Network security risk detection system and method based on big data technology

Abstract

The invention relates to the technical field of network security, and more specifically discloses a network security risk detection system and method based on a big data technology, the feature vector of intrusion data is extracted and analyzed by using a classifier, so that the network security risk level is evaluated, a basis is provided for real-time early warning and targeted defense, and the network security risk detection efficiency is improved. Defects of an existing security monitoring system are made up, network security threats are dealt with, and information leakage and economic loss are prevented.

Description

Technical Field

[0001] This application relates to the field of network security technology, and more specifically, to a network security risk detection system and method based on big data technology. Background Art

[0002] Currently, various known and unknown network attacks have seriously threatened the security of network information systems. In the severe network security situation, not being aware of the risks is the greatest risk. It is necessary to evaluate the network threat situation one has suffered and the actual security status of one's own network. Analyzing the current security threat situation of the system through network security assessment, so as to provide a basis for further formulating targeted defenses, is an important issue in the current research of the network security field.

[0003] However, existing network security monitoring systems, such as virus killing programs and Trojan horse killing programs, generally require manual active detection and prevention to respond to deep-layer attack behaviors such as external data on the application layer, and cannot achieve real-time early warning of attack behaviors. If not processed in time, the network information has been attacked, resulting in information leakage, and in severe cases, economic losses will also be caused.

[0004] Therefore, a network security risk detection system and method based on big data technology are desired. Summary of the Invention

[0005] To solve the above technical problems, this application is proposed. Embodiments of this application provide a network security risk detection system and method based on big data technology, which utilize intrusion data feature extraction and classifier analysis to achieve the assessment and early warning of network security risk levels.

[0006] Correspondingly, according to one aspect of this application, a network security risk detection system based on big data technology is provided, which includes:

[0007] An intrusion data collection module, configured to extract the detected intrusion data, where the intrusion data includes attack types, attack sources, affected systems or resources;

[0008] An intrusion data feature extraction module, configured to extract network security risk analysis feature vectors from the intrusion data;

[0009] An intrusion data classification module, configured to obtain a classification result by passing the network security risk analysis feature vectors through a classifier, where the classification result is used to represent the risk level of the extracted intrusion data, and the risk level includes: low, medium, and high.

[0010] According to another aspect of the present application, there is also provided a network security risk detection method based on big data technology, which includes:

[0011] Extract the detected intrusion data, where the intrusion data includes attack type, attack source, and affected system or resource;

[0012] Extract the network security risk analysis feature vector from the intrusion data;

[0013] Pass the network security risk analysis feature vector through a classifier to obtain a classification result, and the classification result is used to represent the risk level of the extracted intrusion data, where the risk level includes: low, medium, and high.

[0014] Compared with the prior art, a network security risk detection system and method based on big data technology provided by the present application extracts the feature vector of intrusion data and uses a classifier for analysis, thereby evaluating the network security risk level, providing a basis for real-time early warning and targeted defense, making up for the deficiencies of existing security monitoring systems, coping with network security threats, and preventing information leakage and economic losses. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] By describing the embodiments of the present application in more detail in conjunction with the drawings, the above and other objects, features, and advantages of the present application will become more obvious. The drawings are used to provide a further understanding of the embodiments of the present application and constitute a part of the specification. Together with the embodiments of the present application, they are used to explain the present application and do not constitute a limitation to the present application. In the drawings, the same reference numerals generally represent the same components or steps.

[0016] Figure 1 It is a block diagram schematic diagram of a network security risk detection system based on big data technology according to an embodiment of the present application.

[0017] Figure 2 It is a block diagram schematic diagram of an intrusion data feature extraction module in a network security risk detection system based on big data technology according to an embodiment of the present application.

[0018] Figure 3 It is a block diagram schematic diagram of an intrusion data context encoding unit in a network security risk detection system based on big data technology according to an embodiment of the present application.

[0019] Figure 4 It is a flowchart of a network security risk detection method based on big data technology according to an embodiment of the present application. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0020] Various exemplary embodiments, features, and aspects of the present application will be described in detail below with reference to the accompanying drawings. Identical reference numerals in the drawings denote elements having the same or similar functions. Although various aspects of the embodiments are shown in the drawings, the drawings are not necessarily drawn to scale unless otherwise specified.

[0021] As used herein, the term "exemplary" means "serving as an example, embodiment, or illustration." Any embodiment described herein as "exemplary" is not necessarily to be construed as superior or better than other embodiments.

[0022] In addition, for a better description of the present application, numerous specific details are given in the following detailed description. Those skilled in the art should understand that the present application can be implemented without some specific details. In some instances, methods, means, elements, and circuits well-known to those skilled in the art are not described in detail so as to highlight the gist of the present application.

[0023] Furthermore, the terms "first" and "second" are used for descriptive purposes only and cannot be construed as indicating or implying relative importance or implicitly specifying the quantity of the indicated technical features. Thus, features defined with "first" and "second" may explicitly or implicitly include one or more of such features. In the description of the present application, "a plurality of" means two or more unless otherwise specifically defined.

[0024] Figure 1 The block diagram of a network security risk detection system based on big data technology according to an embodiment of the present application is illustrated. As Figure 1 shown, a network security risk detection system 100 based on big data technology according to an embodiment of the present application includes: an intrusion data collection module 110 for extracting detected intrusion data, where the intrusion data includes attack type, attack source, and affected system or resource; an intrusion data feature extraction module 120 for extracting a network security risk analysis feature vector from the intrusion data; and an intrusion data classification module 130 for obtaining a classification result by passing the network security risk analysis feature vector through a classifier, where the classification result is used to represent the risk level of the extracted intrusion data, and the risk level includes: low, medium, and high.

[0025] In the embodiment of the present application, the intrusion data collection module 110 is used to extract the detected intrusion data, where the intrusion data includes the attack type, the attack source, and the affected system or resource. It should be understood that by extracting the attack type, the system can analyze and identify different types of attack behaviors. Different types of attacks may exhibit different characteristics and patterns. Therefore, understanding the attack type helps the system identify and respond to different threats. Understanding the source of the attack can help the system track the attacker and take appropriate countermeasures. By analyzing information such as the IP address and geographical location of the attack source, the security team can better understand the attacker's intentions and strategies and take corresponding defensive measures. Extracting information about the affected system or resource can help the system quickly locate the scope affected by the attack. Understanding the specific situation of the affected system or resource can help the security team respond quickly, isolate the affected part, prevent the spread of the attack, and repair the damaged system or resource in a timely manner. Therefore, extracting information such as the attack type, the attack source, and the affected system or resource is to help the system better analyze, identify, and respond to network security threats, enhance the security of the system, and protect critical systems and data from damage.

