Network security situation awareness system based on federated learning driving

Abstract

The invention discloses a network security situation awareness system based on federated learning driving, and relates to the technical field of distributed computing. The visual management center is in communication connection with a data acquisition module, a distributed federation learning module, a virtual storage management module, a security policy analysis module and an automatic response processing module, and all the modules are in electric signal connection. Through the federated learning technology, the security situation awareness model is locally trained on the multiple distributed nodes, centralized storage and transmission of data are avoided, the risk problem of data privacy leakage in a traditional network security situation awareness system is effectively solved, each node only processes and analyzes data locally, data uploading is not needed, and the network security situation awareness system is convenient to use. Therefore, on the premise of ensuring data security and privacy, cross-node knowledge sharing and model optimization are realized, and the data privacy protection capability of the system is greatly improved.

Description

Technical Field

[0001] The present invention relates to the field of distributed computing technology, and in particular to a network security situation awareness system driven by federated learning. Background Art

[0002] With the rapid development of information technology, network attack methods are becoming increasingly complex and diverse. From traditional viruses and Trojans to advanced persistent threats (APTs), ransomware, zero-day vulnerability attacks, etc., network attackers use advanced technical means to pose a serious threat to the network security of enterprises and individuals. Faced with such a complex and changing threat environment, traditional security protection methods can no longer meet the needs. In order to effectively improve the ability of network security situation awareness, the use of artificial intelligence technology has become a trend. Federated learning, as a new distributed learning framework, can collaboratively train models between multiple devices or nodes, while avoiding centralized storage and transmission of data, solving the problems of data privacy and security.

[0003] In the existing technology, the network security situation awareness system needs to process a large amount of security log data, which will cause the system to become inefficient when facing high-concurrency requests, and even affect the response speed, thereby affecting the real-time perception capability of the security situation. Moreover, when encountering a bottleneck in hardware resources, the hardware performance is often difficult to meet the demand, resulting in limited scalability of the system. Therefore, how to combine federated learning technology and virtualization technology to improve the processing efficiency and scalability of the system is the problem to be solved by the present invention. To this end, a network security situation awareness system driven by federated learning is proposed. Summary of the Invention

[0004] The purpose of the present invention is to provide a network security situation awareness system driven by federated learning to solve the problems raised in the above background technology.

[0005] In order to solve the above technical problems, the technical solution adopted by the present invention is:

[0006] A network security situational awareness system driven by federated learning includes a visualization management center, wherein the visualization management center is communicatively connected to a data acquisition module, a distributed federated learning module, a virtual storage management module, a security policy analysis module, and an automated response and disposal module, wherein the modules are electrically connected;

[0007] The visual management center serves as the management and control center of the entire system. It provides a user interface to enable user interaction with various system modules, making it easier for users to configure, monitor, and manage the system, improving the system's usability and management efficiency. It also enables security managers to intuitively understand the system's operating status and network security situation and make quick decisions.

[0008] The data acquisition module is used to collect and pre-process various types of security log data from the network environment, including network traffic logs, system logs, and application logs, to ensure data quality and consistency;

[0009] The distributed federated learning module is used to locally train the security situation awareness model on multiple distributed nodes using federated learning technology. Each node performs data processing and model training locally, avoiding privacy risks and performance bottlenecks caused by data centralization.

[0010] The virtual storage management module is used to manage the computing, storage and network resources of the system. It abstracts physical resources into virtual resource pools through virtualization technology, performs dynamic allocation and flexible scheduling of resources, and improves resource utilization.

[0011] The security policy analysis module is used to perform threat detection and analysis on the collected security log data based on the security situation awareness model trained by federated learning, identify potential security threats and abnormal behaviors, and then formulate corresponding security policies;

[0012] The automated response and disposal module is used to automatically execute response and disposal operations based on the formulated security policies and threat intelligence, thereby reducing the delay of manual intervention and improving the automation level and response speed of the system.

[0013] A further improvement of the technical solution of the present invention is that the data acquisition module specifically includes:

[0014] Through various sensors, agents, or log collectors deployed in the network environment, it collects multi-source security log data, including network traffic logs, system logs, and application logs. It uses standardized protocols and interfaces to ensure efficient and stable data transmission.

[0015] Preprocess the collected security log data, including data cleaning, format conversion, deduplication, and standardization;

[0016] Integrate the pre-processed scattered security log data, further organize and classify the data, and store it in the data warehouse.

