Network security detection method and system based on cloud computing

Abstract

The invention discloses a network security detection method and system based on cloud computing, and particularly relates to the technical field of college management systems and platforms. When the phenomenon that the operation state of the used equipment network is predicted to be risk but the actual campus network operates normally occurs, further analysis is carried out, hardware risk information of the campus network and software risk information of the campus network are collected and processed to generate a risk assessment coefficient, and the risk assessment coefficient is used for assessment. The risk assessment coefficient is compared with a risk assessment coefficient reference threshold value, when the risk assessment coefficient is greater than the risk assessment coefficient reference threshold value, the network security of the campus network really has a risk, although the campus network can still operate normally at the moment, an alarm needs to be given to remind a worker to carry out maintenance at the moment; the false alarm condition caused by accidental errors of the prediction model or expected risks is reduced, and unnecessary interference and workload to workers are avoided.

Description

Technical Field

[0001] The present invention relates to the technical field of university management systems and platforms, and more specifically, to a network security detection method and system based on cloud computing. Background Art

[0002] Campus network refers to the computer network connected to the campus, which is used to provide network services and resources within the school. In the university management system, the campus network plays a vital role because it connects various information systems, academic resources, administrative services, etc. within the school, providing students, faculty and staff and managers with a convenient network communication and resource sharing platform. The campus network has a large coverage area and needs to cover the entire campus area, including teaching buildings, dormitory areas, laboratories, libraries and other campus areas. At the same time, the campus network needs a stable and lasting high network speed to ensure the normal conduct of experiments and courses, as well as the normal use of teachers and students. Therefore, ensuring the security and stability of the campus network is crucial for the operation and management of the university management system. When the existing campus network is running, once the network security of the campus network has problems, it will cause problems in the operation of the campus network, which will cause problems in the use of the entire campus network. The existing cloud computing-based campus network network security detection technology detects the network status of the campus network. Once the network security of the campus network is detected, it immediately reminds the staff to perform maintenance, thereby timely ensuring the network security of the campus network.

[0003] The prior art has the following deficiencies:

[0004] When the existing campus network network security detection technology detects the network security status of the campus network, it often detects that the campus network has an operational risk and immediately reminds the staff to perform maintenance. Generally, when the campus network is repaired, it is necessary to shut down for maintenance, resulting in interruption of campus network services. Moreover, in the actual campus network network security status detection process, it may be due to accidental errors of the detection system itself that cause problems with the campus network security, or the detected campus network security problems are within the expected range. If the staff is still reminded to perform maintenance immediately at this time, it may cause unnecessary troubles and waste of resources.

[0005] In order to solve the above defects, a network security detection method and system based on cloud computing are provided to solve the above problems. Summary of the invention

[0006] In order to overcome the above-mentioned defects of the prior art, the embodiments of the present invention provide a network security detection method and system based on cloud computing to solve the problems raised in the above-mentioned background technology.

[0007] To achieve the above object, the present invention provides the following technical solutions:

[0008] A network security detection method based on cloud computing includes the following steps:

[0009] S1: First, the operating status of the devices connected to the campus network is predicted by establishing a neural network model to predict the network operating status of the devices connected to the campus network;

[0010] S2: When the network operation status of the device is predicted to be risky but the actual campus network is running normally, it means that the network security of the campus network may be at risk. It is necessary to further determine whether the network security of the campus network is indeed at risk and issue an alarm;

[0011] S3: Collect the hardware risk information and software risk information of the campus network, perform normalization processing, and establish a data processing model to generate a risk assessment coefficient;

[0012] S4: Compare the generated risk assessment coefficient with the pre-set reference threshold of the risk assessment coefficient, and judge whether there is a problem with the network security of the campus network based on the comparison result, and issue an alarm based on the judgment result.

[0013] In a preferred embodiment, the software risk information of the campus network includes the attack intensity CZ of the third party and the network bandwidth utilization HE;

[0014] The network bandwidth utilization is calculated as follows: HE=AG / DK, where AG is the amount of data transmitted through the network within T time, DK represents the maximum transmission bandwidth of the network, and HE is the network bandwidth utilization;

[0015] The calculation expression of the attack strength of the third party is: CZ=h / t, wherein CZ is the attack strength of the third party, h is the number of times the third party attacks the campus network, and t is the duration of the third party attack on the campus network.