[0026] In the embodiment of the present application, the intrusion data feature extraction module 120 is used to extract the network security risk analysis feature vector from the intrusion data. It should be understood that the intrusion data may contain a large amount of details and variables, and directly analyzing this data may be very complex and difficult. By extracting the feature vector, the data dimension can be reduced to a more controllable range, simplifying the complexity of the problem. The process of extracting the feature vector can help screen out the most representative and key information, helping the system better understand the essence and characteristics of the intrusion behavior, and thus analyze and identify more effectively. Based on the extracted feature vector, a network security risk analysis model can be established for intrusion detection, classification, and prediction. The feature vector as input can help the system better perform machine learning and data mining, thereby improving the accuracy and efficiency of network security risk analysis. By extracting the feature vector, the automation and intelligence of network security risk analysis can be achieved. The feature vector can be used as the basis for the system's judgment and decision-making, helping the system detect and respond to potential network security threats in a timely manner. Therefore, extracting the network security risk analysis feature vector from the intrusion data helps simplify the data analysis process, extract key information, establish an effective analysis model, and achieve the automation and intelligence of network security risk analysis, thereby better protecting network security and data security.

[0027] Specifically, in an embodiment of the present application Figure 2 illustrates a block diagram of the intrusion data feature extraction module in the network security risk detection system based on big data technology according to an embodiment of the present application. As Figure 2As shown, in the above-mentioned network security risk detection system 100 based on big data technology, the intrusion data feature extraction module 120 includes: an intrusion data context encoding unit 121, configured to convert the intrusion data into an intrusion data embedding vector and then obtain a multi-dimensional intrusion data feature vector through a context encoder based on a transformer; an intrusion data one-dimensional arrangement unit 122, configured to perform one-dimensional arrangement on the multi-dimensional intrusion data feature vectors and then obtain an intrusion data text understanding feature vector through convolutional encoding; an intrusion data concatenation unit 123, configured to concatenate the multi-dimensional intrusion data feature vectors to obtain an intrusion data global semantic feature vector; an intrusion data two-dimensional arrangement unit 124, configured to perform two-dimensional arrangement on the multi-dimensional intrusion data feature vectors and then obtain an intrusion data local association feature vector through feature extraction; an intrusion data fusion unit 125, configured to fuse the intrusion data text understanding feature vector, the intrusion data global semantic feature vector, and the intrusion data local association feature vector to obtain the network security risk analysis feature vector.

[0028] Correspondingly, in a specific example of the present application, the intrusion data context encoding unit 121 is configured to convert the intrusion data into an intrusion data embedding vector and then obtain a multi-dimensional intrusion data feature vector through a context encoder based on a transformer. It should be understood that by converting the intrusion data into an embedding vector, the original text data can be converted into a representation in a continuous vector space, thereby learning the semantic information of the data. A context encoder based on a transformer, such as the Transformer model, can capture the complex relationships and semantic information between data, and convert the input data into a more meaningful and representative embedding vector. Through the context encoder based on a transformer, multi-dimensional feature vectors can be obtained, and these feature vectors can capture different aspects and attributes of the intrusion data, thereby providing a more comprehensive and rich feature representation. This helps the system better understand the intrusion data and improve the accuracy of intrusion detection and analysis. The Transformer model can effectively capture the context information of the input data, helping the system better understand the background and context of the intrusion data. This helps improve the processing and analysis capabilities of the intrusion data, enabling the system to more comprehensively evaluate network security risks. The context encoder based on a transformer can help the system learn more representative feature vectors, and these feature vectors can better describe the features and patterns of the intrusion data, helping the system perform more accurate intrusion detection and analysis. Therefore, converting the intrusion data into an intrusion data embedding vector and obtaining a multi-dimensional intrusion data feature vector through a context encoder based on a transformer can help the system better understand and analyze the intrusion data, improve the accuracy and efficiency of intrusion detection, and strengthen the network security protection ability.

[0029] Furthermore, Figure 3The figure shows a block diagram of an intrusion data context encoding unit in a network security risk detection system based on big data technology according to an embodiment of the present application. As Figure 3 shown, in the intrusion data feature extraction module 120 of the above-mentioned network security risk detection system 100 based on big data technology, the intrusion data context encoding unit 121 includes: an intrusion data embedding conversion unit 1211, configured to convert the intrusion data through an embedding layer to convert each dimension of the intrusion data into an embedding vector to obtain a sequence of embedding vectors, where the embedding layer uses a learnable embedding matrix to perform embedding encoding on each dimension of the intrusion data; an intrusion data encoding unit 1212, configured to pass the sequence of embedding vectors through the context encoder based on a transformer to obtain the multi-dimensional intrusion data feature vectors.

[0030] Specifically, the intrusion data embedding conversion unit 1211 is configured to convert the intrusion data through an embedding layer to convert each dimension of the intrusion data into an embedding vector to obtain a sequence of embedding vectors, where the embedding layer uses a learnable embedding matrix to perform embedding encoding on each dimension of the intrusion data. It should be understood that converting the intrusion data into embedding vectors through the embedding layer can help the system learn more representative and semantic feature vectors. The embedding vectors can better describe the features and attributes of the data, which helps the system to more accurately understand and analyze the intrusion data. Converting each dimension of the intrusion data into a sequence of embedding vectors can help the system convert the original data into a continuous vector representation, so as to better process and analyze it. This helps the system to more effectively utilize the deep learning model for intrusion detection and risk analysis. By using a learnable embedding matrix to perform embedding encoding on each dimension of the intrusion data, the system can automatically learn the optimal feature representation without manually designing a feature extractor. This helps the system to better adapt to different types of intrusion data and features. The sequence of embedding vectors can be used as the input of the deep learning model to help the system train and learn. The deep learning model can use the sequence of embedding vectors for feature learning and pattern recognition, thereby improving the accuracy and efficiency of network security risk analysis. Therefore, converting the intrusion data into a sequence of embedding vectors through the embedding layer, where a learnable embedding matrix is used to perform embedding encoding on each dimension of the intrusion data, helps the system learn more representative feature vectors, improves the processing ability and analysis effect of the intrusion data, and thus enhances the ability of network security protection and risk assessment.