[0017] A further improvement of the technical solution of the present invention is that the distributed federated learning module specifically includes:

[0018] Initialize the distributed federated learning module and configure the roles and tasks of each distributed node. Each node prepares a local data set and computing resources based on its own configuration. Each distributed node independently processes the collected security log data locally to ensure data quality and consistency.

[0019] The locally processed security log data is used to independently train the security situation awareness model on each distributed node. Each node builds and optimizes the local model based on its own data characteristics and security requirements.

[0020] After completing local model training, each distributed node encrypts the generated model parameters and shares them with other nodes through a secure communication protocol. The shared model parameter information is used to update the global model and integrate the training results of different distributed nodes. This enables cross-node knowledge sharing and model optimization without sharing the original data.

[0021] By collecting parameter information shared by other nodes, each distributed node uses the parameter information to update the local model to make it closer to the global optimal model. The synchronization process ensures that the models on all nodes can be continuously optimized to adapt to the ever-changing network security threat environment. At the same time, through regular global model synchronization, the model structure and parameters are dynamically adjusted to further improve the overall processing efficiency and scalability of the system.

[0022] A further improvement of the technical solution of the present invention is that the training process of the security situation awareness model is:

[0023] Traverse the pre-processed security log data and perform feature analysis on it to extract features related to security situation awareness, including traffic features, system behavior features, and application log features. The extracted features are integrated and, based on system requirements, the standard value of each feature is determined. Abnormal features are marked to obtain a feature vector dataset. Traffic features include packet size and transmission frequency, system behavior features include the number of login attempts and the number of abnormal operations, and application log features include error frequency and the number of abnormal accesses.

[0024] On each distributed node, a neural network algorithm is selected as the basic architecture for training the security situation awareness model. The security situation awareness model is trained based on the feature vector dataset, and the model parameters are adjusted. During the training process, the patterns and abnormal behavior characteristics in the learning data are learned. The model parameters are encrypted to ensure data security during transmission. The encrypted parameters are shared with other nodes through a secure communication protocol. After receiving the encrypted parameters shared by other nodes, each node decrypts and integrates the model parameters, updates the local model, calculates the weighted average of the global model parameters through the federated learning algorithm, and updates the local model to make it closer to the global optimal model. The updated local model is then output.

[0025] On each node, the updated model is verified using a local validation dataset to evaluate the model's performance. Based on the validation results, the model parameters are further adjusted to optimize the model's performance. The optimized security situation awareness model is then output for real-time threat detection and analysis.

[0026] Deploy the trained security situation awareness model, input a feature vector dataset including traffic characteristics, system behavior characteristics, and application log characteristics, and output the detected abnormal behavior characteristics.

[0027] A further improvement of the technical solution of the present invention is that the virtual storage management module specifically includes:

[0028] The virtual storage management module abstracts and integrates the system's physical computing, storage, and network resources. Virtualization technology abstracts the physical CPU, memory, disk storage, and network bandwidth resources into a unified virtual resource pool. It also identifies the characteristics and capabilities of various physical resources, partitions and encapsulates them, and shields differences in the underlying hardware.

[0029] Based on the abstract virtual resource pool, the system's operating status and resource requirements are monitored in real time. Based on the current system load, including the intensity of computing tasks, the increase or decrease in data storage, and fluctuations in network traffic, virtual resources are allocated and scheduled, accurately allocating resources to various business modules or applications to ensure that resources are fully utilized, avoid idle resources and waste, and improve overall resource utilization.

[0030] During system operation, the virtual storage management module continuously tracks changes in system load, and responds quickly and automatically adjusts resource allocation plans when faced with high concurrent requests.

[0031] A further improvement of the technical solution of the present invention is that: the security policy analysis module includes a security situation awareness unit, a threat intelligence sharing unit and a security threat alarm unit;

[0032] The security situation awareness unit is used to perform real-time security situation analysis in combination with the security situation awareness model, calculate the security situation score, evaluate threats and attack activities in the network, and then identify potential security threats and abnormal behaviors;

[0033] The threat intelligence sharing unit is used to share threat intelligence among distributed nodes, including the characteristics, attack patterns, and defense strategies of known threats. It uses federated learning technology to update and disseminate intelligence in real time, thereby enhancing the system's overall threat perception capabilities and enabling each distributed node to obtain the latest threat information in a timely manner, thereby improving the system's defense effectiveness.