[0016] In a preferred embodiment, the hardware risk information of the campus network includes the quality ER of the wires and cables of the campus network equipment and the cooling speed TR of the campus network equipment;

[0017] The calculation expression of the quality of the wires and cables of the campus network equipment is: ER = (sd*sx) - (wd*ws) + (rt*jk); wherein ER is the quality of the wires and cables of the campus network equipment, sd is the purity of the cable, sx is the conductivity of the cable, wd is the length of the cable, ws is the resistivity of the cable, rt is the wear degree of the cable, and jk is the humidity inside the cable;

[0018] The calculation expression for the cooling speed of the campus network equipment is: TR=ah / at, wherein TR is the cooling speed of the campus network equipment, ah is the temperature difference of the campus network equipment from the current temperature to the standard temperature, and at is the time taken for the campus network equipment to cool from the current temperature to the standard temperature.

[0019] In a preferred embodiment, the software risk assessment coefficient is expressed as:

[0020] The third-party attack intensity CZ and the network bandwidth utilization HE are processed to generate the hardware risk assessment coefficient, and the software risk assessment coefficient is marked as SP, which is expressed as follows:

[0021] SP=a1*CZ+a2*HE

[0022] Where SP is the software risk assessment coefficient, a1 and a2 are the proportional coefficients of the third-party attack intensity and network bandwidth utilization, and a1 and a2 are both greater than 0.

[0023] In a preferred embodiment, the expression of the hardware risk assessment coefficient is:

[0024] The quality ER of the wires and cables of the campus network equipment and the cooling speed TR of the campus network equipment are processed to generate a hardware risk assessment coefficient, and the hardware risk assessment coefficient is marked as QL, and its expression is as follows:

[0025] QL=b1*ER+b2*TR

[0026] In the formula, QL is the hardware risk assessment coefficient, b1 and b2 are the preset proportional coefficients of the quality of wires and cables of campus network equipment and the cooling speed of campus network equipment, and b1 and b2 are both greater than 0.

[0027] In a preferred embodiment, the risk assessment coefficient is expressed as:

[0028] The software risk assessment coefficient SP and the hardware risk assessment coefficient QL are processed to generate the risk assessment coefficient K, which is expressed as follows:

[0029]

[0030] Where K is the risk assessment coefficient, α and β are the software risk assessment coefficient and hardware risk assessment coefficient, respectively.

[0031] A network security detection system based on cloud computing includes a risk prediction module, a data acquisition module, a data processing module, a comparison module, and an alarm module, and the modules are connected by signals;

[0032] Risk prediction module: predicts the operating status of devices connected to the campus network. By establishing a neural network model, it predicts the network operating status of devices connected to the campus network and transmits the prediction results to the data acquisition module.

[0033] Data collection module: used to collect hardware risk information and software risk information of the campus network, and transmit the collected data to the data processing module;

[0034] Data processing module: processes the uploaded campus network hardware risk information and campus network software risk information, establishes a data processing model, generates a risk assessment coefficient, and transmits the generated data to the comparison module;

[0035] Comparison module: Compare the generated risk assessment coefficient with the pre-set reference threshold of the risk assessment coefficient, and determine whether there is a problem with the network security of the campus network based on the comparison results, and pass the comparison results to the alarm module. The alarm module chooses to issue or not issue an alarm based on the uploaded results.

[0036] Technical effects and advantages of the present invention:

[0037] 1. In the present invention, the operating status of the equipment connected to the campus network is predicted by a prediction model. If the network operating status of the equipment is predicted to be risky and the actual campus network is not operating normally, or if the network operating status of the equipment is predicted to be risk-free and the actual campus network is not operating normally, an alarm is directly issued to remind the staff that there is a problem with the network security of the campus network and maintenance is required. The prediction model can be used to discover potential network security problems in advance, achieve immediate response to network security risks, and help to take necessary maintenance and protection measures in time to prevent the problem from further expanding.