[0031] Further, the intrusion data encoding unit 1212 is configured to obtain the multi-dimensional intrusion data feature vectors by passing the sequence of the embedding vectors through the Transformer-based context encoder. It should be understood that the Transformer-based context encoder can capture the context information in the input sequence, helping the system better understand the relationships and semantic connections between intrusion data. In this way, richer and more accurate feature vector representations can be obtained, improving the processing and analysis capabilities of intrusion data. The Transformer model can effectively model the input sequence, learning the interactions and dependencies between different elements in the sequence. This helps the system more comprehensively analyze the features of intrusion data, extract more representative feature vectors, and thus improve the accuracy of intrusion detection and analysis. Through the Transformer-based context encoder, multi-dimensional feature vectors can be obtained, which can capture different aspects and attributes of intrusion data, providing a more comprehensive and rich feature representation. This helps the system better understand the features and patterns of intrusion data, improving the effect of intrusion detection. The Transformer-based context encoder can help the system learn more representative feature vectors, which can better describe the features and attributes of intrusion data. This helps the system perform more accurate and comprehensive intrusion data analysis and risk assessment. Therefore, converting the sequence of embedding vectors into multi-dimensional intrusion data feature vectors through the Transformer-based context encoder can help the system better understand and analyze intrusion data, improve the accuracy and efficiency of intrusion detection and analysis, and enhance the network security protection ability.

[0032] Accordingly, in a specific example of the present application, the intrusion data one-dimensional arrangement unit 122 is configured to perform one-dimensional arrangement on the multiple-dimensional intrusion data feature vectors and then perform convolutional encoding to obtain intrusion data text understanding feature vectors. It should be understood that arranging the feature vectors of multiple dimensions in one dimension can fuse the feature information of different dimensions together to form a more comprehensive and all-round feature representation. This helps the system better capture multiple aspects and attributes of intrusion data and improve the richness of feature representation. Through convolutional encoding, the local correlation and patterns between features can be effectively captured, which helps the system learn the spatial structure information between features. The convolutional operation can extract local features and share weights, thereby reducing the number of parameters and computational complexity while retaining important feature information. By performing convolutional encoding on the feature vectors, the feature sequence can be regarded as a text sequence for understanding and processing. This method can draw on the technologies and methods in the field of natural language processing to help the system better understand and analyze the features of intrusion data and improve the effect of intrusion detection and analysis. Convolutional encoding can help the system extract important features and patterns in the input sequence, which helps the system better understand the features and attributes of intrusion data. This helps improve the recognition ability of the intrusion detection system for intrusion behaviors and enhance the network security protection ability. Therefore, by performing one-dimensional arrangement on the multiple-dimensional intrusion data feature vectors and then performing convolutional encoding to obtain intrusion data text understanding feature vectors, the feature fusion and representation ability can be improved, which helps the system better understand and analyze intrusion data, thereby improving the accuracy and efficiency of intrusion detection and analysis and enhancing the network security protection ability.

[0033] Specifically, the intrusion data one-dimensional arrangement unit includes: a vector arrangement sub-unit, configured to perform one-dimensional arrangement on the multiple-dimensional intrusion data feature vectors to obtain a sequence of intrusion data feature vectors; a context semantic encoding sub-unit, configured to perform context semantic encoding on the sequence of intrusion data feature vectors by using the bidirectional long short-term memory neural network model to obtain the intrusion data text understanding feature vectors.

[0034] Correspondingly, the vector arrangement subunit is configured to arrange the multiple-dimensional intrusion data feature vectors in one dimension to obtain a sequence of intrusion data feature vectors. It should be understood that by arranging the feature vectors of multiple dimensions in one dimension, a sequence of feature vectors can be formed. This serialized representation helps the system better model the sequential relationship between features, thereby better capturing the temporal and spatial correlations in the intrusion data. After converting the multi-dimensional feature vectors into a sequence, the correlation information between features can be better extracted. This helps the system more comprehensively analyze the features and patterns of the intrusion data, improving the intrusion detection system's ability to identify intrusion behaviors. Arranging the feature vectors of multiple dimensions in one dimension can reduce the feature dimension to a certain extent, thereby reducing the computational and storage costs. The serialized feature vectors can more effectively represent the original feature information while retaining important feature attributes. After serializing the feature vectors of multiple dimensions, it is more convenient for subsequent processing and analysis. The serialized feature vectors can be applied to various sequence models and algorithms, such as recurrent neural networks (RNNs) and long short-term memory networks (LSTMs), to better mine the temporal information between features. Therefore, arranging the feature vectors of multiple-dimensional intrusion data in one dimension to obtain a sequence of intrusion data feature vectors can help the system better model the correlation between features, extract feature information, reduce dimensions and costs, facilitate subsequent processing and analysis, thereby improving the accuracy and efficiency of intrusion detection and analysis.

[0035] Further, the context semantic encoding subunit is configured to perform context semantic encoding on the sequence of the intrusion data feature vectors by using the bidirectional long short-term memory neural network model to obtain the intrusion data text understanding feature vectors. It should be understood that the bidirectional long short-term memory neural network model can capture the context information in the sequence data, including past and future information. This helps the system better understand the relationships and order among the intrusion data feature vectors, thereby improving the understanding and analysis capabilities of intrusion behaviors. The long short-term memory neural network model structure can effectively handle long-term dependencies, which is beneficial for modeling the long-term information in the feature vector sequence. This is particularly important for intrusion detection systems because intrusion behaviors may involve multiple steps and temporal features. The bidirectional long short-term memory neural network model can perform semantic encoding on the feature vector sequence, converting the feature vectors into a higher-level semantic representation. This helps the system better understand the meaning and patterns of the intrusion data, improving the recognition and understanding capabilities of the intrusion detection system for intrusion behaviors. The bidirectional long short-term memory neural network model combines forward and backward information flows, enabling comprehensive consideration of information in different directions in the feature vector sequence. This helps the system more comprehensively understand the relationships between features, improving the accuracy and robustness of the intrusion detection system. The bidirectional long short-term memory neural network model performs well in processing sequence data and is applicable to various natural language processing and sequence modeling tasks. Applying it to the intrusion data text understanding task can draw on the technologies and methods in the natural language processing field to improve the effect of intrusion data analysis. Therefore, using the bidirectional long short-term memory neural network model to perform context semantic encoding on the sequence of intrusion data feature vectors can help the system better understand the features and patterns of the intrusion data, improve the recognition and understanding capabilities of the intrusion detection system for intrusion behaviors, and enhance the effect of network security protection.

