Security operation and maintenance management method and system based on network security event

Abstract

The invention discloses a security operation and maintenance management method and system based on a network security event, and relates to the technical field of network security, and the method comprises the steps: collecting and preprocessing multi-dimensional data, and calculating an attack state based on the preprocessed multi-dimensional data; the attack influence degree is calculated by using a weighted propagation model based on the attack state, and a fitness function is constructed and optimized based on the attack influence degree to obtain an optimal protection strategy set; and converting the optimal protection strategy set into a control instruction, executing the control instruction, and storing, collecting and analyzing generated multi-dimensional data. A non-linear ordinary differential equation is constructed through a non-linear reaction diffusion model, the predictability and the coping capacity of network security management and operation and maintenance are improved, the attack influence degree is calculated through a weighted propagation model, accurate estimation of the wide propagation effect of network security threats is achieved, and through construction and optimization of a fitness function, the network security threats can be accurately estimated. The flexibility and adaptability of the protection system are improved, and the requirement for manual intervention is greatly reduced.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a security operation and maintenance management method and system based on network security events. Background Art

[0002] With the rapid development of Internet technology, network security issues have gradually become a focus of global attention. The means of network attacks are constantly upgraded. Traditional network security protection measures such as firewalls and intrusion detection systems (IDS) can no longer cope with increasingly complex security threats. In order to effectively respond to these challenges, network security protection methods are developing from a single protection tool to a comprehensive security operation and maintenance management system. With the application of big data technology, artificial intelligence and deep learning, the monitoring and response of network security incidents have gradually become automated and intelligent, especially in multi-dimensional data analysis. Significant progress has been made. The use of multi-dimensional data such as network traffic, bandwidth, transmission delay, etc. collected in real time, combined with modern data processing and analysis technology, can more accurately assess the network security situation, timely discover potential security threats, and take effective protective measures.

[0003] The current network security management system generally has some shortcomings. Many traditional security operation and maintenance management methods often rely on static network topology structures and simple rules for security protection, and lack the ability to perceive dynamically changing network conditions and attack methods in real time. Existing technologies lack effective dynamic adjustment mechanisms in calculating attack propagation rates, impacts, and risks, and fail to optimize protection strategies in a timely manner according to changes in real-time network conditions and security incidents to prevent waste of resources or delayed protection effects. Summary of the invention

[0004] In view of the above existing problems, the present invention is proposed.

[0005] Therefore, the present invention provides a security operation and maintenance management method and system based on network security events, which solves the problem that many traditional security operation and maintenance management methods often rely on static network topology structures and simple rules for security protection, lack the ability to perceive dynamically changing network conditions and attack methods in real time, and the existing technology lacks an effective dynamic adjustment mechanism in calculating the attack propagation rate, impact and risk, and fails to timely optimize the protection strategy according to the real-time network conditions and changes in security events to prevent waste of resources or delayed protection effects.

[0006] In order to solve the above technical problems, the present invention provides the following technical solutions: In a first aspect, the present invention provides a security operation and maintenance management method based on network security incidents, which includes collecting and preprocessing multi-dimensional data, calculating the attack status based on the preprocessed multi-dimensional data; calculating the attack impact using a weighted propagation model based on the attack status, constructing a fitness function based on the attack impact and optimizing it to obtain an optimal set of protection strategies; converting the optimal set of protection strategies into control instructions and executing them, and storing, collecting and analyzing the generated multi-dimensional data.

[0007] As a preferred solution of the security operation and maintenance management method based on network security events described in the present invention, wherein: the collecting of multi-dimensional data and pre-processing thereof refers to using the sFlow protocol to collect multi-dimensional data on a terminal device of the network and pre-processing thereof; The multi-dimensional data includes network topology, bandwidth, transmission delay and network traffic data; The preprocessing includes using the network time protocol to synchronize the collected multidimensional data, using discrete wavelet transform to denoise the multidimensional data, using a hash algorithm to identify and delete duplicate data, using a K-nearest neighbor algorithm to fill in missing data, and normalizing the multidimensional data.

