Network security monitoring system based on big data analysis

Abstract

The invention relates to the technical field of computer security, in particular to a network security monitoring system based on big data analysis, which comprises a historical behavior analysis module, a risk assessment module, an attack path analysis module and an emergency response module. According to the method, through real-time monitoring and comparison with historical data, abnormal fluctuation of network behaviors can be accurately identified, specific risks of the abnormal fluctuation of the network behaviors on network security are rapidly evaluated, the accuracy of threat detection is improved, false alarms can be effectively reduced, and through analysis of network topology and behavior data, the network security is improved. The method can effectively track the flow direction of abnormal data, identify potential attack sources and attack paths, improve the timeliness of risk early warning, enhance the identification capability of complex attack modes, and rapidly cut off potential attack links without affecting normal business operation by implementing isolation and service closing measures, thereby improving the risk early warning efficiency. And the security protection efficiency of the computer network and the stability of the system are optimized.

Description

Technical Field

[0001] The present invention relates to the field of computer security technology, and in particular to a network security monitoring system based on big data analysis. Background Art

[0002] The field of computer security technology is concerned with protecting computer systems from unauthorized access, attacks, damage, or other potential security threats. This field involves a variety of technologies, including intrusion detection systems, firewalls, encryption technology, security protocols, and vulnerability management and response. Through these technologies, the behavior of computer networks and systems can be monitored and analyzed to prevent, detect, and respond to various forms of security threats. In addition, computer security also includes the protection of data to ensure its integrity, availability, and confidentiality.

[0003] Among them, the network security monitoring system is a technical system used to monitor and analyze network traffic in real time to detect, alert and defend against potential network security threats. The uses of the system include intrusion detection, abnormal behavior analysis, data leakage protection and malware defense. By deploying the system, network protection can be effectively strengthened to protect against external and internal threats and ensure data integrity, confidentiality and availability. The core functions of the network security monitoring system also include generating security alerts, providing incident response support and generating detailed security event logs.

[0004] Traditional monitoring systems rely on predefined rules and known attack signatures for threat detection, resulting in insufficient response when faced with unknown or mutated attack methods, and are unable to effectively prevent or quickly respond to zero-day vulnerabilities and advanced persistent threats. They are prone to missed reports or false alarms. Traditional systems have a long response time in threat analysis and response strategy deployment, which gives attackers enough time to carry out damage. This is particularly evident in the face of increasingly complex network environments, increasing network operation and maintenance costs and affecting the overall business continuity and data security of the enterprise. Summary of the invention

[0005] The purpose of the present invention is to solve the shortcomings of the prior art and propose a network security monitoring system based on big data analysis.

[0006] In order to achieve the above object, the present invention adopts the following technical solution: a network security monitoring system based on big data analysis, the system comprising: The historical behavior analysis module calculates the average value of computer network data transmission in differentiated time periods based on the computer's historical network traffic data, evaluates the average status of computer network data transmission, and analyzes the fluctuation range of computer network data in differentiated time periods to obtain the historical computer network behavior benchmark; The risk assessment module monitors the current operation data of the computer network based on the historical computer network behavior benchmark, compares the current data flow with the historical computer network behavior benchmark, evaluates the degree of deviation of the computer network state, and evaluates the network security risk level of the computer equipment in combination with the duration of network state deviation, implements corresponding network security risk warning, and obtains security risk information; The attack path analysis module locates the computer device with abnormal data flow based on the security risk information, traces the path from the abnormal computer device to the potential attack source, identifies the attacker's potential action route and attack chain through network topology analysis, and obtains attack path information; Based on the attack path information, the emergency response module identifies the threatened computer devices on the attack path, evaluates the threat level of the computer devices, isolates the computer devices, evaluates the risk level of differentiated services in the computer devices, identifies services that need to be shut down, cuts off potential attack links, optimizes the security and stability of the computing network, and obtains emergency processing records.

[0007] The present invention is improved in that the method for evaluating the average status of computer network data transmission is: Based on the historical network traffic data of the computer, extract the computer network data of the target period, through the formula:

[0008] Calculate the average data transfer volume during the target period ,in, Indicates the average data transfer volume during the target period. It is The amount of data transferred at a point in time, is the total number of data points in the target time period; Based on the average data transfer volume during the target period ,according to The value is used to evaluate the transmission volume level of the computer network and obtain the average status assessment result.