[0036] Specifically, in a specific example of the present application, the intrusion data cascading unit 123 is used to cascade the multiple-dimensional intrusion data feature vectors to obtain an intrusion data global semantic feature vector. It should be understood that cascading feature vectors of multiple dimensions can integrate the information of each dimension into a more global and comprehensive representation. This helps the system better capture the global semantic information of the intrusion data, thereby improving the ability to understand and analyze intrusion behaviors. The cascading operation can fuse the feature information of different dimensions to form a richer and more comprehensive feature representation. This helps the system make more comprehensive use of the multi-dimensional information of the intrusion data and improve the recognition accuracy of the intrusion detection system for intrusion behaviors. Cascading feature vectors of multiple dimensions can expand the feature space, enabling the system to better capture the diversity and complexity of the intrusion data. This helps improve the recognition ability of the intrusion detection system for different types of intrusion behaviors. By cascading the feature vectors of multiple dimensions into a global feature vector through the cascading operation, the model complexity can be reduced, and the calculation and storage costs can be reduced. This helps improve the operation efficiency and performance of the system. By cascading feature vectors of multiple dimensions, the semantic information of the intrusion data can be better expressed. The global semantic feature vector can more accurately reflect the characteristics and patterns of the intrusion behavior, helping the system better understand and analyze the intrusion data.

[0037] Specifically, in a specific example of the present application, the two-dimensional arrangement unit 124 of the intrusion data is used to perform a two-dimensional arrangement on the multiple-dimensional intrusion data feature vectors and then perform feature extraction to obtain an intrusion data local association feature vector. It should be understood that by arranging the multi-dimensional feature vectors in two dimensions, the local correlation between different-dimensional features can be better captured. This helps the system more accurately understand the relationship between the features and improve the ability to analyze and recognize intrusion behaviors. The two-dimensional arrangement can retain the spatial information of the feature vectors, helping the system better understand the positional relationship and spatial structure between the features. This is particularly important for intrusion data analysis because intrusion behaviors may involve local correlations in space. By performing feature extraction on the two-dimensionally arranged feature vectors, the correlation and patterns between the features can be further extracted and strengthened. This helps the system better distinguish different types of intrusion behaviors and improve the performance of the intrusion detection system. The two-dimensionally arranged feature vectors can integrate the information of multiple dimensions to form a more comprehensive and integrated feature representation. This helps the system better utilize the information of different-dimensional features and improve the ability to understand and analyze the intrusion data. The two-dimensionally arranged feature vectors are convenient for application in some models and methods based on image or spatial data processing. This enables the system to draw on the technologies and experiences in the field of image processing to improve the processing effect of the intrusion data.

[0038] Correspondingly, the intrusion data two-dimensional arrangement unit includes: an intrusion data text convolution subunit, configured to two-dimensionally arrange the multi-dimensional intrusion data feature vectors into an intrusion data feature matrix and then obtain an intrusion data local association feature map through a text convolutional neural network model serving as a feature extractor; an intrusion data feature map dimensionality reduction subunit, configured to perform global average pooling on each feature matrix of the intrusion data local association feature map to obtain the intrusion data local association feature vector.

[0039] Furthermore, the intrusion data text convolution subunit is configured to two-dimensionally arrange the multi-dimensional intrusion data feature vectors into an intrusion data feature matrix and then obtain an intrusion data local association feature map through a text convolutional neural network model serving as a feature extractor. It should be understood that the text convolutional neural network has good local perception when processing data such as images and texts, and can effectively capture the correlation between local features. This enables the text convolutional neural network to effectively extract local association features when processing the intrusion data feature matrix. As a powerful feature extractor, the text convolutional neural network can automatically learn and extract key features in the data. By applying the text convolutional neural network model to the intrusion data feature matrix, the correlation between features can be effectively extracted and strengthened, helping the system better understand the intrusion data. The parameter sharing mechanism in the text convolutional neural network model can effectively reduce the number of model parameters, improve the training efficiency and generalization ability of the model. This is very important for processing large-scale intrusion data feature matrices and can effectively reduce the computational cost. The text convolutional neural network can effectively retain spatial information when processing two-dimensional data, which is very important for the processing of the intrusion data feature matrix. Through the text convolutional neural network model, the system can better utilize the spatial structure information in the intrusion data feature matrix and improve the data processing effect. The text convolutional neural network has achieved good results in the fields of processing texts, images, etc. and has strong model transferability. Applying the text convolutional neural network to the processing of the intrusion data feature matrix can draw on its successful experience in other fields and improve the performance of the intrusion detection system. Therefore, by two-dimensionally arranging the multi-dimensional intrusion data feature vectors into an intrusion data feature matrix and then using the text convolutional neural network model as a feature extractor, the local association feature map of the intrusion data can be effectively extracted, helping the system better understand and analyze the intrusion data and improve the performance and effect of the intrusion detection system.

[0040] Furthermore, the intrusion data feature map dimensionality reduction subunit is used to perform global average pooling on each feature matrix of the local correlation feature map of the intrusion data to obtain the local correlation feature vector of the intrusion data. It should be understood that through global average pooling, the information in the feature matrix can be compressed and dimensionality reduced, thereby reducing the complexity and computational volume of the data. This helps to simplify the feature representation and improve the computational efficiency. Global average pooling can help retain the global information in the feature matrix, rather than being limited to local features. This helps the system to more comprehensively understand the feature distribution and overall feature expression of the intrusion data, and improve the system's understanding ability of intrusion behaviors. Through global average pooling, the noise and unnecessary details in the feature matrix can be suppressed to a certain extent, and more important feature information can be retained. This helps to improve the robustness and generalization ability of the system to the intrusion data. The global average pooling operation can perform weighted averaging on each feature in the feature matrix according to its importance, so as to extract more representative statistical features. This helps the system to better understand the overall feature distribution and feature statistical information of the intrusion data. Global average pooling can effectively reduce the risk of overfitting of the model, making the model more generalizable. Through the pooling operation, the dimensionality of the feature vector can be reduced, the complexity of the model can be lowered, and the model can be prevented from overfitting on the training data. Therefore, by performing global average pooling on each feature matrix of the local correlation feature map of the intrusion data to obtain the local correlation feature vector of the intrusion data, the global feature information can be effectively extracted, the feature representation can be simplified, the understanding ability and generalization ability of the system to the intrusion data can be improved, and at the same time, the computational cost can be reduced and the overfitting risk can be reduced.