[0008] As a preferred solution of the security operation and maintenance management method based on network security events described in the present invention, wherein: the calculation of the attack status based on the preprocessed multi-dimensional data refers to defining the terminal device as a node, extracting the network topology data in the preprocessed multi-dimensional data, and constructing an adjacency matrix of the physical connection relationship in the preprocessed network topology data, which is defined as an edge; Based on the nodes, all directly connected nodes in the preprocessed network topology data are traversed to form a set of neighbor nodes; Based on the preprocessed network traffic data, the IDS protection capability of the i-th node is calculated using the performance evaluation index method. , use the weighted average method to calculate the IDS protection capability between the i-th node and the j-th node ; Based on the preprocessed bandwidth data, transmission delay data, and IDS protection capabilities, calculate the propagation rate between the i-th node and the j-th node , the formula is: , in is the bandwidth between the i-th node and the j-th node, is the transmission delay between the i-th and j-th nodes; The IDS protection capability of the i-th node The reciprocal of is defined as the reaction coefficient of the i-th node ; Collect the maximum attack strength of the ith node from the device manufacturer's product specifications ; The nonlinear reaction-diffusion model is used to formulate the nonlinear ordinary differential equation, which is: , in and are the attack states of the i-th and j-th nodes at time t, is the set of neighbor nodes of the i-th node; Use the Runge-Kutta method to solve the nonlinear ordinary differential equation and obtain the attack state of the i-th node at time t .

[0009] As a preferred solution of the security operation and maintenance management method based on network security events of the present invention, wherein: the calculation of the attack impact using a weighted propagation model based on the attack state refers to the number of all directly connected edges of the node in the preprocessed network topology data traversed based on the node, recorded as the node degree; Based on the adjacency matrix, the Floyd-Warshall algorithm is used to iteratively calculate and obtain the shortest path matrix for each pair of nodes. The elements in the shortest path matrix are extracted as the number of hops between the i-th node and the j-th node. ; Use the propagation delay correction formula to calculate the correction term for the propagation delay ; Based on the preprocessed network topology data, the PageRank algorithm is used to calculate the PageRank value PR of the node; Using empirical regression analysis to set adjustment factors ; The propagation rate, attack status, propagation delay correction term and PageRank value are combined to calculate the attack influence of the i-th node at time t using the weighted propagation model. , the formula is: , in is the attack state of the jth node, is the PageRank value of the jth node, is the degree of the jth node.

[0010] As a preferred solution of the security operation and maintenance management method based on network security events described in the present invention, wherein: the fitness function is constructed and optimized based on the attack impact to obtain the optimal protection strategy set, which means that the risk of the i-th node is calculated using the risk formula based on the attack state and the attack impact. , the formula is: , in is the attack influence of the jth node; The entropy weight method is used to calculate the weight coefficients of the attack impact and risk respectively. Based on the attack impact and risk, the weighted summation method is used to calculate the comprehensive risk value. ; Constructing fitness function based on risk degree and comprehensive risk value , the formula is: , Where N is the total number of nodes in the network, For protection strategies; A set of initial populations is randomly generated, including transmission delay and bandwidth allocation. The reconstruction objective function value of each population is calculated and defined as the fitness value. The individual with the lowest fitness value is selected from the initial population for crossover mutation operation to generate the next generation population. The iterative operation is repeated and stopped when the fitness value converges. The genetic individual with the lowest fitness value in the population after stopping the iteration is output as the optimal individual, and the optimal protection strategy set is obtained, including transmission delay and bandwidth allocation strategy.

[0011] As a preferred solution of the security operation and maintenance management method based on network security events described in the present invention, wherein: converting the optimal protection strategy set into control instructions and executing them refers to generating control instructions from the optimal protection strategy set and executing them refers to generating control instructions from the optimal protection strategy set using an optimized control strategy generation method; The control instructions are transmitted to the terminal device using the communication protocol DNP3, and the terminal device receives the control instructions and executes them.

[0012] As a preferred solution of the security operation and maintenance management method based on network security incidents described in the present invention, wherein: the storage of multi-dimensional data generated by collection and analysis refers to storing the collected multi-dimensional data and the optimal protection strategy set generated by the analysis in a central database, and setting security access measures. The central database backs up the stored data in the cloud, and regularly performs integrity checks on the stored data and backup data. After the test is completed, an integrity test record is generated and synchronously stored in the central database.

[0013] In a second aspect, the present invention provides a security operation and maintenance management system based on network security events, comprising: A collection status module is used to collect and preprocess multi-dimensional data, and calculate the attack status based on the pre-processed multi-dimensional data; The calculation optimization module is used to calculate the attack impact using a weighted propagation model based on the attack status, build a fitness function based on the attack impact and optimize it to obtain the optimal set of protection strategies; The instruction storage module is used to convert the optimal set of protection strategies into control instructions and execute them, and store the multi-dimensional data generated by collection and analysis.

[0014] In a third aspect, the present invention provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: when the computer program is executed by the processor, any step of the security operation and maintenance management method based on network security incidents as described in the first aspect of the present invention is implemented.