[0034] The security threat alarm unit is used to issue an alarm notification when a threat is detected and formulate a corresponding security strategy, which includes isolating infected devices, blocking attack paths and notifying relevant personnel.

[0035] A further improvement of the technical solution of the present invention is that the security situation awareness unit specifically includes:

[0036] The security situation awareness unit receives real-time security log data and extracts features related to security situation awareness, including traffic features, system behavior features, and application log features;

[0037] Combining the security situation awareness model with the standard values of each feature, the extracted features are input and analyzed in real time, and the detected abnormal behavior features are output to evaluate the threats and attack activities in the current network environment, calculate the security situation score, and analyze the security status of the current network environment;

[0038] Based on the calculated security posture score, detected threats and abnormal behaviors are evaluated and classified into different risk levels, including low risk, medium risk, and high risk. This allows security administrators to quickly identify and respond to high-risk events and match the corresponding scoring thresholds for each risk level.

[0039] A further improvement of the technical solution of the present invention is that the threat intelligence sharing unit specifically includes:

[0040] The threat intelligence sharing unit collects threat intelligence from each distributed node. The threat intelligence covers the characteristics, attack patterns, and defense strategies of known threats. Each distributed node performs preliminary organization of the threat intelligence to ensure its standardized format and accurate content, while removing duplicate or low-quality intelligence.

[0041] The organized threat intelligence is encrypted to ensure transmission security. The encrypted threat intelligence is transmitted between nodes using a secure communication protocol to ensure that the intelligence is not tampered with or stolen during the sharing process. After receiving the shared threat intelligence, each node integrates it into the local threat intelligence database.

[0042] Apply shared threat intelligence to security situation awareness models to optimize threat detection and analysis, and then adjust local security policies and rules based on new threat characteristics, attack patterns, and defense strategies.

[0043] A further improvement of the technical solution of the present invention is that the security threat alarm unit specifically includes:

[0044] The security threat alert unit receives analysis results from the security situation awareness model in real time, including the detected threat type, abnormal behavior characteristics, and corresponding risk level;

[0045] Based on the detected risk level and pre-set rule base, corresponding security policies are formulated for the threat types and abnormal behavior characteristics at each risk level;

[0046] In accordance with the established security strategy, the security threat alarm unit sends alarm notifications to relevant personnel through multiple channels, including email, text messages, instant messaging tools, etc., to ensure that relevant personnel can receive threat information in a timely manner.

[0047] A further improvement of the technical solution of the present invention is that the automated response processing module specifically includes:

[0048] The automated response and disposal module receives, in real time, the security policies formulated by the security threat alert unit and the latest threat intelligence provided by the threat intelligence sharing unit. It integrates and analyzes the received information to identify the type, severity, and scope of the current security threat. Furthermore, based on the response rules and disposal requirements specified in the security policy, combined with details such as attack characteristics and behavior patterns in the threat intelligence, it constructs a detailed response and disposal logic framework.

[0049] Based on the results of the integrated analysis, the system automatically plans specific response operation processes and then executes response and disposal operations. By interacting with the interfaces of network devices, security devices, and terminal systems, it quickly implements measures such as device isolation and attack path blocking.

[0050] After completing the automated response and disposal operation, conduct a comprehensive verification of the disposal effect to check whether the infected device has been successfully isolated, whether the network attack path has been effectively blocked, and whether the security threat is under control. By collecting and analyzing system logs and network traffic data information, evaluate the impact of the response and disposal operation on system performance and business operations. Based on the verification results, record the disposal process and optimize and improve the security strategy and response mechanism.

[0051] Due to the adoption of the above technical solution, the present invention has the following technical advancements compared to the prior art:

[0052] 1. The present invention provides a network security situation awareness system driven by federated learning. Through federated learning technology, the security situation awareness model is locally trained on multiple distributed nodes, avoiding the centralized storage and transmission of data, and effectively solving the risk of data privacy leakage in traditional network security situation awareness systems. Each node only processes and analyzes data locally without uploading the data. This achieves cross-node knowledge sharing and model optimization while ensuring data security and privacy, greatly improving the system's data privacy protection capabilities.

