traffic data to obtain a grayscale traffic map sequence.

[0070] S103, input the grayscale flow map sequence into the first convolution layer, use the two-dimensional convolution filter variant to extract spatial features, and use the one-dimensional convolution filter variant to aggregate temporal features along the time dimension, send the spatial feature map and the temporal feature map after the dimension is reduced by the average pooling operation into a fully connected layer, normalize the output through the Softmax function to obtain the weight coefficient matrix, and obtain the first spatiotemporal feature after the spatiotemporal features and the weight coefficient matrix are fused.

[0071] S104, input the fused first spatiotemporal features into the second convolutional layer, use a two-dimensional convolution filter variant to extract spatial features, and use a one-dimensional convolution filter variant to aggregate temporal features along the time dimension, send the spatial feature map and the temporal feature map after reducing the dimension in the average pooling operation into a fully connected layer, normalize the output through the Softmax function to obtain a weight coefficient matrix, and obtain the fused second spatiotemporal features by combining the spatiotemporal features and the weight coefficient matrix.

[0072] S105. The information entropy corresponding to the second spatiotemporal feature is fused using an LC operation to obtain a third spatiotemporal feature.

[0073] S106. After weighted adjustment of the third spatiotemporal feature using the channel attention mechanism, the feature is input into the fully connected layer and then the final traffic data classification result is output.

[0074] S2. Collect flow data in real time and pre-process the collected flow data.

[0075] S3. Use the traffic classification model to classify the pre-processed traffic data. Based on the information entropy of the classified traffic data, use the weighted method to determine the stability of the traffic data and visualize the stability of the traffic data. The stability calculation formula of the traffic data is

[0076] sta j = l j H j ;

[0077] In the formula, sta j Indicates the stability of class j traffic data, l jrepresents the sensitivity of class j traffic data, H j Represents the information entropy of class j traffic data.

[0078] S4. Determine the abnormal traffic data based on the information entropy of the classified traffic data and predict the first security situation based on the correlation between each type of traffic data and each security situation. Specifically, take the classified traffic data whose information entropy is greater than its corresponding security threshold as abnormal traffic data and determine the classification type corresponding to the abnormal traffic data. Take the security situation corresponding to which the correlation between the abnormal traffic data and each security situation is greater than the threshold B as the first security situation.

[0079] S5. Input the real-time collected traffic data into the security situation prediction model to perform security situation prediction, determine the type of the second security situation, take the intersection of the first security situation and the second security situation, and determine the final security situation prediction result; the security situation prediction model can be constructed using a neural network model, a regression prediction method, a Bayesian network model, and a long short-term memory network.

[0080] S6. Evaluate the final security situation prediction results based on the security situation evaluation index system and visualize the security situation evaluation results; the security situation evaluation index system includes vulnerability evaluation indicators, disaster recovery evaluation indicators, threat evaluation indicators and stability evaluation indicators. The specific execution steps of the security situation prediction result evaluation include: using the hierarchical analysis method to determine the corresponding weights of the vulnerability evaluation indicators, disaster recovery evaluation indicators, threat evaluation indicators and stability evaluation indicators;

[0081] Compute vulnerability assessment data, disaster recovery assessment data, threat assessment data, and stability assessment data for security situation prediction;

[0082] The vulnerability assessment data of the security situation prediction is weighted based on the weights corresponding to the vulnerability assessment indicators to obtain the final vulnerability assessment result;

[0083] The disaster recovery assessment data of the security situation prediction is weighted based on the weights corresponding to the disaster recovery assessment indicators to obtain the final disaster recovery assessment result;

[0084] The threat assessment data of the security situation prediction is weighted based on the weights corresponding to the threat assessment indicators to obtain the final threat assessment result;

[0085] The stability assessment data of the security situation prediction is weighted based on the weights corresponding to the stability assessment indicators to obtain the final stability assessment result.