[0015] In a fourth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein: when the computer program is executed by a processor, it implements any step of the security operation and maintenance management method based on network security incidents as described in the first aspect of the present invention.

[0016] The beneficial effects of the present invention are as follows: the present invention collects multi-dimensional data and performs preprocessing, calculates the attack status based on the preprocessed multi-dimensional data; calculates the attack impact using a weighted propagation model based on the attack status, constructs a fitness function based on the attack impact and optimizes it to obtain an optimal set of protection strategies; improves the predictability and response capabilities of network security management and operation and maintenance, which not only improves the flexibility and adaptability of the protection system, but also greatly reduces the need for manual intervention. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0018] Figure 1 This is a flowchart of the security operation and maintenance management method based on network security events in Example 1.

[0019] Figure 2 This is a structural diagram of the security operation and maintenance management system based on network security events in Example 1. DETAILED DESCRIPTION

[0020] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the accompanying drawings.

[0021] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0022] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The term "in one embodiment" that appears in different places in this specification does not necessarily refer to the same embodiment, nor does it refer to a separate or selective embodiment that is mutually exclusive with other embodiments.

[0023] Example 1, reference Figure 1 and Figure 2 , which is the first embodiment of the present invention, and provides a security operation and maintenance management method based on network security events, comprising the following steps: S1, collect and preprocess multi-dimensional data, and calculate the attack status based on the pre-processed multi-dimensional data; Specifically, collecting multi-dimensional data and performing pre-processing means using the sFlow protocol to collect multi-dimensional data on a terminal device of the network and performing pre-processing; The multi-dimensional data includes network topology, bandwidth, transmission delay and network traffic data; The preprocessing includes using the network time protocol to synchronize the collected multidimensional data, using discrete wavelet transform to denoise the multidimensional data, using a hash algorithm to identify and delete duplicate data, using a K-nearest neighbor algorithm to fill in missing data, and normalizing the multidimensional data.

[0024] The network topology, bandwidth, transmission delay and network traffic data are collected on network terminal devices through the sFlow protocol, which can fully reflect the operation status of the network and the interaction relationship between each node. The network time protocol (NTP) ensures the time consistency of the data of each device to avoid errors introduced by clock asynchrony. De-noising reduces useless high-frequency noise through discrete wavelet transform and retains effective signal components. Data de-duplication eliminates duplicate data and avoids the interference of redundant information on the analysis results. Missing data filling uses the KNN algorithm to infer missing values ​​based on similarity to further improve data integrity, while normalization ensures the fairness of different data dimensions and avoids the excessive influence of certain dimensions on the analysis results. The collected original multi-dimensional data can be provided to subsequent network security situation awareness and protection models in a more accurate and consistent format. The fully pre-processed data can more effectively support the dynamic detection and response of network security incidents, thereby improving the protection system's ability to identify and respond to network threats.