[0041] Specifically, in a specific example of the present application, the intrusion data fusion unit 125 is configured to fuse the intrusion data text understanding feature vector, the intrusion data global semantic feature vector, and the intrusion data local association feature vector to obtain the network security risk analysis feature vector. It should be understood that fusing text understanding features, global semantic features, and local association features can comprehensively utilize different types of information, improve the expression ability and richness of the feature vector. This helps the system analyze network security risks more comprehensively and accurately. Different types of feature vectors contain different levels and types of information. Fusing these features can achieve information complementarity and supplementation, improving the understanding and analysis ability of network security risks. Fusing multiple feature vectors can improve the system's resistance to noise and interference, enhance the robustness and stability of the system, and make the network security risk analysis result more reliable. By fusing different types of feature vectors, multiple aspects of information can be comprehensively considered, improving the accuracy and reliability of network security risk analysis. The comprehensive features can better capture the complexity and diversity of network security events. Fusing multiple feature vectors helps improve the generalization ability of the system, enabling the system to effectively perform network security risk analysis in different scenarios and datasets, with better adaptability and universality. Therefore, by fusing the intrusion data text understanding feature vector, the intrusion data global semantic feature vector, and the intrusion data local association feature vector, different types of information can be fully utilized to improve the comprehensiveness, accuracy, and robustness of network security risk analysis, thereby better identifying and responding to network security threats.

[0042] Correspondingly, the intrusion data fusion unit includes: a global-local feature fusion subunit, configured to fuse the intrusion data global semantic feature vector and the intrusion data local association feature vector to obtain an intrusion data global-local association feature vector; a risk feature fusion subunit, configured to perform bit-by-bit perturbation entropy fusion optimization of hybrid regression on the intrusion data text understanding feature vector and the intrusion data global-local association feature vector to obtain the network security risk analysis feature vector.

[0043] Correspondingly, the global-local feature fusion subunit is used to fuse the global semantic feature vector of the intrusion data and the local correlation feature vector of the intrusion data to obtain the global-local correlation feature vector of the intrusion data. It should be understood that the global semantic feature vector captures global information, while the local correlation feature vector contains local information. Fusing the two enables the feature vector to consider both global semantic information and local correlation, thus more comprehensively describing the data features. Fusing the global semantic feature and the local correlation feature can make the feature vector richer and more diverse, covering different levels and types of information, which helps to improve the expression ability and discrimination of the feature vector. The global semantic feature and the local correlation feature each have different feature representation capabilities. Fusion can comprehensively utilize their advantages, making the feature vector more representative and discriminative, which is beneficial to subsequent data analysis and processing. The fusion of the global-local correlation feature vector can comprehensively consider the relationship between global information and local correlation, effectively capturing the association and consistency between the whole and the local of the data, which is beneficial to better understanding the data features. By fusing the global semantic feature and the local correlation feature, the information in the high-dimensional feature space can be fused into a lower-dimensional feature vector, reducing the computational complexity while retaining useful information, which helps to improve the data processing efficiency. Therefore, fusing the global semantic feature vector of the intrusion data and the local correlation feature vector of the intrusion data to obtain the global-local correlation feature vector of the intrusion data can make full use of the advantages of global and local information, making the feature vector more information-rich, representative, and discriminative, which helps to improve the comprehensive expression ability and analysis effect of the data features.

[0044] Specifically, the global-local feature fusion subunit is used to: fuse the global semantic feature vector of the intrusion data and the local correlation feature vector of the intrusion data as follows to obtain the global-local correlation feature vector of the intrusion data; where the fusion formula is:

[0045] V1 = αV s + βV d

[0046] where V1 is the global-local correlation feature vector of the intrusion data, F s is the global semantic feature vector of the intrusion data, V d is the local correlation feature vector of the intrusion data, "+" represents the addition of the elements at the corresponding positions of the global semantic feature vector of the intrusion data and the local correlation feature vector of the intrusion data, and α and β are weighting parameters used to control the balance between the global semantic feature vector and the local correlation feature vector in the global-local correlation feature vector of the intrusion data.

[0047] Further, the fusion risk feature subunit is used to perform bit-by-bit perturbation entropy fusion optimization on the intrusion data text understanding feature vector and the intrusion data global-local association feature vector to obtain the network security risk analysis feature vector. It should be understood that the text understanding feature vector and the global-local association feature vector respectively represent text information understanding and global-local relevance. Fusing these two types of feature vectors can comprehensively consider text information and data structure information, enriching the information content of the feature vector. Combining text understanding and global-local association features can provide a more comprehensive description of data features, covering text semantic information and data internal relevance, which helps to comprehensively understand network data features and thus more accurately analyze network security risks. The text understanding feature and the global-local association feature contain different types and levels of information, and fusion can achieve information complementarity and supplementation, improving the richness and representational ability of the feature vector, which is conducive to more comprehensively capturing network security risk features. By fusing different types of feature vectors, multiple aspects of information can be comprehensively considered, improving the accuracy and reliability of network security risk analysis. The comprehensive feature can better capture the complexity and diversity of network security events, improving the accuracy of the analysis results. The fusion of the text understanding feature and the global-local association feature can comprehensively consider the relationship between global and local features, effectively capturing the diversity and complexity of data features, which helps to more comprehensively analyze network security risks.

[0048] Specifically, the fusion risk feature subunit is used to: calculate the autoregressive matrix of the intrusion data text understanding feature vector, and perform core factor dimensionality reduction on the autoregressive matrix of the intrusion data text understanding feature vector to obtain a set of intrusion data text understanding feature core component coding vectors, which is expressed by the formula:

[0049]

[0050] where V represents the intrusion data text understanding feature vector, T represents the transpose of the vector, M z represents the autoregressive matrix, U represents the set of intrusion data text understanding feature core component coding vectors, v1, v2, v m respectively represent the first, second, and mth intrusion data text understanding feature core component coding vectors, Λ represents the intrusion data text understanding feature diagonal matrix after core factor dimensionality reduction, and λ1, λ m respectively represent the first and mth eigenvalues on the diagonal of the intrusion data text understanding feature diagonal matrix.