[0053] 2. The present invention provides a network security situation awareness system driven by federated learning. By real-time collection and analysis of various security log data in the network environment, it can promptly discover potential security threats and abnormal behavior characteristics. Combined with the security situation awareness model, it can quickly assess the severity and scope of the threat and formulate corresponding security policies. The introduction of the automated response and disposal module further reduces the delay of manual intervention, improves the response speed of the system, and effectively reduces the impact of security incidents on business operations. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments described in the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0055] Figure 1 This is a schematic diagram of the functional modules of the system of the present invention;

[0056] Figure 2 It is a schematic diagram of the workflow of the present invention;

[0057] Figure 3 Schematic diagram of the workflow of the security situation awareness unit of the present invention. DETAILED DESCRIPTION

[0058] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0059] Example 1, as Figures 1 to 3 As shown, the present invention provides a network security situation awareness system driven by federated learning, including a visualization management center, which is communicatively connected to a data acquisition module, a distributed federated learning module, a virtual storage management module, a security policy analysis module, and an automated response and disposal module, wherein the modules are connected by electrical signals;

[0060] The visual management center, serving as the management and control hub for the entire system, provides a user interface to enable user interaction with various system modules, facilitating system configuration, monitoring, and management. This improves system usability and management efficiency, allowing security managers to intuitively understand system operating status and network security posture, enabling them to make quick decisions.

[0061] The data acquisition module is used to collect and pre-process various security log data from the network environment, including network traffic logs, system logs and application logs, to ensure the quality and consistency of the data. Through various sensors, agents or log collectors deployed in the network environment, multi-source security log data including network traffic logs, system logs and application logs are collected. Standardized protocols and interfaces are used to ensure that data can be transmitted efficiently and stably. The collected security log data is pre-processed, including data cleaning, format conversion, deduplication and standardization. Among them, data cleaning removes invalid and redundant data, format conversion ensures that all data conforms to a unified format standard, deduplication avoids interference from duplicate data, and standardization converts data into a format suitable for subsequent analysis and processing. The pre-processed scattered security log data is integrated, and the data is further organized and classified and stored in a data warehouse.

[0062] The distributed federated learning module is used to use federated learning technology to locally train the security situation awareness model on multiple distributed nodes. Each node performs data processing and model training locally, avoiding the privacy risks and performance bottlenecks brought about by data centralization. At the same time, it can fully utilize the computing resources of each node to improve the overall processing efficiency and scalability of the system. The distributed federated learning module is initialized and the roles and tasks of each distributed node are configured. Each node prepares local data sets and computing resources according to its own configuration. Each distributed node performs local independent processing on the collected security log data to ensure the quality and consistency of the data. Local processing fully utilizes the computing resources of each node, reduces dependence on the central node, and improves the overall efficiency of the system. The locally processed security log data is used to independently process the collected security log data on each distributed node. A security situation awareness model is trained independently. Each node builds and optimizes a local model based on its own data characteristics and security requirements. After completing local model training, each distributed node encrypts the generated model parameters and shares them with other nodes through a secure communication protocol. The shared model parameter information is used to update the global model and integrate the training results of different distributed nodes. This enables cross-node knowledge sharing and model optimization without sharing original data. By collecting parameter information shared by other nodes, each distributed node uses the parameter information to update the local model to make it closer to the global optimal model. The synchronization process ensures that the models on all nodes can be continuously optimized to adapt to the ever-changing network security threat environment. At the same time, through regular global model synchronization, the model structure and parameters are dynamically adjusted to further improve the overall processing efficiency and scalability of the system.

[0063] In addition, the training process of the security situation awareness model is as follows:

[0064] Traverse the pre-processed security log data and perform feature analysis on it to extract features related to security situation awareness, including traffic features, system behavior features and application log features. Integrate the extracted features and determine the standard value of each feature according to system requirements. Mark the abnormal features to obtain a feature vector data set, where traffic features include packet size and transmission frequency, system behavior features include the number of login attempts and the number of abnormal operations, and application log features include error frequency and the number of access anomalies. On each distributed node, select a neural network algorithm as the infrastructure for training the security situation awareness model. Train the security situation awareness model based on the feature vector data set and adjust the model parameters. During the training process, learn the patterns and abnormal behavior features in the data and encrypt the model parameters to ensure that they are transmitted correctly. To ensure data security during transmission, the encrypted parameters are shared with other nodes through a secure communication protocol. After receiving the encrypted parameters shared by other nodes, each node decrypts and integrates the model parameters, updates the local model, calculates the weighted average of the global model parameters through the federated learning algorithm, and updates the local model to make it closer to the global optimal model. The updated local model is output. On each node, the updated model is verified using a local validation dataset to evaluate the performance of the model. Based on the validation results, the model parameters are further adjusted to optimize the model performance. The optimized security situation awareness model is output for real-time threat detection and analysis. The trained security situation awareness model is deployed, and the feature vector dataset including traffic characteristics, system behavior characteristics, and application log characteristics is input, and the detected abnormal behavior characteristics are output.