[0025] Further, calculating the attack status based on the preprocessed multi-dimensional data means defining the terminal device as a node, extracting the network topology data in the preprocessed multi-dimensional data, and constructing an adjacency matrix of the physical connection relationship in the preprocessed network topology data, which is defined as an edge; Based on the nodes, all directly connected nodes in the preprocessed network topology data are traversed to form a set of neighbor nodes; Based on the preprocessed network traffic data, the IDS protection capability of the i-th node is calculated using the performance evaluation index method. , use the weighted average method to calculate the IDS protection capability between the i-th node and the j-th node ; Based on the preprocessed bandwidth data, transmission delay data, and IDS protection capabilities, calculate the propagation rate between the i-th node and the j-th node , the formula is: , in is the bandwidth between the i-th node and the j-th node, is the transmission delay between the i-th and j-th nodes; The IDS protection capability of the i-th node The reciprocal of is defined as the reaction coefficient of the i-th node ; Collect the maximum attack strength of the ith node from the device manufacturer's product specifications ; The nonlinear reaction-diffusion model is used to formulate the nonlinear ordinary differential equation, which is: , in and are the attack states of the i-th and j-th nodes at time t, is the set of neighbor nodes of the i-th node; The reaction rate is inversely related to the protection capability. If the protection capability is strong, the node will react slowly to the attack, and the attack state growth will also slow down accordingly. This is consistent with the physical meaning. In the formula It reflects the self-suppression effect of the node when it is attacked, that is, the attack state of the node gradually slows down as the attack degree increases. The introduction of the maximum attack strength is very appropriate because each node has a natural limit value (bearing strength). After exceeding this value, the propagation effect of the attack will weaken. The node's protection ability, hardware resources, software protection, etc. all limit the upper limit of its attack tolerance. When the attack intensity approaches the node's maximum attack strength, the attack growth will tend to saturation, and the effect of further growth will weaken. This is in line with the physical laws of the system reaction and diffusion process. Nonlinear terms It reflects the self-limiting effect of attack expansion, the diffusion term This is consistent with the diffusion law of attacks in actual networks: attacks will not expand indefinitely, but will be suppressed by the attack state approaching the maximum value. The attack state of neighboring nodes affects the attack state of the i-th node, which is consistent with the diffusion characteristics of network attacks. The probability of neighboring nodes being attacked will affect the attack probability of the target node. Most attack propagation models in the prior art only model attack propagation based on network topology or a fixed propagation rate, ignoring the dynamic effects of node protection capability and maximum carrying capacity. By introducing the reaction coefficient and the maximum carrying attack intensity, this formula can more accurately reflect the different protection capabilities and carrying limits of different nodes, making the attack propagation model more adaptable to the actual network environment. The traditional linear propagation model cannot handle the self-limiting characteristics of attack expansion. The nonlinear reaction term dynamically simulates the reaction and carrying capacity of the node to the attack, further improving the accuracy of the model. The nonlinear effect enhances the model's consideration of attack protection measures, making the attack propagation model better reflect the restriction mechanism of attacks in the real network. Different from the models that usually use a fixed propagation rate or are based on conventional topological analysis in the prior art, this model can dynamically adjust the propagation coefficient according to the attack status of the adjacent nodes, taking into account the dynamic interaction between the diffusion of the attack and the network topology, and improving the adaptability of the model to complex network structures. By combining the node protection capability, carrying capacity, nonlinear diffusion term and the propagation effect of the adjacent nodes, it can not only analyze the spatial distribution of the attack propagation path, but also accurately describe the evolution of the attack in the time dimension, and improve the predictability and response capabilities of network security management and operation and maintenance. Use the Runge-Kutta method to solve the nonlinear ordinary differential equation and obtain the attack state of the i-th node at time t .

[0026] The neighbor node set intuitively depicts the connection status and relationship of each node in the network, providing a clear network structure map for subsequent security situation assessment. Through the adjacency matrix, the system can quickly identify the direct connection between nodes, providing an important basis for calculating the attack propagation path and impact. Through the performance evaluation index method, the IDS protection capability of each node is calculated, and the security protection level of each node in the network can be quantitatively evaluated, so that nodes with strong protection capabilities can be protected first, while nodes with weaker protection capabilities can receive supplementary protection measures in time. Calculating the propagation rate can predict the expansion range of the attack and adjust the protection strategy according to the propagation rate in the network. By calculating the reaction coefficient of each node (that is, the inverse of the IDS protection capability) and the product specification of the equipment manufacturer, the attack can be predicted. The maximum attack intensity collected in the model can further refine the protection capability assessment of each node. This combined analysis can ensure that the network system can make reasonable resource allocation and protection response when facing attacks of different intensities. The nonlinear reaction-diffusion model is used to simulate the propagation of attacks, and the Runge-Kutta method is used to numerically solve ordinary differential equations, which can accurately predict the dynamic changes of the attack state. The model takes into account the nonlinear characteristics of attack propagation, so that the state changes of attacks at different time points can be carefully predicted. The attack state of each node is calculated through the nonlinear model, which greatly improves the intelligence of the network security system. By automatically adjusting the protection measures, efficient response to complex network attacks can be achieved, which greatly improves the timeliness and accuracy of protection.

[0027] S2. Calculate the attack impact using a weighted propagation model based on the attack status, build a fitness function based on the attack impact and optimize it to obtain the optimal set of protection strategies; Specifically, the attack impact degree is calculated using a weighted propagation model based on the attack state, which refers to the number of all directly connected edges of the node in the preprocessed network topology data based on the node, recorded as the node degree; Based on the adjacency matrix, the Floyd-Warshall algorithm is used to iteratively calculate and obtain the shortest path matrix for each pair of nodes. The elements in the shortest path matrix are extracted as the number of hops between the i-th node and the j-th node. ; Use the propagation delay correction formula to calculate the correction term for the propagation delay , the formula is: , Based on the preprocessed network topology data, the PageRank algorithm is used to calculate the PageRank value PR of the node; Using empirical regression analysis to set adjustment factors ; The propagation rate, attack status, propagation delay correction term and PageRank value are combined to calculate the attack influence of the i-th node at time t using the weighted propagation model. , the formula is: , in is the attack state of the jth node, is the PageRank value of the jth node, is the degree of the jth node.