[0009] The present invention is improved in that the steps of obtaining the historical computer network behavior benchmark are: Based on the average condition evaluation result, the formula:

[0010] Calculate the volatility range of the target period ,in, Indicates the average data transfer volume during the target period. It is The amount of data transferred at a point in time, is the total number of data points in the target time period, Indicates The weight coefficient of each time point, is the fluctuation range of the target period; Based on the volatility range of the target period , integrating the average data transfer volume during the target period , get a historical computer network behavior benchmark.

[0011] The present invention is improved in that the method for evaluating the degree of deviation of the computer network status is: Based on the historical computer network behavior benchmark, monitor the current operation data of the computer network to obtain real-time computer network data; Based on the real-time computer network data, by the formula:

[0012] Calculate the normalized deviation index , and obtain the deviation evaluation result of the computer network status, where Indicates the average data transfer volume during the target period. is the fluctuation range of the target period, is the current network transmission volume, is the adjustment coefficient, is the offset constant, is the proportionality coefficient, is the standardized deviation index.

[0013] The present invention is improved in that the step of obtaining the security risk information is: Based on the deviation degree assessment result of the computer network status, the standardized deviation index at the differentiated time point is compared with the preset deviation threshold, the number of times the standardized deviation index exceeds the preset deviation threshold and the corresponding duration are recorded, and the security risk association data is obtained; Based on the security risk association data, by formula:

[0014] Calculating Cybersecurity Risk Level ,in, For the The normalized deviation index of the deviation, is the number of times exceeding the deviation threshold, For the The duration of the deviation, is the total length of the monitoring period, is the adjustment factor, is the cyber security risk level; Based on the cybersecurity risk level , implement corresponding network security risk warnings, and obtain security risk information.

[0015] The present invention is improved in that the step of acquiring the attack path information is: Based on the security risk information, identify a list of abnormal computer devices, use graph database technology, take each abnormal device as a starting node, track down potential attack sources, extract connection relationships between nodes through database query operations, analyze network topology, apply path search algorithms, find the shortest and most likely path from the abnormal device to the potential attack source, and obtain potential path identification results; Based on the potential path identification result, the formula is:

[0016] Calculating the score of the attack path ,in, For the path The activity intensity of each node, From abnormal device to The path length of the nodes, is the adjustment factor, Score the attack path; Scoring based on the attack path , by comparing the differentiated paths Value size, select The path with the largest value is taken as the target path to obtain the attack path information.

[0017] The present invention is improved in that the method for isolating computer equipment is as follows: Based on the attack path information, identify the threatened computer device on the attack path, and extract the position and function of the computer device in the attack chain to obtain threat association data; Based on the threat correlation data, by formula:

[0018] Threat level to computing devices ,in, Indicates the importance of the equipment. Indicates the urgency of the threat to the device. Indicates the exposure of the device, are model parameters, is the threshold value that defines the exposure; Based on the threat level of the device in question , compared with the preset threat threshold, the computer equipment exceeding the threat threshold is isolated, and the computer equipment isolation result is obtained.

[0019] The present invention is improved in that the steps of obtaining the emergency handling record are: Based on the computer device isolation result, analyzing the running services and applications of the threatened computer device, extracting the business importance and security vulnerability information of the service, and obtaining service-related data; Based on the service association data, by the formula:

[0020] Calculating the service shutdown index ,in, Indicates the business importance of the service, Indicates the security vulnerability level of the service. Indicates the difficulty of restoring the service. is the stability constant, The index for determining whether the service is closed; Based on the judgment index of the closure of the service , compared with the preset closing threshold, The application service whose value exceeds the preset shutdown threshold is closed and an emergency processing record is obtained.