[0065] The virtual storage management module is used to manage the computing, storage and network resources of the system. It abstracts physical resources into virtual resource pools through virtualization technology, dynamically allocates resources and flexibly schedules resources, improves resource utilization, and can dynamically adjust resource allocation according to the system load to ensure stable operation of the system under high concurrent requests. At the same time, it reduces the bottleneck problem of hardware resources. The virtual storage management module abstracts and integrates the physical computing, storage and network resources of the system. It abstracts the physical CPU, memory, disk storage and network bandwidth resources into a unified virtual resource pool through virtualization technology, and identifies the characteristics and capabilities of various physical resources, divides and encapsulates them, shields the differences in the underlying hardware, and monitors the system's operating status and resource requirements in real time based on the abstracted virtual resource pool. Based on the current system load, including the intensity of computing tasks, changes in data storage, and fluctuations in network traffic, virtual resources are allocated and scheduled, and resources are accurately allocated to various business modules or applications to ensure that resources are fully utilized, avoid idleness and waste of resources, and improve overall resource utilization. During system operation, the virtual storage management module continuously tracks changes in the system load. When faced with high-concurrency requests, it quickly responds and automatically adjusts the resource allocation plan to increase the resource supply for key business modules or applications, ensuring that the system can still operate stably under high load conditions and guaranteeing business continuity and performance. At the same time, through dynamic resource adjustment, the bottleneck problem of hardware resources is effectively alleviated, enabling the system to better adapt to changing business needs and operating environments.

[0066] The security policy analysis module is used to detect and analyze threats in collected security log data based on the security situation awareness model trained by federated learning, identify potential security threats and abnormal behaviors, and then formulate corresponding security policies;

[0067] The automated response and disposal module is used to automatically execute response and disposal operations based on the established security policies and threat intelligence, reduce the delay of manual intervention, improve the system's automation level and response speed, and effectively reduce the impact of security incidents. The automated response and disposal module is a key link in the system's active defense and can ensure a rapid response after a security threat is discovered.

[0068] Example 2, as Figures 1 to 3 As shown, based on embodiment 1, the present invention provides a technical solution: preferably, the security policy analysis module includes a security situation awareness unit, a threat intelligence sharing unit and a security threat alarm unit;

[0069] Among them, the security situation awareness unit is used to perform real-time analysis of the security situation in combination with the security situation awareness model, calculate the security situation score, evaluate the threats and attack activities in the network, and then identify potential security threats and abnormal behaviors. The security situation awareness unit receives real-time security log data and extracts features related to security situation awareness, including traffic features, system behavior features, and application log features. In combination with the security situation awareness model and the standard values of each feature, the extracted features are input and analyzed in real time, and the detected abnormal behavior features are output to evaluate the threats and attack activities in the current network environment, calculate the security situation score, analyze the security status of the current network environment, and evaluate the detected threats and abnormal behaviors based on the calculated security situation score, and then classify the threats and abnormal behaviors into different risk levels, including low risk level, medium risk level, and high risk level, so that security administrators can quickly identify and respond to high-risk events and match the corresponding scoring threshold for each risk level;

[0070] The calculation process of security posture score is as follows:

[0071] Collect and organize various types of security log data in the current network environment, extract characteristic values related to security situation awareness, including traffic characteristics, system behavior characteristics, and application log characteristics, and clarify the standard value of each characteristic. For each extracted characteristic value, calculate its ratio to the corresponding standard value, standardize the characteristic values of different dimensions, square the standardized values of traffic characteristics, system behavior characteristics, and application log characteristics, and calculate the cumulative sum of their respective square values. The square operation amplifies the degree of deviation between the characteristic value and the standard value, so that subsequent calculations can more sensitively reflect changes in the security status of the network environment. The sum of the squares of the application log features is added to obtain the total sum of squares. The square root of the total sum of squares is then taken to quantify the overall impact of each feature. The square root of the total sum of squares is divided by the square root of the total number of features and multiplied by 100 to obtain the security posture score. The total number of features is the sum of the number of traffic features, system behavior features, and application log features, with a value of 6 (packet size, transmission frequency, number of login attempts, number of abnormal operations, error frequency, and number of access anomalies). Through normalization, the value range of the security posture score is limited to between 0 and 100, which facilitates the intuitive assessment of the security status of the network environment.