[0028] Existing attack propagation models usually ignore the importance of nodes. This formula introduces PageRank values ​​to weight the influence of each node, thereby ensuring that the impact of node importance on attack propagation is accurately reflected. Existing models only focus on the propagation rate of attacks and ignore the impact of transmission delays. Different network connections (such as links with different bandwidths and delays) will have different effects on the speed of attack propagation. This formula combines the propagation rate and propagation delay to more accurately simulate the actual process of attack propagation. This allows the model to not only evaluate the propagation speed of attacks, but also consider changes under different network conditions. Traditional attack propagation models usually use linear models, ignoring nonlinear behavior in actual networks. Through nonlinear propagation effects, the dynamic changes of attacks are considered, which can more accurately predict the diffusion process of attacks in the network and provide a basis for the adjustment of protection strategies. By combining the attack status of adjacent nodes with the network topology, this model can more accurately calculate the attack influence of nodes and reflect the complexity of attacks being transmitted from other nodes to target nodes. By traversing the nodes in the network topology and their directly connected edges, the system can accurately evaluate the possible paths and impact range of the attack in the network. By using the Floyd-Warshall algorithm to calculate the shortest path matrix between each pair of nodes, the system can accurately obtain the "hop count" information between each node in the network. The hop count refers to the minimum number of edges passed from one node to another, which directly reflects the distance between two nodes. By using the propagation delay correction formula, the system can calibrate the delay of information propagation in the network and eliminate errors caused by network fluctuations, thereby ensuring that the calculation of the propagation rate is more accurate. The importance of a node not only affects its own protection needs, but may also determine its role in the propagation of an attack. By calculating the Pag of each node, the system can calculate the number of nodes that are affected by the attack. eRank value PR, the system can identify the key nodes in the network, these nodes are often the main carriers of attack spread, by calculating the PageRank value PR of each node, the system can identify the key nodes in the network, these nodes are often the main carriers of attack spread, the use of empirical regression analysis method enables the weighted propagation model to be adjusted according to historical data and the actual network environment, thereby improving the prediction accuracy of the model, using the weighted propagation model to calculate the attack influence of each node at a certain moment, which can comprehensively consider the role of various factors in the network, and provide a comprehensive basis for evaluating the propagation effect and impact range of attacks in the network. The system can intelligently adjust the protection strategy, optimize the allocation of network resources, and improve the network's anti-attack ability and adaptability.

[0029] Furthermore, a fitness function is constructed and optimized based on the attack impact to obtain the optimal set of protection strategies: Based on the attack status and attack impact, the risk of the i-th node is calculated using the risk formula. , the formula is: , in is the attack influence of the jth node; The attack propagation model only evaluates risks based on the network topology and the properties of the nodes themselves (such as protection capabilities, attack status, etc.), ignoring the role of adjacent nodes in attack propagation. This model takes into account the attack status and propagation capabilities of adjacent nodes, making risk assessment more refined and able to reflect the complex interactions between nodes. In this way, the model can identify the influence of important nodes in the network and more accurately evaluate the propagation paths between nodes. Traditional attack propagation models mostly use linear propagation models, assuming that the influence between nodes is linear, which simplifies the complexity of attack propagation in the real world. The sigmoid function is used to handle the nonlinear regulation of propagation delay and attack impact, so that the propagation effect of the attack varies with the attack status of the node. The proposed method can smoothly change with the change of state, which is not only closer to the actual attack propagation mode, but also can finely control the influence of nonlinear diffusion by adjusting the coefficient, thereby improving the prediction accuracy of the model. The existing model simply relies on the connection strength of the node to calculate the propagation rate, ignoring the role of propagation delay. By introducing the joint modeling of propagation delay and propagation rate, the model can more accurately reflect the delay and bandwidth differences between nodes in the network, thereby more realistically simulating the attack propagation process in the network. By introducing the sigmoid function and the attack influence adjustment mechanism, the attack influence of each node can be flexibly adjusted within different time scales, so that the model can reflect the attack state changes of the node in real time and better cope with the dynamic network attack environment. The entropy weight method is used to calculate the weight coefficients of the attack impact and risk respectively. Based on the attack impact and risk, the weighted summation method is used to calculate the comprehensive risk value. ; Constructing fitness function based on risk degree and comprehensive risk value , the formula is: , Where N is the total number of nodes in the network, For protection strategies; Existing protection strategies usually only consider the protection needs or risks of nodes and lack a dynamic adjustment mechanism. Traditional methods may have the same protection strategy for all nodes and do not make targeted allocations based on risk and priority. This formula combines priority and risk, dynamically adjusts the protection strategy based on the risk and importance of the node, and ensures that high-risk and key nodes are protected first. Most of the existing attack propagation and protection models ignore the importance of nodes in the network, which may result in insufficient protection of core nodes, thus affecting the security of the entire network. By introducing the PageRank value, it ensures that important nodes in the network receive higher priority protection, enhances the model's adaptability to the network structure, and can effectively slow down the spread of attacks. The existing model only considers The connectivity and propagation rate of nodes ignore the propagation delay of different links in the network, resulting in the model being unable to accurately reflect the actual differences in propagation speed in the network. This formula combines propagation delay and propagation rate to provide a more accurate prediction of attack propagation under different network conditions. This consideration can better simulate the actual network environment and improve the effectiveness of the protection strategy. Traditional models usually use linear models to describe attack expansion. This method cannot capture the nonlinear characteristics of attack propagation, resulting in low prediction accuracy of the model when facing a complex network environment. The sigmoid function is introduced to nonlinearly adjust the impact of attack propagation, so that the protection strategy can more sensitively adapt to attacks of different intensities and improve the real-time response capability of the protection measures. A set of initial populations is randomly generated, including transmission delay and bandwidth allocation. The reconstruction objective function value of each population is calculated and defined as the fitness value. The individual with the lowest fitness value is selected from the initial population for crossover mutation operation to generate the next generation population. The iterative operation is repeated and stopped when the fitness value converges. The genetic individual with the lowest fitness value in the population after stopping the iteration is output as the optimal individual, and the optimal protection strategy set is obtained, including transmission delay and bandwidth allocation strategy.