[0038] 2. The present invention further analyzes the phenomenon that the network operation status of the predicted equipment is risky but the actual campus network operates normally. The hardware risk information and the software risk information of the campus network are collected and processed to generate a risk assessment coefficient, and the risk assessment coefficient is compared with a pre-set reference threshold of the risk assessment coefficient. When the risk assessment coefficient is greater than the pre-designed reference threshold of the risk assessment coefficient, it indicates that there is indeed a risk in the network security of the campus network. Although the campus network can operate normally, the network security of the campus network has been determined to be risky. At this time, an alarm is needed to remind the staff to carry out maintenance, so as to reduce false alarms caused by accidental errors in the prediction model or expected risks, and avoid unnecessary interference and workload to the staff. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to facilitate understanding by those skilled in the art, the present invention is further described below in conjunction with the accompanying drawings;

[0040] Figure 1 is a flow chart of the method of the present invention;

[0041] Figure 2 It is a system module diagram of the present invention. DETAILED DESCRIPTION

[0042] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0043] Example 1

[0044] See also Figure 1 As shown, the network security detection method based on cloud computing described in this embodiment includes the following steps:

[0045] S1: First, the operating status of the devices connected to the campus network is predicted by establishing a neural network model to predict the network operating status of the devices connected to the campus network;

[0046] S2: When the network operation status of the device is predicted to be risky but the actual campus network is running normally, it means that the network security of the campus network may be at risk. It is necessary to further determine whether the network security of the campus network is indeed at risk and issue an alarm;

[0047] S3: Collect the hardware risk information and software risk information of the campus network, perform normalization processing, and establish a data processing model to generate a risk assessment coefficient;

[0048] S4: Compare the generated risk assessment coefficient with the pre-set reference threshold of the risk assessment coefficient, and judge whether there is a problem with the network security of the campus network based on the comparison result, and issue an alarm based on the judgment result.

[0049] The specific operations include:

[0050] In step S1, a network operation status of a device when using a campus network is predicted by using a neural network;

[0051] Collect sample data, which is historical data including device usage data when using the campus network and device operation status data when using the campus network;

[0052] The device usage data when using the campus network includes the total number of devices connected to the campus network, the overall average network speed when the devices are connected to the campus network, and the operation time of the campus network; the device operation status data when using the campus network includes risk-free operation and risky operation, with the label of risk-free operation being 1 and the label of risky operation being 0.

[0053] The total number of devices used is the total number of devices using the campus network within a cycle. It should be noted that a cycle can be determined according to an actual value, for example, a cycle is 24 hours.

[0054] The overall average network speed of a device when in use is used to measure how fast the device runs over a period of time. The overall average network speed of the device can be calculated using the following formula: Average network speed = (average upload speed + average download speed) / 2. Average upload speed refers to the average speed at which data is sent from the user device to the Internet. Average download speed refers to the average speed at which data is received from the Internet to the user device.

[0055] The device operation time is the total time a device operates in a cycle.

[0056] The equipment operation status data under the campus network is a label indicating whether the equipment is in positive risk operation when in use.

[0057] The sample data is divided into training sample data and test sample data, which are sample pairs consisting of sample input and expected output;

[0058] It should be noted that the above-mentioned collected data is one year's data, that is, 365 sets of data, but is not limited to 365 sets of data.

[0059] In order to avoid excessive errors in the neural network and prevent local neurons from reaching an oversaturated state, the sample data is normalized so that the sample data are all between 0 and 1. The network output vector is denormalized to obtain the original output value; the normalization formula for sample data is:

[0060]

[0061] In the formula, ψ is the normalized sample data, α is the ratio of the original sample data to the minimum value of the original sample data, It is the ratio of the maximum value of the original sample data to the minimum value of the original sample data;

[0062] Establish a fuzzy Bayesian neural network model and bring the sample data into the fuzzy Bayesian neural network model;

[0063] The neural network model used to determine the equipment operation status under the campus network consists of an input layer, a hidden layer, and an output layer; the input layer consists of a set of data including the total number of equipment in use, the overall average network speed when the equipment is in use, and the equipment operation time, with a total of 15 neuron nodes; the hidden layer is determined by an empirical formula; the output layer is the equipment operation status data Pl, P2, ... P365 under the campus network, and the hidden layer is determined by an empirical formula, which is

[0064]