[0072] The calculation expression of security posture score is:

[0073]

[0074] Where S is the security situation score, which reflects the overall security status of the network environment, and F i is the current value of the i-th flow characteristic, SFi is the standard value of the i-th flow characteristic, T j is the current value of the jth system behavior characteristic, ST j is the standard value of the jth system behavior characteristic, A r is the current value of the log feature of the rth application, SA r is the standard value of the rth application log feature, n is the number of traffic features, m is the number of system behavior features, k is the number of application log features, and the value of S ranges from 0 to 100, where 0 indicates complete security with no threats or abnormal behaviors, and 100 indicates the highest risk with severe threats or abnormal behaviors. When the current values of traffic, system behavior, and application log features in the network environment deviate more from the standard values, S will increase, indicating an increase in the security risk of the network environment. On the contrary, when the feature values are close to or meet the standard values, S will decrease, indicating a relatively safe network environment.

[0075] Multiple risk levels correspond to multiple scoring thresholds one by one, and the corresponding relationships are as follows:

[0076] The scoring threshold for low risk level is: 0 <S≤S L ;

[0077] The scoring threshold for medium risk level is: S L <S≤S H ;

[0078] The scoring threshold for high risk level is: S H <S<100;

[0079] Among them, S is the security situation score, S L is the upper threshold of low risk level and the lower threshold of medium risk level, S H The upper threshold for medium risk level and the lower threshold for high risk level;

[0080] The threat intelligence sharing unit is used to share threat intelligence among distributed nodes, including the characteristics, attack patterns, and defense strategies of known threats. It uses federated learning technology to update and disseminate this intelligence in real time, enhancing the system's overall threat perception capabilities and enabling each distributed node to obtain the latest threat information in a timely manner, improving the system's defense effectiveness. The threat intelligence sharing unit collects threat intelligence from each distributed node. The threat intelligence covers the characteristics, attack patterns, and defense strategies of known threats. Each distributed node performs a preliminary compilation of the threat intelligence to ensure its format is standardized and its content is accurate. It also removes duplicate or low-quality intelligence and encrypts the compiled threat intelligence to ensure transmission security. The encrypted threat intelligence is transmitted between nodes using a secure communication protocol to ensure that the intelligence is not tampered with or stolen during the sharing process. After receiving the shared threat intelligence, each node integrates it into its local threat intelligence database. At the same time, it updates local models and strategies based on the latest threat intelligence, improving the node's awareness and defense capabilities against new threats. The shared threat intelligence is applied to the security situation awareness model to optimize threat detection and analysis. Local security policies and rules are then adjusted based on the new threat characteristics, attack patterns, and defense strategies, including updating intrusion detection rules and adjusting firewall policies, to enhance the system's defense effectiveness.

[0081] The security threat alert unit is used to issue alerts when a threat is detected and formulate corresponding security policies. Security policies include isolating infected devices, blocking attack paths, and notifying relevant personnel. The security threat alert unit receives analysis results from the security situation awareness model in real time, including the detected threat type, abnormal behavior characteristics, and corresponding risk level. Based on the detected risk level and the pre-set rule base, it formulates corresponding security policies for the threat type and abnormal behavior characteristics at each risk level. For infected devices, the unit analyzes their infection path and possible harm, and plans isolation plans, such as determining the isolation method (network isolation, system isolation, etc.) and the scope of isolation. For attack paths, it studies how to effectively block them, which involves operations such as adjusting firewall rules and closing relevant ports. At the same time, it identifies the list of relevant personnel who need to be notified, including security administrators, operation and maintenance personnel, and determines the notification method and urgency. In accordance with the formulated security policy, the security threat alert unit sends alert notifications to relevant personnel through various channels, including email, SMS, instant messaging tools, etc., to ensure that relevant personnel can receive threat information in a timely manner.

