Network security information analysis and statistics method based on regulation and control cloud platform

Abstract

The invention discloses a network security information analysis and statistics method based on a regulation and control cloud platform. Protocol identification, standardized mapping and blood relationship marking of multi-source security equipment data are realized through an edge layer protocol adaptation cluster and a metadata self-registration mechanism; constructing a real-time streaming and batch processing dual-channel framework based on regulation and control of cloud platform container resources, and fusing to generate a standardized security event object with a frequency weight and a hazard coefficient; designing a main ring-emergency ring double-path decision closed loop, respectively processing conventional events and high-risk threats, and realizing knowledge base iteration; extracting features by using a containerized architecture in combination with an XGBoost + isolated forest integrated model, detecting threats and generating rules; and a space-time-system-risk four-dimensional visualization engine is constructed, attack path drawing, event evolution display and high-risk area prediction are realized, and a management closed loop is formed. According to the network security information analysis and statistics method based on the regulation and control cloud platform, the intelligence and automation level of network security information analysis and statistics is improved.

Images