[0065] G is the number of neurons in the hidden layer, n is the number of input neurons in the input layer, m is the number of output neurons in the output layer, and a is a constant ranging from 1 to 10;

[0066] Establish the fuzzy Bayesian neural network prediction model, determine the model's excitation function, training function, learning function and neural network performance index; the excitation function selects the sigmoid function The training function selects the trainlm function, the learning function selects the Bayesian function, and the neural network performance index is: RMSE =

[0067]

[0068] Pre-training process: through the pre-training function trainlm, set the training target, training steps, training error accuracy, and select the optimal number of hidden layer neurons based on the results;

[0069] Create a forward neural network: net = newff(PR, [S1, S2... SN1], {TF1, TF2... TFN1},

[0070] BTF, BLF, PF), where the vector elements range from 1 to N1; net is to create a new neural network; PR is a matrix composed of the maximum and minimum values ​​of the network input elements; [S1, S2...SN1] represents the number of neurons in the hidden layer and output layer of the network; {TF1, TF2...TFN1} represents the hidden layer and output layer activation function, which is the sigmod function; BTF is the training function of the network, which is the trainlm function; BLF is the weight learning function of the network, which is the Bayesian function; PF is the performance function, which defaults to the "mse" function;

[0071] Create a neural network weight set: The weight set that affects the accuracy and generalization ability of the neural network operation is represented by ω, that is, ω={ω1,ω2,ω3,...,ωn}, where ωi (i=1,2,3...n) represents the weight component;

[0072] Create a weighted judgment set: Use the improved expert scoring method to fuzzify the neural network weights. Experts first score without communication, sort the scoring results from large to small, and the first and last experts negotiate and score again, re-rank, and so on, until the scoring is completed. The judgment set is represented by V, that is, V = {V1, V2, V3, ..., Vn}, where Vi (i = 1, 2, 3 ... n) represents the importance of the weight component;

[0073] Perform expert scoring: Use expert scoring method to fuzzify the weights of neural network;

[0074] Defuzzification: The weighted average method is used for defuzzification to obtain the prior probability of the neural network weights. The formula is:

[0075] In the formula, P(ωi) represents the prior probability of the neural network weight, bj represents the number of judges, and vi represents the possible judgment results made by the judges;

[0076] Determine the likelihood function: Assuming that the target values ​​t1, t2, t3, ..., tn are generated under Gaussian white noise, the likelihood function is:

[0077] Among them, ZD(γ) is the normalization factor and γ is the hyperparameter;

[0078] The posterior probability formula for determining weights: rongyi

[0079] Where, i = (1, 2, 3, ..., n), j = (1, 2, 3, ..., n), is the error function,

[0080] Randomly select a training sample set D to learn and train the fuzzy Bayesian neural network prediction model, use fuzzy knowledge and Bayesian function to determine the weights of the input layer, hidden layer, and output layer, and use the training sample data to judge whether the actual output and expected output of the output layer meet the performance index requirements of the neural network; if the requirements are not met, then appropriately change the number of neurons in the hidden layer, re-determine the weights of the input layer, hidden layer, and output layer by fuzzy knowledge and Bayesian function, and again use the training sample data to judge whether the actual output and expected output of the output layer meet the performance index requirements of the neural network; if the requirements are met, the training ends, otherwise continue the training until the performance index requirements of the neural network are met;

[0081] The campus network is used to extract 365 sets of equipment usage data and equipment operation status data under the campus network, including the total number of equipment used and the overall average network speed when the equipment is used. 300 sets of them are used as training sample data, and 65 sets of them are used as test sample data. In order to avoid excessive errors in the neural network and prevent local neurons from reaching an oversaturated state, the sample data is normalized so that the sample data are between 0 and 1. The network output vector is denormalized to obtain the original output value; the input layer consists of 1 set of data, including the total number of equipment used, the overall average network speed when the equipment is used, and the equipment operation time. There are 15 neuron nodes in total, and the hidden layer is determined by an empirical formula; the output layer is the equipment operation status data under the campus network; after the accuracy analysis after the preset training, the number of hidden layer neurons is determined to be 14, and the optimal structure of the neural network is finally determined to be 15×14×2. Fuzzy knowledge and Bayesian function are used to determine the weights ωi (i=1,2,3,...,n) to predict whether there is any risk in the network operation status of equipment using the campus network.