[0082] The automated response and disposal module specifically includes:

[0083] The automated response and disposal module receives in real time the security policies formulated by the security threat alarm unit and the latest threat intelligence provided by the threat intelligence sharing unit, and integrates and analyzes the received information to clarify the type, severity and scope of the current security threats. At the same time, based on the response rules and disposal requirements stipulated in the security policy, combined with the attack characteristics, behavior patterns and other details in the threat intelligence, it constructs a detailed response and disposal logic framework. Based on the results of the integrated analysis, it automatically plans the specific response operation process, and then executes the response and disposal operations. By interacting with the interfaces of network devices, security devices and terminal systems, it quickly implements measures such as device isolation and attack path blocking. During the execution process, the execution status and effect of the operation are monitored in real time to ensure that each step of the operation can be completed accurately. If an operation abnormality or failure occurs, the backup plan can be automatically triggered or the relevant operation can be re-executed to ensure the continuity and effectiveness of the response and disposal. After completing the automated response and disposal operation, the disposal effect is fully verified to check whether the infected device has been successfully isolated, whether the network attack path has been effectively blocked, and whether the security threat is under control. By collecting and analyzing system logs and network traffic data information, the impact of the response and disposal operation on system performance and business operations is evaluated. According to the verification results, the disposal process is recorded, and the security strategy and response mechanism are optimized and improved.

[0084] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. A network security situation awareness system driven by federated learning, including a visualization management center, characterized by: The visualization management center is communicatively connected to a data acquisition module, a distributed federated learning module, a virtual storage management module, a security policy analysis module, and an automated response and disposal module, wherein electrical signal connections are made between the modules; The data acquisition module is used to collect and pre-process various types of security log data from the network environment; The distributed federated learning module is used to locally train the security situation awareness model on multiple distributed nodes using federated learning technology; The virtual storage management module is used to manage the computing, storage and network resources of the system, abstract physical resources into virtual resource pools through virtualization technology, and perform dynamic allocation and scheduling of resources; The security policy analysis module is used to perform threat detection and analysis on the collected security log data based on the security situation awareness model trained by federated learning, identify potential security threats and abnormal behaviors, and then formulate corresponding security policies; The automated response and disposal module is used to automatically execute response and disposal operations based on the formulated security policies and threat intelligence.

2. The network security situation awareness system based on federated learning according to claim 1, characterized in that: The data acquisition module specifically includes: Collect multi-source security log data including network traffic logs, system logs, and application logs through various sensors, agents, or log collectors deployed in the network environment; Preprocess the collected security log data, including data cleaning, format conversion, deduplication, and standardization. Integrate the pre-processed scattered security log data, further organize and classify the data, and store it in the data warehouse.

3. The network security situation awareness system based on federated learning according to claim 1, characterized in that: The distributed federated learning module specifically includes: Initialize the distributed federated learning module and configure the roles and tasks of each distributed node. Each node prepares local data sets and computing resources based on its own configuration. Each distributed node independently processes the collected security log data locally. The locally processed security log data is used to independently train the security situation awareness model on each distributed node; After completing local model training, each distributed node encrypts the generated model parameters and shares them with other nodes through a secure communication protocol; Collect parameter information shared by other nodes. Each distributed node uses the parameter information to update the local model to make it closer to the global optimal model. At the same time, through regular global model synchronization, the model structure and parameters are dynamically adjusted.

4. The network security situation awareness system based on federated learning according to claim 3 is characterized by: The training process of the security situation awareness model is as follows: Traverse the pre-processed security log data and perform feature analysis on it to extract features related to security situation awareness, including traffic features, system behavior features, and application log features. The extracted features are integrated and, based on system requirements, the standard value of each feature is determined. Abnormal features are marked to obtain a feature vector dataset. Traffic features include packet size and transmission frequency, system behavior features include the number of login attempts and the number of abnormal operations, and application log features include error frequency and the number of abnormal accesses. On each distributed node, a neural network algorithm is selected as the infrastructure for training the security situation awareness model. The security situation awareness model is trained based on the feature vector dataset, and the model parameters are adjusted. During the training process, the patterns and abnormal behavior characteristics in the learning data are learned, the model parameters are encrypted, and the encrypted parameters are shared with other nodes. After receiving the encrypted parameters shared by other nodes, each node decrypts and integrates the model parameters, updates the local model, calculates the weighted average of the global model parameters through the federated learning algorithm, and updates the local model to make it closer to the global optimal model, and outputs the updated local model. On each node, the updated model is verified using a local validation dataset to evaluate the model's performance. Based on the validation results, the model parameters are further adjusted to optimize the model's performance. The optimized security situation awareness model is then output for real-time threat detection and analysis. Deploy the trained security situation awareness model, input a feature vector dataset including traffic characteristics, system behavior characteristics, and application log characteristics, and output the detected abnormal behavior characteristics.