[0051] That is, through the calculation of the autoregressive matrix, the mutual dependence relationship between different feature dimensions can be quantified, revealing the inherent structural laws of the data. For example, certain semantic features (such as the co-occurrence frequency of specific attack keywords) may form strong associations with features such as timestamps or source IP addresses. If such associations are not explicitly extracted, it may lead to an increased sensitivity of subsequent classifiers to noise. The intervention of core factor dimensionality reduction is to map the original high-dimensional features to a low-dimensional space through orthogonal transformation, while retaining the direction with the largest variance in the data (i.e., the dimension with the most abundant information), thereby reducing the computational complexity while filtering out redundant or weakly correlated feature components.

[0052] Specifically, the fusion risk feature subunit is further configured to: input the set of intrusion data text understanding feature core component encoding vectors into a sequence encoder based on a forward LSTM model to obtain a set of intrusion data text understanding feature core component context-associated encoding vectors, which is represented by the formula:

[0053] F = LSTM([v1, v2, …, v m ) = [s1, s2, …, s m

[0054] where LSTM represents the forward LSTM model, F represents the set of intrusion data text understanding feature core component context-associated encoding vectors, and s1, s2, s m represent the first, second, and m-th intrusion data text understanding feature core component context-associated encoding vectors.

[0055] That is, this application introduces an LSTM sequence encoder to model the set of intrusion data text understanding feature core component encoding vectors through its gating mechanism. Specifically, through the persistent storage and selective forgetting of historical information by the memory unit of the LSTM model, the long-range dependencies between the intrusion data text understanding feature core component encoding vectors can be captured (such as the progressive association between early low-frequency probing behaviors and later high-intensity attacks of a certain type of attack), and this cross-dimensional non-linear association is encoded as a context-associated vector, making up for the deficiency of PCA that only focuses on linear structures. More importantly, it transforms discrete features into a representational form with dynamic semantic relationships, enabling subsequent classifiers to distinguish complex attack scenarios from normal operation fluctuations, thereby significantly improving the accuracy and granularity of risk level determination.

[0056] ​Specifically, the fusion risk feature subunit is further configured to: calculate the bit-by-bit perturbation entropy between each pair of corresponding intrusion data text understanding feature core component context correlation encoding vectors and intrusion data text understanding feature core component encoding vectors in the set of intrusion data text understanding feature core component context correlation encoding vectors and the set of intrusion data text understanding feature core component encoding vectors to obtain a set of bit-by-bit perturbation entropy, which is expressed by the formula:

[0057]

[0058] wherein, ∧ represents a logical operator, w represents a bit-by-bit perturbation comparison function, v i represents the i-th intrusion data text understanding feature core component encoding vector, represents the feature value at the j-th position of the i-th intrusion data text understanding feature core component encoding vector, s i represents the i-th intrusion data text understanding feature core component context correlation encoding vector, represents the feature value at the j-th position of the i-th intrusion data text understanding feature core component context correlation encoding vector, ε represents a predetermined threshold, r i represents the i-th bit-by-bit perturbation matching feature vector, represents the feature value at the j-th position of the i-th bit-by-bit perturbation matching feature vector, L represents the length of the i-th bit-by-bit perturbation matching feature vector, e i represents the i-th bit-by-bit perturbation entropy.

[0059] That is, the present application introduces bit-by-bit perturbation entropy. By quantifying the information uncertainty (i.e., entropy value) of each bit in the exclusive OR operation result of the intrusion data text understanding feature core component context correlation encoding vector and the intrusion data text understanding feature core component encoding vector at the binary bit level, it evaluates the information reconstruction degree of the context correlation modeling on the original features, makes up for the deficiency of the traditional measurement method in non-linear information perturbation detection, and more importantly, converts the feature difference into a quantized signal interpretable by information theory. The generated set of bit-by-bit perturbation entropy not only provides an optimization basis based on information sensitivity for subsequent feature weight adjustment, but also realizes the in-depth decoupling of complex attack semantics through the difference analysis at the binary level, improving the dynamic adaptability of risk grading and the pertinence of defense strategies.

[0060] Specifically, the fusion risk feature subunit is further configured to: perform a weighting process on the set of bit-by-bit perturbation entropy to obtain a set of bit-by-bit perturbation entropy weight factors, which is expressed by the formula:

[0061] a i = softmax(e i )

[0062] Among them, softmax represents the normalized exponential function, and a i represents the i-th bitwise perturbation entropy weight factor.

[0063] That is, through the normalized output of the probability distribution, the complex entropy value relationship is transformed into a scalar weight that can directly participate in feature fusion, reducing the complexity of subsequent calculations. In addition, the smooth gradient characteristic of Softmax avoids the instability of the model caused by sudden weight changes, ensuring the continuity of defense strategy adjustment. The adaptive weight allocation mechanism enables the system to focus on the feature dimensions with the most significant information perturbation, thereby improving the risk recognition accuracy and response efficiency in complex attack scenarios.

[0064] Specifically, the fusion risk feature subunit is further configured to: based on the set of bitwise perturbation entropy weight factors, fuse the set of core component encoding vectors of the intrusion data text understanding features to obtain an optimized intrusion data text understanding feature vector, which is expressed by the formula:

[0065]

[0066] where v f represents the optimized intrusion data text understanding feature vector.

[0067] That is, through weighted fusion, the differences at the information theory level are quantitatively transformed into the structural reconstruction of the feature space, which can improve the discrimination ability of subsequent classifiers for complex attack patterns. In addition, the feature recombination guided by the bitwise perturbation entropy weight factor reduces the interference of redundant information, enabling the system to have stronger generalization ability when dealing with new attacks. The dynamic weight allocation mechanism enables the model to adapt to changes in the network environment, thereby continuously optimizing the risk detection accuracy while ensuring real-time performance, and generating an optimized intrusion data text understanding feature vector.

[0068] Specifically, the fusion risk feature subunit is further configured to: perform weighted fusion on the optimized intrusion data text understanding feature vector and the intrusion data global-local association feature vector to obtain a network security risk analysis feature vector. It should be understood that by assigning dynamic weights to different optimized intrusion data text understanding feature vectors and intrusion data global-local association feature vectors, the fused network security risk analysis feature vector not only retains the sensitivity to key details but also has the reasoning ability of the macroscopic attack chain, ultimately forming a comprehensive quantitative representation of the risk level.