[0082] When it is predicted that the network operation status of the device is at risk but the actual campus network is running normally, it means that the network security of the campus network may be at risk. It is necessary to further determine whether the network security of the campus network is indeed at risk and issue an alarm;

[0083] It should be noted that the network operation status of the device in use can be predicted by the neural network, and can be roughly divided into the following four categories according to the actual campus network operation status: the first category, it is predicted that the network operation status of the device in use is risky and the actual campus network is not operating normally, which means that the network security of the campus network is indeed at risk, and an alarm can be directly issued to remind the staff to maintain the network security of the campus network; the second category, it is predicted that the network operation status of the device in use is risky and the actual campus network is operating normally, and it is not certain whether the network security of the campus network is really at risk or it is just an accidental error of the detection technology, and further analysis is needed to determine whether there is a risk in the network security of the campus network; the third category, it is predicted that the network operation status of the device in use is risk-free and the actual campus network is operating normally, which means that the network security of the campus network is secure at this time and there is no risk; the fourth category, it is predicted that the network operation status of the device in use is risk-free and the actual campus network is operating abnormally, which means that the network security of the campus network has already appeared at risk, and an alarm is also needed to remind the staff to maintain the network security of the campus network;

[0084] Therefore, when the second type of situation occurs, that is, when the network operation status of the device is predicted to be risky and the actual campus network is operating normally, further analysis is needed to determine whether there is really a risk to the network security of the campus network.

[0085] Example 2

[0086] Collect the hardware risk information and software risk information of the campus network, normalize them, and establish a data processing model to generate risk assessment coefficients;

[0087] Software risk information of campus network includes network bandwidth utilization and third-party attack intensity;

[0088] Network bandwidth utilization: refers to the degree of network bandwidth utilization when the campus network is running; the higher the network bandwidth utilization, the greater the risk of network security in the campus network. The reasons are:

[0089] Attackers take advantage of network congestion to launch attacks: When network bandwidth utilization is high, the network is vulnerable to denial of service (DDoS) attacks. Attackers take advantage of network congestion to send a large number of malicious requests to the target server, consuming network resources and causing normal users to be unable to access network services.

[0090] Abnormal network behavior may be masked: When network bandwidth utilization is high, abnormal network behavior (such as intrusion, malicious traffic, etc.) may be masked in normal traffic, making it difficult to be discovered and blocked in time, increasing network security threats.

[0091] Increased latency and packet loss: High network bandwidth utilization may lead to increased network latency and packet loss, affecting the timely transmission and processing of sensitive data, increasing data leakage and information security risks.

[0092] Degraded network performance: Excessive use of network bandwidth may lead to degraded network performance, affecting user experience and work efficiency, and even affecting normal activities such as teaching and scientific research.

[0093] Therefore, high network bandwidth utilization often indicates that the campus network security is indeed at risk, and an alarm is needed to remind staff to take corresponding security measures;

[0094] The network bandwidth utilization is calculated as follows: HE = AG / DK, where AG is the amount of data transmitted through the network within T time, DK represents the maximum transmission bandwidth of the network, and HE is the network bandwidth utilization;

[0095] Third-party attack intensity: refers to the intensity of the campus network's ability to withstand third-party attacks. The higher the intensity of the third-party attack, the more risks there are in the campus network security. The reasons are:

[0096] Increased risk of data leakage and theft: High-intensity third-party attacks may lead to the theft or leakage of sensitive information in the campus network, including personal information of students and faculty, school confidential documents, etc., thus posing serious security risks.

[0097] Increased malicious network behaviors: High-intensity third-party attacks may lead to more malicious behaviors in campus networks, such as malware infection, phishing, and online fraud, further increasing security threats to campus networks.

[0098] Increased risk of security vulnerabilities being exploited: Attackers may exploit security vulnerabilities in the campus network to launch attacks. High-intensity attacks mean that more security vulnerabilities may be discovered and exploited, increasing the security risk of the campus network.

[0099] Therefore, high-intensity attacks often indicate that the campus network security is indeed at risk, and an alarm needs to be sounded to remind staff to take appropriate security measures;

[0100] The calculation expression of the attack strength of the third party is: CZ=h / t, wherein CZ is the attack strength of the third party, h is the number of times the third party attacks the campus network, and t is the duration of the third party attack on the campus network.