[0021] Compared with the prior art, the advantages and positive effects of the present invention are: In the present invention, by real-time monitoring and comparison with historical data, abnormal fluctuations in network behavior can be accurately identified, and the specific risks posed to network security can be quickly assessed, thereby improving the accuracy of threat detection and effectively reducing the occurrence of false alarms. By analyzing network topology and behavior data, the flow of abnormal data can be effectively tracked, potential attack sources and attack paths can be identified, the timeliness of risk warnings can be improved, and the ability to identify complex attack patterns can be enhanced. By implementing isolation and service shutdown measures, potential attack links can be quickly cut off without affecting normal business operations, thereby optimizing the security protection efficiency of computer networks and the stability of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 is a system flow chart of the present invention; Figure 2 A flow chart for evaluating the average status of computer network data transmission for the present invention; Figure 3 A flow chart for obtaining a historical computer network behavior benchmark for the present invention; Figure 4 A flow chart for evaluating the degree of deviation of a computer network status according to the present invention; Figure 5 A flow chart for obtaining security risk information for the present invention; Figure 6 A flow chart of obtaining attack path information of the present invention; Figure 7 A flow chart for isolating a computer device according to the present invention; Figure 8 A flowchart for obtaining emergency processing records for the present invention. DETAILED DESCRIPTION

[0023] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0024] In the description of the present invention, it should be understood that the terms "length", "width", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", etc., indicating positions or positional relationships, are based on the positions or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present invention. In addition, in the description of the present invention, the meaning of "multiple" is two or more, unless otherwise clearly and specifically defined.

[0025] See also Figure 1 The present invention provides a technical solution: a network security monitoring system based on big data analysis, the system comprising: The historical behavior analysis module calculates the average value of computer network data transmission in differentiated time periods based on the computer's historical network traffic data, evaluates the average status of computer network data transmission, and analyzes the fluctuation range of computer network data in differentiated time periods to obtain the historical computer network behavior benchmark; The risk assessment module monitors the current operation data of the computer network based on the historical computer network behavior benchmark, compares the current data flow with the historical computer network behavior benchmark, evaluates the degree of deviation of the computer network status, and evaluates the network security risk level of the computer equipment in combination with the duration of network status deviation, implements corresponding network security risk warning, and obtains security risk information; The attack path analysis module locates the computer device with abnormal data flow based on the security risk information, traces the path from the abnormal computer device to the potential attack source, and identifies the attacker's potential action route and attack chain through network topology analysis to obtain attack path information; Based on the attack path information, the emergency response module identifies the threatened computer equipment on the attack path, evaluates the threat level of the computer equipment, isolates the computer equipment, and evaluates the risk level of differentiated services in the computer equipment, identifies the services that need to be shut down, cuts off potential attack links, optimizes the security and stability of the computing network, and obtains emergency processing records.

[0026] Historical computer network behavior benchmarks include network traffic averages, peak traffic, and traffic volatility; security risk information includes real-time deviation rates, risk level scores, and abnormal event frequencies; attack path information includes attack source information, affected nodes, and potential attack propagation path information; and emergency response records include response measures information and blocking operation records.

[0027] See also Figure 2 , the method for evaluating the average status of computer network data transmission is: Based on the historical network traffic data of the computer, extract the computer network data of the target period, through the formula:

[0028] Calculate the average data transfer volume during the target period ,in, Indicates the average data transfer volume during the target period. It is The amount of data transferred at a point in time, is the total number of data points in the target time period; Average data transfer volume based on target period ,according to The value is used to evaluate the transmission volume level of the computer network and obtain the average status assessment result.

[0029] formula:

[0030] Parameter details and how to obtain them: It is The amount of data transmitted at a certain time point is recorded automatically by the computer network monitoring system during continuous operation. During the set monitoring period, the network traffic is recorded once per unit time (such as every minute). The data is continuously recorded and stored in the database for subsequent analysis.

[0031] It is the total number of data points in a specified time period, representing the frequency of data collection during the entire time period.

[0032] Calculation example: The time period for focus is set to 3 minutes. , which means that the data transmission volume is recorded once every minute during these three minutes. The specific values ​​are as follows: MB, MB, MB.

[0033] Calculate the sum of all minutes within three minutes MB.

[0034] Calculate the average

[0035] result It means that in the three minutes of observation, the average network data transmission volume per minute is about 133.33MB. This helps network administrators quickly understand the network load status in a short period of time.

[0036] See also Figure 3 ,The steps to obtain the historical computer network behavior benchmark are: Based on the average status assessment results, the formula is:

[0037] Calculate the volatility range of the target period ,in, Indicates the average data transfer volume during the target period. It is The amount of data transferred at a point in time, is the total number of data points in the target time period, Indicates The weight coefficient of each time point, is the fluctuation range of the target period; Fluctuation range based on target period , integrating the average data transfer volume during the target period , get a historical computer network behavior benchmark.