[0086] Embodiment 2:

[0087] A cloud-based collaborative real-time traffic data visualization analysis system, comprising:

[0088] The traffic data sensitivity module is used to classify the historical traffic data using the traffic classification model, and to determine the correlation between each type of traffic data and each security situation using the grey correlation method, and to determine the sensitivity of each type of traffic data;

[0089] Data collection module, collects flow data in real time and pre-processes the collected flow data;

[0090] The stability display module uses the traffic classification model to classify the pre-processed traffic data, determines the stability of the traffic data using a weighted method based on the information entropy of the classified traffic data, and visualizes the stability of the traffic data;

[0091] The security situation prediction module determines abnormal traffic data based on the information entropy of the classified traffic data and predicts the first security situation based on the correlation between each type of traffic data and each security situation; inputs the real-time collected traffic data into the security situation prediction model to perform security situation prediction, determines the type of the second security situation, takes the intersection of the first security situation and the second security situation, and determines the final security situation prediction result;

[0092] The security situation assessment module evaluates the final security situation prediction results based on the security situation assessment indicator system and visualizes the security situation assessment results; the security situation assessment indicator system includes vulnerability assessment indicators, disaster recovery assessment indicators, threat assessment indicators and stability assessment indicators.

[0093] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0094] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art can still modify the technical solutions described in the aforementioned embodiments or replace some of the technical features therein by equivalents. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A cloud-based collaborative real-time traffic data visualization analysis method, characterized in that: The steps include: Use the traffic classification model to classify the historical traffic data, and use the grey correlation method to determine the correlation between each type of traffic data and each security situation, and determine the sensitivity of each type of traffic data; Collect traffic data in real time and pre-process the collected traffic data; The pre-processed traffic data is classified using the traffic classification model. Based on the information entropy of the classified traffic data, the stability of the traffic data is determined using a weighted method, and the stability of the traffic data is visualized. Determine abnormal traffic data based on the information entropy of the classified traffic data and predict the first security situation based on the correlation between each type of traffic data and each security situation; Input the real-time collected traffic data into the security situation prediction model to perform security situation prediction, determine the type of the second security situation, take the intersection of the first security situation and the second security situation, and determine the final security situation prediction result; Based on the security situation assessment index system, the final security situation prediction result is evaluated and the security situation assessment result is visualized; the security situation assessment index system includes vulnerability assessment index, disaster recovery assessment index, threat assessment index and stability assessment index.

2. According to claim 1, a cloud-based collaborative real-time traffic data visualization analysis method is characterized in that: The traffic classification model execution steps include: Calculate the information entropy of each preprocessed traffic data; The pre-processed traffic data is segmented, cleaned, and vectorized to obtain a grayscale traffic map sequence; The grayscale flow map sequence is input into the first convolutional layer, and the spatial features are extracted using a two-dimensional convolution filter variant, and the temporal features are aggregated along the time dimension using a one-dimensional convolution filter variant. The spatial feature map and the temporal feature map after the average pooling operation are reduced in dimension are sent to a fully connected layer, and the output is normalized by the Softmax function to obtain a weight coefficient matrix. The spatiotemporal features and the weight coefficient matrix are combined to obtain the first spatiotemporal features. The fused first spatiotemporal features are input into the second convolutional layer, and the spatial features are extracted using a two-dimensional convolutional filter variant, and the temporal features are aggregated along the time dimension using a one-dimensional convolutional filter variant. The spatial feature map and the temporal feature map after the average pooling operation are reduced in dimension are sent to a fully connected layer, and the output is normalized by the Softmax function to obtain a weight coefficient matrix. The spatiotemporal features and the weight coefficient matrix are combined to obtain the fused second spatiotemporal features. The information entropy corresponding to the second spatiotemporal feature is fused using the LC operation to obtain the third spatiotemporal feature; After weighted adjustment of the third spatiotemporal feature using the channel attention mechanism, it is input into the fully connected layer and then outputs the final traffic data classification result.