[0101] The third-party attack intensity CZ and the network bandwidth utilization HE are processed to generate the hardware risk assessment coefficient, and the software risk assessment coefficient is marked as SP, which is expressed as follows:

[0102] SP=a1*CZ+a2*HE

[0103] Where SP is the software risk assessment coefficient, a1 and a2 are the proportional coefficients of the third-party attack intensity and network bandwidth utilization, and a1 and a2 are both greater than 0.

[0104] Campus network hardware risk information includes the quality of campus network equipment wires and cables, and the cooling speed of campus network equipment;

[0105] Campus network equipment wire and cable quality: refers to the quality of the wires and cables used in campus network equipment; if there is a problem with the quality of campus network equipment wires and cables, it will also pose a risk to the network security of the campus network. The reasons are:

[0106] Reduced data transmission reliability: Low-quality wires and cables may have problems such as poor contact, line breakage, and electromagnetic interference, resulting in reduced instability and reliability of data transmission, thereby increasing the risk of data loss or damage.

[0107] Increased risk of network service interruption: If there are quality problems with the wires and cables of campus network equipment, it may cause the connection between network devices to be interrupted or unstable, thereby affecting the normal operation of network services, or even causing a complete interruption of network services, posing a threat to the stability and availability of the campus network.

[0108] Increased possibility of security vulnerability exploitation: Malicious attackers may take advantage of the poor quality of wires and cables to launch attacks, such as tampering with or interfering with wires and cables, conducting man-in-the-middle attacks or data theft, thereby undermining the data security and privacy protection of the campus network.

[0109] Hidden dangers may be ignored: The quality of wires and cables may be ignored or underestimated, and not considered as one of the main factors of network security risks. However, poor wire and cable quality may become a potential entry point for network attacks, so it should be given enough attention and concern.

[0110] Therefore, when the quality of the wires and cables of campus network equipment is poor, it is very likely to affect the network security of the campus network, and an alarm is needed to remind the staff to take corresponding safety measures;

[0111] The calculation expression of the quality of campus network equipment wires and cables is: ER = (sd*sx)-(wd*ws)+(rt*jk); where ER is the quality of campus network equipment wires and cables, sd is the purity of the cable, sx is the conductivity of the cable, wd is the length of the cable, ws is the resistivity of the cable, rt is the wear degree of the cable, and jk is the humidity inside the cable;

[0112] The cooling speed of campus network equipment refers to the efficiency and speed of the network equipment cooling system in regulating and cooling the equipment temperature. If there is a problem with the cooling speed of campus network equipment, it will also pose a risk to the network security of the campus network. The reasons are:

[0113] Device overheating leading to performance degradation: If the campus network equipment is not cooled quickly enough to keep the equipment within the appropriate operating temperature range, the equipment may overheat. Overheated equipment may cause performance degradation, which may affect the stability and reliability of network services and increase the risk of network outages.

[0114] Hardware damage and failure: Overheated devices may cause damage or failure of hardware components such as the CPU, memory, hard disk, etc. This can lead to degraded performance of the device or even complete failure of the device, increasing the risk of data loss and service interruption.

[0115] Increased likelihood of security vulnerability exploitation: Overheating of the device may cause it to operate abnormally or crash, making it more vulnerable to attack and exploitation by malicious attackers. Attackers may exploit vulnerabilities caused by overheating of the device to conduct malicious intrusions, data theft, and other attacks, increasing the risk of network security threats.

[0116] Increased fire risk: Overheated equipment may cause fire, posing a serious threat to the physical security and personnel safety of the campus network, possibly resulting in property damage and casualties, and seriously affecting the normal operation and security of the campus network.

[0117] Therefore, it is very important to ensure the cooling speed of campus network equipment. The calculation expression for the cooling speed of campus network equipment is: TR=ah / at, where TR is the cooling speed of campus network equipment, ah is the temperature difference of campus network equipment from the current temperature to the standard temperature, and at is the time taken for campus network equipment to cool from the current temperature to the standard temperature. The faster the cooling time, the less likely there will be network security risks in the campus network.