[0038] formula:

[0039] Parameter details and how to obtain them: : The average data transmission volume during the target period, calculated by the previous step.

[0040] :Indicates the The amount of network data at a point in time is recorded by a computer network monitoring system in real time or at a predetermined time point. These data are the basic data points used in the analysis.

[0041] : Indicates the total number of data points in the target time period, that is, the number of time points recorded during the measurement period. This number reflects the size of the data set and is used to calculate the mean and standard deviation.

[0042] :It is The weights of the importance of the data at each time point are used to adjust the influence of the data point in the total fluctuation calculation according to its importance. These weights can be set based on specific criteria (such as peak hours of network traffic), reflecting that data at certain time points may be more critical than at other times.

[0043] Calculation example: The network data transmission volume at three time points was observed and the corresponding weights were set. Considering that the traffic is usually larger in the evening, the weight of the evening data is higher. The data points are: MB, MB, MB, weight: , , , total number of data points: .

[0044] Calculate the average :

[0045] calculate :

[0046]

[0047]

[0048]

[0049]

[0050]

[0051] Calculation results , indicating that the fluctuation range of network data volume during the three observed time points is approximately 22.91MB. Indicates the degree to which the data deviates from its average value, providing network administrators with important information about network load changes.

[0052] See also Figure 4 ,The method for evaluating the degree of deviation of the computer network status is: Based on the historical computer network behavior benchmark, monitor the current operation data of the computer network and obtain real-time computer network data; Based on real-time computer network data, through the formula:

[0053] Calculate the normalized deviation index , and obtain the deviation evaluation result of the computer network status, where Indicates the average data transfer volume during the target period. is the fluctuation range of the target period, is the current network transmission volume, is the adjustment coefficient, is the offset constant, is the proportionality coefficient, is the standardized deviation index.

[0054] formula:

[0055] Parameter details and how to obtain them: : The average data transmission volume during the target period, calculated by the previous step.

[0056] : The fluctuation range of the target period, calculated through the previous steps.

[0057] :The amount of network data at the current time point, collected in real time by the network monitoring system.

[0058] : Adjustment coefficient, used to adjust the fluctuation range This is a design parameter that can be adjusted based on the specific needs of the network environment.

[0059] : Offset constant, ensuring that the value inside the logarithm is always greater than zero to ensure the validity of the calculation. This constant needs to be set according to the range of the data to avoid illegal operations in the logarithmic calculation.

[0060] : Proportional coefficient, based on the current data volume The size of the logarithmic function can be adjusted to adapt to the change in the amount of data. This coefficient can be set according to the rate of change of historical data to ensure that the sensitivity of the logarithmic part is moderate.

[0061] Calculation example: Set the following numbers for calculation: Data average MB, fluctuation range MB, current data volume MB, adjustment factor , offset constant , proportionality coefficient .

[0062] Calculate the difference between the current data and the average value MB, calculation of fluctuation range with adjustment factor , calculate the logarithmic part , deviation index .

[0063] Calculation results It means that the current data deviates from the historical average to a small extent. The result helps network administrators evaluate and monitor the security status of the network and ensure that the network operates within the normal range.

[0064] See also Figure 5 ,The steps to obtain security risk information are: Based on the deviation degree assessment results of the computer network status, the standardized deviation index at the differentiated time points is compared with the preset deviation threshold, and the number of times the standardized deviation index exceeds the preset deviation threshold and the corresponding duration are recorded to obtain security risk association data; Based on the security risk association data, the formula is:

[0065] Calculating Cybersecurity Risk Level ,in, For the The normalized deviation index of the deviation, is the number of times exceeding the deviation threshold, For the The duration of the deviation, is the total length of the monitoring period, is the adjustment factor, is the cyber security risk level; Based on cybersecurity risk level , implement corresponding network security risk warnings, and obtain security risk information.

[0066] formula:

[0067] Parameter details and how to obtain them: : No. The normalized deviation index of the deviation is calculated as above.

[0068] : No. The duration of the deviation is determined by the time log recorded by the network monitoring system, which is the specific time difference from the beginning to the end of the deviation.

[0069] : The number of times exceeding the deviation threshold is obtained through statistics.