[0069] In an embodiment of the present application, the intrusion data classification module 130 is configured to obtain a classification result by passing the network security risk analysis feature vector through a classifier, where the classification result is used to represent the risk level of the extracted intrusion data. The risk level includes: low, medium, and high. It should be understood that by classifying the network security risk analysis feature vector through a classifier, automatic evaluation and classification of the risk level of intrusion data can be achieved, improving the efficiency and reliability of network security risk analysis. Using the classification result to represent the risk level (such as low, medium, and high) can standardize the risk assessment result, making the risk level easier to understand and compare, which is beneficial for decision-makers to quickly take corresponding security measures. Dividing the risk level into low, medium, and high levels can provide an intuitive risk assessment result and is easy to explain to relevant personnel, helping decision-makers quickly understand the severity of network security risks. Dividing the risk level of intrusion data into different levels can help the security team prioritize high-risk events and improve the efficiency and timeliness of dealing with network security threats. Based on the risk level output by the classifier, the security team can formulate corresponding security policies and countermeasures according to different levels of risk, and strengthen network security defense and monitoring in a targeted manner. Therefore, by classifying the network security risk analysis feature vector through a classifier and then using the classification result to represent the risk level of intrusion data (such as low, medium, and high), automatic risk assessment, standardized risk levels, interpretable results, determination of risk priorities, and effective support for decision-makers can be achieved, which helps improve the efficiency of network security management and the accuracy of decision-making.

[0070] Correspondingly, in an embodiment of the present application, the intrusion data classification module is configured to: use the classifier to process the network security risk analysis feature vector according to the following formula to obtain the classification result;

[0071] where the formula is: softmax{(W n , B n ):...:(W1, B1)|X}, where W1 to W n are weight matrices, b1 to B n are bias vectors, X is the network security risk analysis feature vector, softmax represents the softmax function, and O represents the classification result.

[0072] In summary, based on the network security risk detection system and method based on big data technology in the embodiment of the present application, by extracting the feature vector of intrusion data and using a classifier for analysis, the network security risk level is evaluated, providing a basis for real-time early warning and targeted defense, making up for the deficiencies of existing security monitoring systems, coping with network security threats, and preventing information leakage and economic losses.

[0073] As described above, the network security risk detection system 100 based on big data technology according to the embodiments of the present application can be implemented in various terminal devices, such as the server of the network security risk detection system based on big data technology. In one example, the network security risk detection system 100 based on big data technology can be integrated into the terminal device as a software module and / or a hardware module. For example, the network security risk detection system 100 based on big data technology can be a software module in the operating system of the terminal device, or can be an application program developed for the terminal device; of course, the network security risk detection system 100 based on big data technology can also be one of the many hardware modules of the terminal device.

[0074] Alternatively, in another example, the network security risk detection system 100 based on big data technology and the terminal device can also be separate devices, and the network security risk detection system 100 based on big data technology can be connected to the terminal device through a wired and / or wireless network, and transmit interaction information in accordance with a predetermined data format.

[0075] Figure 4 It is a flowchart of the network security risk detection method based on big data technology according to the embodiments of the present application. As Figure 4 shown, the network security risk detection method based on big data technology according to the embodiments of the present application includes the steps of: S110, extracting the detected intrusion data, where the intrusion data includes the attack type, the attack source, and the affected system or resource; S120, extracting a network security risk analysis feature vector from the intrusion data; S130, passing the network security risk analysis feature vector through a classifier to obtain a classification result, where the classification result is used to represent the risk level of the extracted intrusion data, and the risk level includes: low, medium, and high.

[0076] Here, those skilled in the art can understand that the specific operations of each step in the above network security risk detection method based on big data technology have been described in detail in the description of the network security risk detection system based on big data technology above, and therefore, the repeated description thereof will be omitted. Figures 1 to 3 The above has described the basic principles of the present disclosure in combination with specific embodiments. However, it should be noted that the advantages, advantages, effects, etc. mentioned in the present disclosure are only examples and not limitations, and it cannot be considered that these advantages, advantages, effects, etc. are essential for each embodiment of the present disclosure. In addition, the above specific details are only for the purpose of illustration and easy understanding, and are not limitations. The above details do not limit the present disclosure to necessarily adopt the above specific details to implement.

[0077]

[0078] ​The block diagrams of the devices, apparatuses, equipment, and systems involved in this disclosure are only illustrative examples and are not intended to require or imply that the connection, arrangement, and configuration must be carried out in the manner shown in the block diagrams. As those skilled in the art will recognize, these devices, apparatuses, equipment, and systems can be connected, arranged, and configured in any way. Words such as "including," "comprising," "having," etc. are open-ended terms, meaning "including but not limited to," and can be used interchangeably with each other. The word "or" and "and" used herein refer to the word "and / or" and can be used interchangeably with it, unless the context clearly indicates otherwise. The word "such as" used herein refers to the phrase "such as but not limited to" and can be used interchangeably with it.

[0079] In addition, as used herein, the "or" used in the listing of items starting with "at least one" indicates a disjunctive listing. So, for example, the listing of "at least one of A, B, or C" means A or B or C, or AB or AC or BC, or ABC (i.e., A and B and C). Furthermore, the term "exemplary" does not mean that the examples described are preferred or better than other examples.

[0080] It should also be noted that in the systems and methods of this disclosure, each component or each step can be decomposed and / or recombined. These decompositions and / or recombinations should be regarded as equivalent solutions of this disclosure.

[0081] Various changes, substitutions, and alterations to the technologies described herein can be made without departing from the teachings defined by the appended claims. In addition, the scope of the claims of this disclosure is not limited to the specific aspects of the processes, machines, manufactures, compositions of events, means, methods, and acts described above. Current or later-developed processes, machines, manufactures, compositions of events, means, methods, or acts that perform substantially the same function or achieve substantially the same result as the corresponding aspects described herein can be utilized. Thus, the appended claims include such processes, machines, manufactures, compositions of events, means, methods, or acts within their scope.

[0082] The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use this disclosure. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein can be applied to other aspects without departing from the scope of this disclosure. Therefore, this disclosure is not intended to be limited to the aspects shown herein, but rather to the broadest scope consistent with the principles and novel features disclosed herein.

[0083]

[0084] ​The foregoing description has been presented for purposes of illustration and description. In addition, the description is not intended to limit embodiments of the present disclosure to the form disclosed herein. Although several example aspects and embodiments have been discussed above, those of skill in the art will recognize some of their variations, modifications, alterations, additions, and subcombinations.