[0030] By combining the attack impact and risk to evaluate the security of each node, the potential threat of attacks to the network can be fully reflected. Calculating the comprehensive risk value can assign an appropriate protection level to each node, ensuring that key nodes in the network (such as nodes with high risk) are more strongly protected. The weights are calculated by the entropy weight method, and the comprehensive risk value is obtained by the weighted summation method to ensure that the impact of different factors is accurately evaluated, which improves the rationality and pertinence of the protection strategy design. By constructing a fitness function and combining the risk and comprehensive risk value of the nodes in the network, the system can evaluate the performance of each set of protection strategies in actual applications. Genetic algorithms, as an efficient optimization method, can simulate the process of natural selection and gene inheritance. Finding the optimal solution in a complex strategy space can not only efficiently handle complex network protection problems, but also dynamically adjust strategies according to actual attack situations. Transmission delay and bandwidth allocation strategies can be dynamically adjusted according to the evaluation results of attack impact, thereby improving the network's anti-attack capabilities and resource utilization efficiency. Through comprehensive analysis of risk and attack impact, the system can dynamically reinforce the network and respond to various security threats in a timely manner, thereby greatly improving the stability and security of the network. By adjusting transmission delay and bandwidth allocation through genetic algorithms, balanced protection can be performed across the entire network to avoid excessive concentration or dispersion of resources, ensuring that each node in the network can be reasonably protected and improving the overall protection capabilities of the network.

[0031] S3, convert the optimal set of protection strategies into control instructions and execute them, store, collect and analyze the generated multi-dimensional data; Specifically, converting the optimal protection strategy set into control instructions and executing them means generating control instructions from the optimal protection strategy set and executing them means generating control instructions from the optimal protection strategy set using an optimized control strategy generation method; The control instructions are transmitted to the terminal device using the communication protocol DNP3, and the terminal device receives the control instructions and executes them.

[0032] By automatically generating and executing control instructions, the system can quickly and accurately adjust the protection strategy when the network changes or the attack threat increases, thereby reducing the interference of human factors and improving the real-time and flexibility of network protection. The introduction of the optimized control strategy generation method enables the protection strategy to be flexibly adjusted according to the real-time needs of the network environment. It not only takes into account the capabilities of various network devices and the network topology, but also can adapt to different attack scenarios and generate control instructions that meet actual needs. The use of DNP3 protocol to transmit control instructions can effectively ensure the reliability and real-time nature of instruction transmission. The terminal device automatically executes control instructions and can respond quickly according to network security protection needs. By dynamically adjusting the protection strategy, the adaptability of the network is improved. The implementation of the optimal protection strategy can not only improve security, but also effectively optimize the use of network resources.

[0033] Furthermore, storing the multi-dimensional data generated by collection and analysis means storing the collected multi-dimensional data and the optimal protection strategy set generated by the analysis in a central database, and setting security access measures. The central database will back up the stored data in the cloud, and regularly perform integrity checks on the stored data and backup data. After the test is completed, an integrity test record will be generated and stored synchronously in the central database.