[0070] :The total length of the monitoring period, usually the time from the start to the end of monitoring, is set according to the configuration of the network monitoring system.

[0071] : Adjustment coefficient, used to adjust the impact of the number of deviations on the risk assessment results. This is an empirical value, adjusted based on previous monitoring data and network security requirements.

[0072] Calculation example: The following parameters were set for the calculation: , deviation index The duration of each deviation is 0.8, 1.2, 0.9, 1.5, and 0.7 respectively. The monitoring time periods are 5, 3, 4, 6, and 2 minutes respectively. Minutes, adjustment factor .

[0073] Calculate the product of the deviation index and the duration , respectively 4, 3.6, 3.6, 9, 1.4, the total is , calculate the logarithmic part , apply the risk assessment formula: .

[0074] Calculation results , indicating that the network risk level is low after considering the frequency, duration and adjustment factor of deviations during a given monitoring period. This result provides a quantitative risk assessment for network administrators, helping them understand the status of network security during a specific monitoring period and take appropriate security measures.

[0075] See also Figure 6 ,The steps to obtain the attack path information are: Based on security risk information, identify the list of abnormal computer devices, use graph database technology, take each abnormal device as the starting node, track the potential attack source, extract the connection relationship between nodes through database query operations, analyze the network topology, apply the path search algorithm, find the shortest and most likely path from the abnormal device to the potential attack source, and obtain the potential path identification result; Based on the potential path identification results, the formula is:

[0076] Calculating the score of the attack path ,in, For the path The activity intensity of each node, From abnormal device to The path length of the nodes, is the adjustment factor, Score the attack path; Attack path-based scoring , by comparing the differentiated paths Value size, select The path with the largest value is taken as the target path to obtain the attack path information.

[0077] formula:

[0078] Parameter details and how to obtain them: : The first The activity intensity of a node is obtained from the network monitoring system, reflecting the role and importance of the node in potential attack activities.

[0079] : From the starting node (the device detected as abnormal) to the node The distance is the shortest path length calculated by the path search algorithm in the graph database, such as the Dijkstra algorithm.

[0080] : The adjustment coefficient is a preset constant used to ensure that the denominator is not zero and to balance the impact of distance so that the path score will not decrease indefinitely due to the increase in distance.

[0081] Calculation example: There are three key nodes, and the score of the attack path formed by the nodes needs to be evaluated, and the node activity intensity : 80, 50, 30 respectively, the distance from the starting node to these nodes : 1, 2, 3 respectively, adjustment coefficient Set to 0.5.

[0082] Calculation process: Node 1's score:

[0083] Node 2's score:

[0084] Node 3 score:

[0085] Overall rating :

[0086] Calculation results , indicating that the attack path has a higher probability. The higher the score, the more likely the path is to be used by attackers to perform malicious activities.

[0087] See also Figure 7 , the method of isolating computer equipment is: Based on the attack path information, identify the threatened computer devices on the attack path, extract the position and function of the computer devices in the attack chain, and obtain threat association data; Based on threat correlation data, through the formula:

[0088] Threat level to computing devices ,in, Indicates the importance of the equipment. Indicates the urgency of the threat to the device. Indicates the exposure of the device, are model parameters, is the threshold value that defines the exposure; Based on the threat level of the device , compared with the preset threat threshold, the computer equipment exceeding the threat threshold is isolated, and the computer equipment isolation result is obtained.

[0089] formula:

[0090] Parameter details and how to obtain them: :The importance of the device. It is usually rated based on the core function of the device in the network, the degree of sensitive data stored, and the business impact. The importance score of the device can be obtained through the security team's assessment or data provided by the automated asset management system.

[0091] : The urgency of the threat to the device. This metric is based on the device's position on the attack path and the frequency and severity of recent attack attempts or threat activities. Urgency can be obtained through analysis of alerts and logs from intrusion detection systems or security information and event management systems.

[0092] :The exposure of a device reflects its accessibility to the outside world and its potential attack surface. This can be determined using network topology analysis tools, which assess the number of external connections, the number of open ports, and access control policies of the device.

[0093] and : These two parameters regulate the effect of exposure on threat assessment. Defines the slope of the function, affecting the sensitivity of the result to changes in exposure; is the threshold value, which determines the midpoint of the exposure, that is, the point where the effect of the exposure on the result changes from significant to insignificant. These parameters are usually set based on historical data and expert experience.