Claims

1. A network security risk detection system based on big data technology, characterized in that Including: An intrusion data collection module for extracting detected intrusion data, where the intrusion data includes attack type, attack source, affected system or resource; An intrusion data feature extraction module for extracting network security risk analysis feature vectors from the intrusion data; An intrusion data classification module for obtaining a classification result by passing the network security risk analysis feature vectors through a classifier, and the classification result is used to represent the risk level of the extracted intrusion data, where the risk level includes: low, medium, high.

2. The network security risk detection system based on big data technology according to claim 1, wherein The intrusion data feature extraction module includes: An intrusion data context encoding unit for converting the intrusion data into intrusion data embedding vectors and then obtaining multi-dimensional intrusion data feature vectors through a context encoder based on a transformer; An intrusion data one-dimensional arrangement unit for arranging the multi-dimensional intrusion data feature vectors in one dimension and then obtaining intrusion data text understanding feature vectors through convolutional encoding; An intrusion data concatenation unit for concatenating the multi-dimensional intrusion data feature vectors to obtain intrusion data global semantic feature vectors; An intrusion data two-dimensional arrangement unit for arranging the multi-dimensional intrusion data feature vectors in two dimensions and then obtaining intrusion data local association feature vectors through feature extraction; An intrusion data fusion unit for fusing the intrusion data text understanding feature vectors, the intrusion data global semantic feature vectors and the intrusion data local association feature vectors to obtain the network security risk analysis feature vectors.

3. The network security risk detection system based on big data technology according to claim 2, characterized in that, The intrusion data context encoding unit includes: An intrusion data embedding conversion unit for converting the intrusion data through an embedding layer to convert each dimension of the intrusion data into an embedding vector to obtain a sequence of embedding vectors, where the embedding layer uses a learnable embedding matrix to perform embedding encoding on each dimension of the intrusion data; An intrusion data encoding unit for passing the sequence of embedding vectors through the context encoder based on the transformer to obtain the multi-dimensional intrusion data feature vectors.

4. The network security risk detection system based on big data technology according to claim 3, wherein The intrusion data one-dimensional arrangement unit includes: A vector arrangement sub-unit for arranging the multi-dimensional intrusion data feature vectors in one dimension to obtain a sequence of intrusion data feature vectors; A context semantic encoding sub-unit for performing context semantic encoding on the sequence of intrusion data feature vectors using the bidirectional long short-term memory neural network model to obtain the intrusion data text understanding feature vectors.

5. The network security risk detection system based on big data technology according to claim 4, characterized in that, The intrusion data two-dimensional arrangement unit includes: An intrusion data text convolution sub-unit for arranging the multi-dimensional intrusion data feature vectors in two dimensions into an intrusion data feature matrix and then obtaining an intrusion data local association feature map through a text convolutional neural network model as a feature extractor; An intrusion data feature map dimensionality reduction sub-unit for performing global average pooling on each feature matrix of the intrusion data local association feature map to obtain the intrusion data local association feature vectors.

6. The network security risk detection system based on big data technology according to claim 5, characterized in that, The intrusion data fusion unit includes: The global-local feature fusion subunit is used to fuse the global semantic feature vector of the intrusion data and the local correlation feature vector of the intrusion data to obtain the global-local correlation feature vector of the intrusion data; The risk feature fusion subunit is used to perform bit-by-bit perturbation entropy fusion optimization of hybrid regression on the text understanding feature vector of the intrusion data and the global-local correlation feature vector of the intrusion data to obtain the network security risk analysis feature vector.

7. The network security risk detection system based on big data technology according to claim 6, characterized in that, The global-local feature fusion subunit is used to: fuse the global semantic feature vector of the intrusion data and the local correlation feature vector of the intrusion data as follows to obtain the global-local correlation feature vector of the intrusion data; where the fusion formula is: V1 = αV s + βV d Among them, V1 is the global-local correlation feature vector of the intrusion data, and F s is the global semantic feature vector of the intrusion data, and V d is the local correlation feature vector of the intrusion data. The "+" indicates the addition of elements at the corresponding positions of the global semantic feature vector of the intrusion data and the local correlation feature vector of the intrusion data. α and β are weighting parameters used to control the balance between the global semantic feature vector of the intrusion data and the local correlation feature vector of the intrusion data in the global-local correlation feature vector of the intrusion data.

8. The network security risk detection system based on big data technology according to claim 7, characterized in that The risk feature fusion subunit is used to: Calculate the autoregressive matrix of the text understanding feature vector of the intrusion data, and perform core factor dimensionality reduction on the autoregressive matrix of the text understanding feature vector of the intrusion data to obtain a set of core component coding vectors of the text understanding feature of the intrusion data; Input the set of core component coding vectors of the text understanding feature of the intrusion data into a sequence encoder based on the forward LSTM model to obtain a set of context correlation coding vectors of the core components of the text understanding feature of the intrusion data; Calculate the bit-by-bit perturbation entropy between each corresponding context correlation coding vector of the core components of the text understanding feature of the intrusion data and the core component coding vector of the text understanding feature of the intrusion data in the set of context correlation coding vectors of the core components of the text understanding feature of the intrusion data and the set of core component coding vectors of the text understanding feature of the intrusion data to obtain a set of bit-by-bit perturbation entropy; Perform weight processing on the set of bit-by-bit perturbation entropy to obtain a set of bit-by-bit perturbation entropy weight factors; Based on the set of bit-by-bit perturbation entropy weight factors, fuse the set of core component coding vectors of the text understanding feature of the intrusion data to obtain an optimized text understanding feature vector of the intrusion data; Fuse the optimized text understanding feature vector of the intrusion data and the global-local correlation feature vector of the intrusion data to obtain a network security risk analysis feature vector.

9. The network security risk detection system based on big data technology according to claim 8, characterized in that The intrusion data classification module is used to: use the classifier to process the network security risk analysis feature vector according to the following formula to obtain the classification result; Among them, the formula is: softmax{(W n , B n ):…:(W1, B1)|X}, where, W1 to W n are weight matrices, B1 to B n are bias vectors, X is the network security risk analysis feature vector, softmax represents the softmax function, and O represents the classification result.

10. A network security risk detection method based on big data technology, characterized in that, It includes: Extract the detected intrusion data, where the intrusion data includes the attack type, attack source, affected system or resource; Extract the network security risk analysis feature vector from the intrusion data; Pass the network security risk analysis feature vector through a classifier to obtain a classification result, and the classification result is used to represent the risk level of the extracted intrusion data, where the risk level includes: low, medium, high.

Images