[0034] Storing multi-dimensional data and protection strategy sets in a central database and setting security access measures can centrally manage all network security data and ensure the integrity and confidentiality of information. By setting strict access control and encryption measures, it is ensured that only authorized personnel can access and modify data, thereby preventing data leakage or malicious tampering. Security access measures provide guarantees for the system's protection capabilities and enhance data security. Backing up stored data in the cloud can effectively prevent data loss due to system crashes or equipment failures. Periodic integrity testing of stored data and backup data can timely discover potential data problems such as data loss, tampering or damage. Through the storage and management of the collected multi-dimensional data and the optimal protection strategy set in the central database, centralized data management can be achieved, which not only improves the efficiency of data retrieval and access, but also facilitates cross-departmental and cross-system collaborative analysis and decision-making. By implementing cloud backup and integrity testing, the reliability and fault tolerance of the system are greatly enhanced. Automated backup, integrity testing and protection strategy adjustment reduce human errors and the complexity of system management, and improve operation and maintenance efficiency and accuracy.

[0035] This embodiment also provides a security operation and maintenance management system based on network security events, including: A collection status module is used to collect and preprocess multi-dimensional data, and calculate the attack status based on the pre-processed multi-dimensional data; The calculation optimization module is used to calculate the attack impact using a weighted propagation model based on the attack status, build a fitness function based on the attack impact and optimize it to obtain the optimal set of protection strategies; The instruction storage module is used to convert the optimal set of protection strategies into control instructions and execute them, and store the multi-dimensional data generated by collection and analysis.

[0036] This embodiment also provides a computer device, which is suitable for the case of a security operation and maintenance management method based on network security incidents, including: a memory and a processor; the memory is used to store computer executable instructions, and the processor is used to execute computer executable instructions to implement the security operation and maintenance management method based on network security incidents as proposed in the above embodiment.

[0037] The computer device may be a terminal, and the computer device includes a processor, a memory, a communication interface, a display screen and an input device connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be achieved through WIFI, an operator network, NFC (near field communication) or other technologies. The display screen of the computer device may be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device may be a touch layer covered on the display screen, or a key, trackball or touchpad provided on the housing of the computer device, or an external keyboard, touchpad or mouse, etc.

[0038] This embodiment also provides a storage medium on which a computer program is stored. When the program is executed by a processor, the security operation and maintenance management method based on network security events proposed in the above embodiment is implemented; the storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (Static Random Access Memory, referred to as SRAM), electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, referred to as EEPROM), erasable programmable read-only memory (Erasable Programmable Read Only Memory, referred to as EPROM), programmable read-only memory (Programmable Red-Only Memory, referred to as PROM), read-only memory (Read-Only Memory, referred to as ROM), magnetic storage, flash memory, magnetic disk or optical disk.

[0039] In summary, the present invention collects multi-dimensional data and performs preprocessing, calculates the attack status based on the preprocessed multi-dimensional data; calculates the attack impact using a weighted propagation model based on the attack status, constructs a fitness function based on the attack impact and optimizes it to obtain the optimal set of protection strategies; improves the predictability and response capabilities of network security management and operation and maintenance, which not only improves the flexibility and adaptability of the protection system, but also greatly reduces the need for manual intervention.

[0040] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A security operation and maintenance management method based on network security events, characterized by: include, Collect and preprocess multi-dimensional data, and calculate the attack status based on the pre-processed multi-dimensional data; Based on the attack status, a weighted propagation model is used to calculate the attack impact, and a fitness function is constructed and optimized based on the attack impact to obtain the optimal set of protection strategies. Convert the optimal set of protection strategies into control instructions and execute them, and store, collect and analyze the generated multi-dimensional data.

2. The method for security operation and maintenance management based on network security events according to claim 1, characterized in that: The collecting of multi-dimensional data and pre-processing thereof refers to using the sFlow protocol to collect multi-dimensional data and pre-process it on a terminal device of the network; The multi-dimensional data includes network topology, bandwidth, transmission delay and network traffic data; The preprocessing includes using the network time protocol to synchronize the collected multidimensional data, using discrete wavelet transform to denoise the multidimensional data, using a hash algorithm to identify and delete duplicate data, using a K-nearest neighbor algorithm to fill in missing data, and normalizing the multidimensional data.