[0094] Calculation example: Set the parameters as follows: :The importance of equipment in the business is high. : The device faces a relatively high level of imminent threat. : The equipment has a medium level of exposure. : The effect of exposure on the results is more sensitive. : The set exposure threshold.

[0095] Calculation process:

[0096]

[0097]

[0098]

[0099]

[0100]

[0101] Calculation results Indicates that the device faces a medium or higher threat level. The rating helps security teams determine the protective measures that need to be taken.

[0102] See also Figure 8 , the steps to obtain emergency handling records are: Based on the computer equipment isolation results, analyze the running services and applications of the threatened computer equipment, extract the business importance and security vulnerability information of the services, and obtain service-related data; Based on service-related data, the formula is:

[0103] Calculating the service shutdown index ,in, Indicates the business importance of the service, Indicates the security vulnerability level of the service. Indicates the difficulty of restoring the service. is the stability constant, The index for determining whether the service is closed; Determination index based on service shutdown , compared with the preset closing threshold, The application service whose value exceeds the preset shutdown threshold is closed and an emergency processing record is obtained.

[0104] formula:

[0105] Parameter details and how to obtain them : The business importance of a service, which is usually assessed based on the role the service plays in maintaining day-to-day business operations, can be obtained through business impact analysis, a method of evaluating the impact of a specific business function on the company's overall operations.

[0106] : The security vulnerability level of the service. The score is based on the security team's latest vulnerability scan results of the service. The severity rating of the vulnerability is usually provided by international vulnerability scoring standards such as CVSS.

[0107] :The difficulty of service recovery, including the time, resources and technical complexity required to restore the service, is usually supported by business continuity plans or disaster recovery plans.

[0108] : Stability constant, used to ensure the stability of the calculation and avoid the situation where the denominator is zero. This constant should be small enough not to significantly affect the calculation results, such as .

[0109] Calculation example: Set the parameters as follows: : Assume that the service's business impact rating is 7 (on a scale of 1 to 10), indicating high business importance. : The current vulnerabilities in the service are rated as high (on a scale of 1 to 10), indicating that the service has serious security risks. : The difficulty of restoring this service is medium, neither the most complex nor the easiest. : A small constant used to ensure computational stability.

[0110] Calculation process:

[0111]

[0112]

[0113] Calculation results This indicates that the service has a high need to be shut down due to its high business impact and high security risk, with a relatively medium recovery difficulty. This value is used to guide the security team's decision-making and indicates the services that need to be shut down or take additional protection measures to mitigate potential security risks.

[0114] The above are only preferred embodiments of the present invention and are not intended to limit the present invention in other forms. Any technician familiar with the profession may use the technical contents disclosed above to change or modify them into equivalent embodiments with equivalent changes and apply them to other fields. However, any simple modification, equivalent change and modification made to the above embodiments based on the technical essence of the present invention without departing from the technical solution of the present invention still falls within the protection scope of the technical solution of the present invention.

Claims

1. A network security monitoring system based on big data analysis, characterized in that: The system comprises: The historical behavior analysis module calculates the average value of computer network data transmission in differentiated time periods based on the computer's historical network traffic data, evaluates the average status of computer network data transmission, and analyzes the fluctuation range of computer network data in differentiated time periods to obtain the historical computer network behavior benchmark; The risk assessment module monitors the current operation data of the computer network based on the historical computer network behavior benchmark, compares the current data flow with the historical computer network behavior benchmark, evaluates the degree of deviation of the computer network state, and evaluates the network security risk level of the computer equipment in combination with the duration of network state deviation, implements corresponding network security risk warning, and obtains security risk information; The attack path analysis module locates the computer device with abnormal data flow based on the security risk information, traces the path from the abnormal computer device to the potential attack source, identifies the attacker's potential action route and attack chain through network topology analysis, and obtains attack path information; Based on the attack path information, the emergency response module identifies the threatened computer devices on the attack path, evaluates the threat level of the computer devices, isolates the computer devices, evaluates the risk level of differentiated services in the computer devices, identifies services that need to be shut down, cuts off potential attack links, optimizes the security and stability of the computing network, and obtains emergency processing records.