[0118] The quality ER of the wires and cables of the campus network equipment and the cooling speed TR of the campus network equipment are processed to generate a hardware risk assessment coefficient, and the hardware risk assessment coefficient is marked as QL, and its expression is as follows:

[0119] QL=b1*ER+b2*TR

[0120] In the formula, QL is the hardware risk assessment coefficient, b1 and b2 are the preset proportional coefficients of the quality of wires and cables of campus network equipment and the cooling speed of campus network equipment, and b1 and b2 are both greater than 0.

[0121] The software risk assessment coefficient SP and the hardware risk assessment coefficient QL are processed to generate the risk assessment coefficient K, which is expressed as follows:

[0122]

[0123] Where K is the risk assessment coefficient, α and β are the preset proportional coefficients of the software risk assessment coefficient and the hardware risk assessment coefficient, and both α and β are greater than 0.

[0124] Compare the risk assessment coefficient K with the pre-designed risk assessment coefficient reference threshold KU,

[0125] If the risk assessment coefficient K is less than the pre-designed risk assessment coefficient reference threshold KU, it means that although the predicted network operation status of the equipment is risky, the actual campus network is operating normally. This phenomenon indicates that there is no risk to the network security of the campus network. The predicted risk of the network operation status of the equipment may be due to accidental errors in the prediction model or the risk is within expectations. There is no need to alarm to remind staff to perform repairs; if the risk assessment coefficient K is greater than the pre-designed risk assessment coefficient reference threshold KU, it means that there is indeed a risk to the network security of the campus network. Although the campus network can operate normally, the network security of the campus network has been determined to be at risk. At this time, an alarm is needed to remind staff to perform repairs to reduce false alarms caused by accidental errors in the prediction model or expected risks, and avoid unnecessary interference and workload to staff.

[0126] like Figure 2As shown, a network security detection system based on cloud computing includes a risk prediction module, a data acquisition module, a data processing module, a comparison module, and an alarm module, and the modules are connected by signals;

[0127] Risk prediction module: predicts the operating status of devices connected to the campus network. By establishing a neural network model, it predicts the network operating status of devices connected to the campus network and transmits the prediction results to the data acquisition module.

[0128] Data collection module: used to collect hardware risk information and software risk information of the campus network, and transmit the collected data to the data processing module;

[0129] Data processing module: processes the uploaded campus network hardware risk information and campus network software risk information, establishes a data processing model, generates a risk assessment coefficient, and transmits the generated data to the comparison module;

[0130] Comparison module: Compare the generated risk assessment coefficient with the pre-set reference threshold of the risk assessment coefficient, and determine whether there is a problem with the network security of the campus network based on the comparison results, and pass the comparison results to the alarm module. The alarm module chooses to issue or not issue an alarm based on the uploaded results.

[0131] A network security detection system based on cloud computing provided in an embodiment of the present invention is implemented by the above-mentioned network security detection method based on cloud computing. The specific method and process of the network security detection method based on cloud computing are detailed in the embodiment of the above-mentioned network security detection method based on cloud computing, which will not be repeated here.

[0132] The above embodiments can be implemented in whole or in part by software, hardware, firmware or any other combination. When implemented using software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state hard disk.

[0133] It should be understood that the term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. A and B can be singular or plural. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship, but it may also indicate an "and / or" relationship. Please refer to the context for specific understanding.

[0134] In this application, "at least one" means one or more, and "plurality" means two or more. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can be represented by: a, b, c, ab, ac, bc, or abc, where a, b, c can be single or multiple.

[0135] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0136] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0137] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0138] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0139] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0140] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0141] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard disks, read-only memories (ROM), random access memories (RAM), magnetic disks or optical disks.

[0142] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A network security detection method based on cloud computing, characterized in that: The following steps are involved: S1: First, the operating status of the devices connected to the campus network is predicted by establishing a neural network model to predict the network operating status of the devices connected to the campus network; S2: When the network operation status of the device is predicted to be risky but the actual campus network is running normally, it means that the network security of the campus network may be at risk. It is necessary to further determine whether the network security of the campus network is indeed at risk and issue an alarm; S3: Collect the hardware risk information and software risk information of the campus network, perform normalization processing, and establish a data processing model to generate a risk assessment coefficient; S4: Compare the generated risk assessment coefficient with the pre-set reference threshold of the risk assessment coefficient, and judge whether there is a problem with the network security of the campus network based on the comparison result, and issue an alarm based on the judgment result.