3. According to claim 2, a cloud-based collaborative real-time traffic data visualization analysis method is characterized in that: The information entropy: In the formula, H j represents the information entropy of class j traffic data, n i represents the number of times the characteristic attribute i of the j-type traffic data appears in the random event, n represents the number of types of the characteristic attributes of the j-type traffic data, It represents the sum of the number of occurrences of all characteristic attributes of type j traffic data in random events.

4. According to claim 1, a cloud-based collaborative real-time traffic data visualization analysis method is characterized in that: The sensitivity calculation steps for each type of traffic data are as follows: Based on the correlation between each type of traffic data and each security situation, determine the weight of each type of traffic data in a security situation. The sum of the weights of each type of traffic data in a security situation is 1. The sensitivity is obtained by adding up the corresponding weights of each type of traffic data in all security situations and dividing it by the number of security situations.

5. The cloud-based collaborative real-time traffic data visualization analysis method according to claim 1 is characterized in that: The stability calculation formula of the flow data is: is j =l j H j ; In the formula, sta j Indicates the stability of class j traffic data, l j represents the sensitivity of class j traffic data, H j Represents the information entropy of class j traffic data.

6. The cloud-based collaborative real-time traffic data visualization analysis method according to claim 1 is characterized in that: The classified traffic data whose information entropy is greater than the corresponding security threshold is regarded as abnormal traffic data and the classification type corresponding to the abnormal traffic data is determined; the security situation corresponding to which the correlation between the abnormal traffic data and each security situation is greater than the threshold B is regarded as the first security situation.

7. The cloud-based collaborative real-time traffic data visualization analysis method according to claim 1 is characterized in that: The security situation prediction model is constructed by using a neural network model, a regression prediction method, a Bayesian network model, and a long short-term memory network.

8. The cloud-based collaborative real-time traffic data visualization analysis method according to claim 1, characterized in that: The security situation prediction result evaluation step comprises: The weights of vulnerability assessment index, disaster tolerance assessment index, threat assessment index and stability assessment index are determined by using the hierarchical analysis method. Compute vulnerability assessment data, disaster recovery assessment data, threat assessment data, and stability assessment data for security situation prediction; The vulnerability assessment data of the security situation prediction is weighted based on the weights corresponding to the vulnerability assessment indicators to obtain the final vulnerability assessment results; The disaster recovery assessment data of the security situation prediction is weighted based on the weights corresponding to the disaster recovery assessment indicators to obtain the final disaster recovery assessment result; The threat assessment data of the security situation prediction is weighted based on the weights corresponding to the threat assessment indicators to obtain the final threat assessment result; The stability assessment data of the security situation prediction is weighted based on the weights corresponding to the stability assessment indicators to obtain the final stability assessment result.

9. A cloud-based collaborative real-time traffic data visualization analysis system, characterized in that: include: The traffic data sensitivity module is used to classify the historical traffic data using the traffic classification model, and to determine the correlation between each type of traffic data and each security situation using the grey correlation method, and to determine the sensitivity of each type of traffic data; Data collection module, collects flow data in real time and pre-processes the collected flow data; The stability display module uses the traffic classification model to classify the pre-processed traffic data, determines the stability of the traffic data using a weighted method based on the information entropy of the classified traffic data, and visualizes the stability of the traffic data; A security situation prediction module, which determines abnormal traffic data based on the information entropy of the classified traffic data and predicts a first security situation based on the correlation between each type of traffic data and each security situation; Input the real-time collected traffic data into the security situation prediction model to perform security situation prediction, determine the type of the second security situation, take the intersection of the first security situation and the second security situation, and determine the final security situation prediction result; The security situation assessment module evaluates the final security situation prediction results based on the security situation assessment indicator system and visualizes the security situation assessment results; the security situation assessment indicator system includes vulnerability assessment indicators, disaster recovery assessment indicators, threat assessment indicators and stability assessment indicators.

Images