2. The network security monitoring system based on big data analysis according to claim 1 is characterized in that: The method for evaluating the average status of computer network data transmission is: Based on the historical network traffic data of the computer, extract the computer network data of the target period, through the formula: Calculate the average data transfer volume during the target period ,in, Indicates the average data transfer volume during the target period. It is The amount of data transferred at a point in time, is the total number of data points in the target time period; Based on the average data transfer volume during the target period ,according to The value is used to evaluate the transmission volume level of the computer network and obtain the average status assessment result.

3. The network security monitoring system based on big data analysis according to claim 2 is characterized in that: The steps for obtaining the historical computer network behavior benchmark are: Based on the average condition evaluation result, the formula: Calculate the volatility range of the target period ,in, Indicates the average data transfer volume during the target period. It is The amount of data transferred at a point in time, is the total number of data points in the target time period, Indicates The weight coefficient of each time point, is the fluctuation range of the target period; Based on the volatility range of the target period , integrating the average data transfer volume during the target period , get a historical computer network behavior benchmark.

4. The network security monitoring system based on big data analysis according to claim 1 is characterized in that: The method for evaluating the degree of deviation of the computer network status is: Based on the historical computer network behavior benchmark, monitor the current operation data of the computer network to obtain real-time computer network data; Based on the real-time computer network data, by the formula: Calculate the normalized deviation index , and obtain the deviation evaluation result of the computer network status, where Indicates the average data transfer volume during the target period. is the fluctuation range of the target period, is the current network transmission volume, is the adjustment coefficient, is the offset constant, is the proportionality coefficient, is the standardized deviation index.

5. The network security monitoring system based on big data analysis according to claim 4 is characterized in that: The steps for obtaining the security risk information are: Based on the deviation degree assessment result of the computer network status, the standardized deviation index at the differentiated time point is compared with the preset deviation threshold, the number of times the standardized deviation index exceeds the preset deviation threshold and the corresponding duration are recorded, and the security risk association data is obtained; Based on the security risk association data, by formula: Calculating Cybersecurity Risk Level ,in, For the The normalized deviation index of the deviation, is the number of times exceeding the deviation threshold, For the The duration of the deviation, is the total length of the monitoring period, is the adjustment factor, is the cyber security risk level; Based on the cybersecurity risk level , implement corresponding network security risk warnings, and obtain security risk information.

6. The network security monitoring system based on big data analysis according to claim 1 is characterized in that: The steps for acquiring the attack path information are as follows: Based on the security risk information, identify a list of abnormal computer devices, use graph database technology, take each abnormal device as a starting node, track down potential attack sources, extract the connection relationship between nodes through database query operations, analyze the network topology, apply path search algorithms, find the shortest and most likely path from the abnormal device to the potential attack source, and obtain potential path identification results; Based on the potential path identification result, the formula is: Calculating the score of the attack path ,in, For the path The activity intensity of each node, From abnormal device to The path length of the nodes, is the adjustment factor, Score the attack path; Scoring based on the attack path , by comparing the differentiated paths Value size, select The path with the largest value is taken as the target path to obtain the attack path information.

7. The network security monitoring system based on big data analysis according to claim 1 is characterized in that: The method for isolating computer equipment is as follows: Based on the attack path information, identify the threatened computer device on the attack path, and extract the position and function of the computer device in the attack chain to obtain threat association data; Based on the threat correlation data, by formula: Threat level to computing devices ,in, Indicates the importance of the equipment. Indicates the urgency of the threat to the device. Indicates the exposure of the device. are model parameters, is the threshold value that defines the exposure; Based on the threat level of the device in question , compared with the preset threat threshold, the computer equipment exceeding the threat threshold is isolated, and the computer equipment isolation result is obtained.

8. The network security monitoring system based on big data analysis according to claim 7 is characterized in that: The steps for obtaining the emergency handling record are as follows: Based on the computer device isolation result, analyzing the running services and applications of the threatened computer device, extracting the business importance and security vulnerability information of the service, and obtaining service-related data; Based on the service association data, by formula: Calculating the service shutdown index ,in, Indicates the business importance of the service, Indicates the security vulnerability level of the service. Indicates the difficulty of restoring the service. is the stability constant, The index for determining whether the service is closed; Based on the judgment index of the closure of the service , compared with the preset closing threshold, The application service whose value exceeds the preset shutdown threshold is closed and an emergency processing record is obtained.

Images