2. A network security detection method based on cloud computing according to claim 1, characterized in that: The software risk information of the campus network includes the attack intensity CZ of the third party and the network bandwidth utilization HE; The network bandwidth utilization is calculated as follows: HE=AG / DK, where AG is the amount of data transmitted through the network within T time, DK represents the maximum transmission bandwidth of the network, and HE is the network bandwidth utilization; The calculation expression of the attack strength of the third party is: CZ=h / t, wherein CZ is the attack strength of the third party, h is the number of times the third party attacks the campus network, and t is the duration of the third party attack on the campus network.

3. A network security detection method based on cloud computing according to claim 2, characterized in that: The hardware risk information of the campus network includes the quality ER of the wires and cables of the campus network equipment and the cooling speed TR of the campus network equipment; The calculation expression of the quality of the wires and cables of the campus network equipment is: ER = (sd*sx) - (wd*ws) + (rt*jk); wherein ER is the quality of the wires and cables of the campus network equipment, sd is the purity of the cable, sx is the conductivity of the cable, wd is the length of the cable, ws is the resistivity of the cable, rt is the wear degree of the cable, and jk is the humidity inside the cable; The calculation expression for the cooling speed of the campus network equipment is: TR=ah / at, wherein TR is the cooling speed of the campus network equipment, ah is the temperature difference of the campus network equipment from the current temperature to the standard temperature, and at is the time taken for the campus network equipment to cool from the current temperature to the standard temperature.

4. A network security detection method based on cloud computing according to claim 3, characterized in that: The expression of the software risk assessment coefficient is: The third-party attack intensity CZ and the network bandwidth utilization HE are processed to generate the hardware risk assessment coefficient, and the software risk assessment coefficient is marked as SP, which is expressed as follows: SP=a1*CZ+a2*HE Where SP is the software risk assessment coefficient, a1 and a2 are the proportional coefficients of the third-party attack intensity and network bandwidth utilization, and a1 and a2 are both greater than 0.

5. A network security detection method based on cloud computing according to claim 4, characterized in that: The expression of the hardware risk assessment coefficient is: The quality ER of the wires and cables of the campus network equipment and the cooling speed TR of the campus network equipment are processed to generate a hardware risk assessment coefficient, and the hardware risk assessment coefficient is marked as QL, and its expression is as follows: QL=b1*ER+b2*TR In the formula, QL is the hardware risk assessment coefficient, b1 and b2 are the preset proportional coefficients of the quality of wires and cables of campus network equipment and the cooling speed of campus network equipment, and b1 and b2 are both greater than 0.

6. A network security detection method based on cloud computing according to claim 5, characterized in that: The expression of the risk assessment coefficient is: The software risk assessment coefficient SP and the hardware risk assessment coefficient QL are processed to generate the risk assessment coefficient K, which is expressed as follows: Where K is the risk assessment coefficient, α and β are the software risk assessment coefficient and hardware risk assessment coefficient, respectively.

7. A network security detection system based on cloud computing, used to implement a network security detection method based on cloud computing according to any one of claims 1 to 6, characterized in that: It includes risk prediction module, data acquisition module, data processing module, comparison module, alarm module, and signal connection between each module; Risk prediction module: predicts the operating status of devices connected to the campus network. By establishing a neural network model, it predicts the network operating status of devices connected to the campus network and transmits the prediction results to the data acquisition module. Data collection module: used to collect hardware risk information and software risk information of the campus network, and transmit the collected data to the data processing module; Data processing module: processes the uploaded campus network hardware risk information and campus network software risk information, establishes a data processing model, generates a risk assessment coefficient, and transmits the generated data to the comparison module; Comparison module: Compare the generated risk assessment coefficient with the pre-set reference threshold of the risk assessment coefficient, and determine whether there is a problem with the network security of the campus network based on the comparison results, and pass the comparison results to the alarm module. The alarm module chooses to issue or not issue an alarm based on the uploaded results.

Images