5. The network security situation awareness system based on federated learning according to claim 1, characterized in that: The virtual storage management module specifically includes: The virtual storage management module abstracts and integrates the system's physical computing, storage, and network resources. Virtualization technology abstracts the physical CPU, memory, disk storage, and network bandwidth resources into a unified virtual resource pool. Based on the abstract virtual resource pool, the system's operating status and resource requirements are monitored in real time. Based on the current system load, including the intensity of computing tasks, the increase or decrease in data storage, and fluctuations in network traffic, virtual resources are allocated and scheduled, accurately allocating resources to various business modules or applications to ensure that resources are fully utilized, avoid idle resources and waste, and improve overall resource utilization. During system operation, the virtual storage management module continuously tracks changes in system load, and responds quickly and automatically adjusts resource allocation plans when faced with high concurrent requests.

6. The network security situation awareness system based on federated learning according to claim 4, characterized in that: The security strategy analysis module includes a security situation awareness unit, a threat intelligence sharing unit and a security threat alarm unit; The security situation awareness unit is used to perform real-time security situation analysis in combination with the security situation awareness model, calculate the security situation score, evaluate threats and attack activities in the network, and then identify potential security threats and abnormal behaviors; The threat intelligence sharing unit is used to share threat intelligence among distributed nodes, including characteristics of known threats, attack patterns and defense strategies; The security threat alarm unit is used to issue an alarm notification when a threat is detected and formulate a corresponding security strategy, which includes isolating infected devices, blocking attack paths and notifying relevant personnel.

7. The network security situation awareness system based on federated learning according to claim 6, characterized in that: The security situation awareness unit specifically includes: The security situation awareness unit receives real-time security log data and extracts features related to security situation awareness, including traffic features, system behavior features, and application log features; Combining the security situation awareness model with the standard values of each feature, the extracted features are input and analyzed in real time, and the detected abnormal behavior features are output to evaluate the threats and attack activities in the current network environment, calculate the security situation score, and analyze the security status of the current network environment; Based on the calculated security posture score, the detected threats and abnormal behaviors are evaluated and then classified into different risk levels, including low risk level, medium risk level and high risk level, and the corresponding scoring threshold is matched for each risk level.

8. The network security situation awareness system based on federated learning according to claim 6, characterized in that: The threat intelligence sharing unit specifically includes: The threat intelligence sharing unit collects threat intelligence from each distributed node. The threat intelligence covers the characteristics, attack patterns, and defense strategies of known threats. Each distributed node performs preliminary compilation of the threat intelligence. The organized threat intelligence is encrypted and transmitted between nodes using a secure communication protocol. After receiving the shared threat intelligence, each node integrates it into the local threat intelligence database. Apply shared threat intelligence to security situation awareness models to optimize threat detection and analysis, and then adjust local security policies and rules based on new threat characteristics, attack patterns, and defense strategies.

9. The network security situation awareness system based on federated learning according to claim 8, characterized in that: The security threat alarm unit specifically includes: The security threat alert unit receives analysis results from the security situation awareness model in real time, including the detected threat type, abnormal behavior characteristics, and corresponding risk level; Based on the detected risk level and pre-set rule base, corresponding security policies are formulated for the threat types and abnormal behavior characteristics at each risk level; In accordance with the established security policies, the security threat alarm unit sends alarm notifications to relevant personnel through various channels.

10. The network security situation awareness system based on federated learning according to claim 9, characterized in that: The automated response processing module specifically includes: The automated response and disposal module receives in real time the security policies formulated by the security threat alert unit and the latest threat intelligence provided by the threat intelligence sharing unit. It integrates and analyzes the received information to identify the type, severity, and scope of the current security threat. At the same time, it builds a response and disposal logic framework based on the response rules and disposal requirements specified in the security policy, combined with the attack characteristics and behavior pattern details in the threat intelligence. Based on the results of the integrated analysis, the system automatically plans specific response operation processes and then executes response and disposal operations. By interacting with the interfaces of network devices, security devices, and terminal systems, it quickly implements device isolation and attack path blocking measures. After completing the automated response and disposal operation, conduct a comprehensive verification of the disposal effect to check whether the infected device has been successfully isolated, whether the network attack path has been effectively blocked, and whether the security threat is under control. By collecting and analyzing system logs and network traffic data information, evaluate the impact of the response and disposal operation on system performance and business operations. Based on the verification results, record the disposal process and optimize and improve the security strategy and response mechanism.

Images