3. The method for security operation and maintenance management based on network security events according to claim 2, characterized in that: Calculating the attack status based on the preprocessed multi-dimensional data means defining the terminal device as a node, extracting the network topology data in the preprocessed multi-dimensional data, and constructing an adjacency matrix based on the physical connection relationship in the preprocessed network topology data, which is defined as an edge; Based on the nodes, all directly connected nodes in the preprocessed network topology data are traversed to form a set of neighbor nodes; Based on the preprocessed network traffic data, the IDS protection capability of the i-th node is calculated using the performance evaluation index method. , use the weighted average method to calculate the IDS protection capability between the i-th node and the j-th node ; Based on the preprocessed bandwidth data, transmission delay data, and IDS protection capabilities, calculate the propagation rate between the i-th node and the j-th node , the formula is: ， in is the bandwidth between the i-th node and the j-th node, is the transmission delay between the i-th and j-th nodes; The IDS protection capability of the i-th node The reciprocal of is defined as the reaction coefficient of the i-th node ; Collect the maximum attack strength of the ith node from the device manufacturer's product specifications ; The nonlinear reaction-diffusion model is used to formulate the nonlinear ordinary differential equation, which is: ， in and are the attack states of the i-th and j-th nodes at time t, is the set of neighbor nodes of the i-th node; Use the Runge-Kutta method to solve the nonlinear ordinary differential equation and obtain the attack state of the i-th node at time t .

4. The method for security operation and maintenance management based on network security events according to claim 3, characterized in that: The calculation of the attack impact using the weighted propagation model based on the attack state refers to the number of all directly connected edges of the node in the pre-processed network topology data traversed based on the node, recorded as the node degree; Based on the adjacency matrix, the Floyd-Warshall algorithm is used to iteratively calculate and obtain the shortest path matrix for each pair of nodes. The elements in the shortest path matrix are extracted as the number of hops between the i-th node and the j-th node. ; Use the propagation delay correction formula to calculate the correction term for the propagation delay ; Based on the preprocessed network topology data, the PageRank algorithm is used to calculate the PageRank value PR of the node; Using empirical regression analysis to set adjustment factors ; The propagation rate, attack status, propagation delay correction term and PageRank value are combined to calculate the attack influence of the i-th node at time t using the weighted propagation model. , the formula is: ， in is the attack state of the jth node, is the PageRank value of the jth node, is the degree of the jth node.

5. The method for security operation and maintenance management based on network security events according to claim 4, characterized in that: The fitness function is constructed and optimized based on the attack impact to obtain the optimal protection strategy set. The risk formula is used to calculate the risk of the i-th node based on the attack status and attack impact. , the formula is: ， in is the attack influence of the jth node; The entropy weight method is used to calculate the weight coefficients of the attack impact and risk respectively. Based on the attack impact and risk, the weighted summation method is used to calculate the comprehensive risk value. ; Constructing fitness function based on risk degree and comprehensive risk value , the formula is: ， Where N is the total number of nodes in the network, For protection strategies; A set of initial populations is randomly generated, including transmission delay and bandwidth allocation. The reconstruction objective function value of each population is calculated and defined as the fitness value. The individual with the lowest fitness value is selected from the initial population for crossover mutation operation to generate the next generation population. The iterative operation is repeated and stopped when the fitness value converges. The genetic individual with the lowest fitness value in the population after stopping the iteration is output as the optimal individual, and the optimal protection strategy set is obtained, including transmission delay and bandwidth allocation strategy.

6. The method for security operation and maintenance management based on network security events according to claim 5, characterized in that: The converting the optimal protection strategy set into control instructions and executing them refers to generating control instructions from the optimal protection strategy set and executing them, which refers to generating control instructions from the optimal protection strategy set using an optimized control strategy generation method; The control instructions are transmitted to the terminal device using the communication protocol DNP3, and the terminal device receives the control instructions and executes them.

7. The method for security operation and maintenance management based on network security events according to claim 6, characterized in that: The storage of the multi-dimensional data generated by collection and analysis refers to storing the collected multi-dimensional data and the optimal protection strategy set generated by the analysis in a central database, and setting security access measures. The central database will back up the stored data in the cloud, and regularly perform integrity checks on the stored data and backup data. After the test is completed, an integrity test record will be generated and stored synchronously in the central database.

8. A security operation and maintenance management system based on network security events, based on the security operation and maintenance management method based on network security events according to any one of claims 1 to 7, characterized in that: include, A collection status module is used to collect and preprocess multi-dimensional data, and calculate the attack status based on the pre-processed multi-dimensional data; The calculation optimization module is used to calculate the attack impact using a weighted propagation model based on the attack status, build a fitness function based on the attack impact and optimize it to obtain the optimal set of protection strategies; The instruction storage module is used to convert the optimal set of protection strategies into control instructions and execute them, and store the multi-dimensional data generated by collection and analysis.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the security operation and maintenance management method based on network security events described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the security operation and maintenance management method based on network security events described in any one of claims 1 to 7 are implemented.

Images