Intelligent network space topology construction method fusing multivariate data and alarm traceability method

Abstract

The invention discloses an intelligent network space topology construction method fusing multivariate data and an alarm tracing method in the technical field of network management and network security. The method comprises the following steps: according to asset data and physical connection relation data, sequentially carrying out asset grouping, topology framework firewall layout, topology framework switch layout, topology framework asset offset, layout of all other assets and topology layout optimization based on graph segmentation through a physical mapping service to obtain JSON data capable of completely describing a topology structure; according to the JSON data, a front-end rendering engine based on WebGL is utilized to render a visual topological graph in a browser, events are added in the visual topological graph through event driving so as to support a user to drag and edit topology, and an interactive visual topological graph is obtained. According to the method, remarkable technical progress is generated in the authenticity, the automation degree, the field applicability and the safety analysis value of the topology.

Description

Technical Field

[0001] This invention relates to the fields of network management and network security technology, and in particular to a method for constructing an intelligent network space topology and a method for tracing alarm sources that integrates diverse data. Background Technology

[0002] As networks continue to expand in scale and become increasingly complex, network topology visualization has become central to operations and security analysis. Traditional topology generation techniques often rely on simple matching of static templates and asset information, resulting in topology maps that fail to accurately reflect the physical connections of the network and incurring high maintenance costs. This problem is particularly pronounced in critical industries such as power, where existing solutions cannot meet the rigid requirement for precise descriptions of the network's physical structure. Furthermore, traditional alarm display methods typically show alarm events in isolation, lacking the ability to visualize attack paths within the topology context. This makes it difficult for security analysts to quickly locate the source of attacks and assess their impact, hindering the efficiency of security incident response and handling. Summary of the Invention

[0003] The purpose of this invention is to solve the problems that traditional topology technology cannot automatically generate real physical topology and that alarm information is disconnected from topology paths, and to provide an intelligent network space topology construction method and alarm tracing method that integrates multi-source data.

[0004] To solve the above-mentioned technical problems, the present invention is implemented using the following technical solution:

[0005] In a first aspect, the present invention provides a method for constructing an intelligent network spatial topology that integrates multi-source data, comprising:

[0006] Based on asset data and physical connection relationship data, the physical mapping service sequentially performs asset grouping, topology skeleton firewall layout, topology skeleton switch layout, topology skeleton asset offset, layout of all remaining assets, and topology layout optimization based on graph segmentation to obtain a JSON data that can completely describe the topology structure.

[0007] Based on the JSON data, a visual topology map is rendered in the browser using a WebGL-based front-end rendering engine. Events are then added to the visual topology map via event-driven processing to allow users to drag and drop and edit the topology, resulting in an interactive visual topology map.

[0008] Optionally, the asset data is used to describe all physical devices in the network, and each asset data record includes asset ID, full asset name, abbreviation of asset, asset IP, asset type, security zone, region, and network type;

[0009] The asset types include hosts, firewalls, switches, monitoring devices, and security equipment;

[0010] The switches include management switches, core switches, and general-purpose switches;

[0011] The security zone includes Zone I, Zone II, and Zone I-II;

[0012] The network types include local area networks (LANs) and backbone networks;

[0013] The physical connection relationship data is used to describe the physical link connection status between network devices. Each physical connection relationship record includes source asset ID, destination asset ID, source asset security zone, destination asset security zone, and connection status.

[0014] The source asset ID represents the asset ID at the beginning of the connection relationship;

[0015] The destination asset ID represents the asset ID at the termination end of the connection relationship;

[0016] The connection status indicates the current state of the connection relationship, including newly added, confirmed, and deleted.

[0017] Optionally, the asset grouping includes:

[0018] Based on the network type of the assets, all assets are divided into local area network groups and backbone network groups;

[0019] For all assets in a LAN group, they are divided into Zone I LAN core switch group, Zone I LAN management switch group, Zone I LAN other asset group, Zone I-II LAN firewall group, Zone II LAN core switch group, Zone II LAN management switch group, and Zone II LAN other asset group according to the security zone and asset type.

[0020] All assets within the backbone network group are divided into four groups based on their security zone and asset type: Zone I backbone network general switch group, Zone I backbone network other asset group, Zone II backbone network general switch group, and Zone II backbone network other asset group.

[0021] Assets with only one connection and whose peer is a switch are classified as terminal assets, and all other assets are classified as non-terminal assets.

[0022] Optionally, the topology skeleton firewall layout includes:

[0023] For each firewall in the LAN firewall group of Zone I-II, starting at a preset coordinate... Based on this, place firewalls sequentially according to the following formula:

[0024] ,

[0025] in, This indicates the first firewall group in the I-II zone LAN. The coordinates of the firewall, This indicates the firewall serial number in the LAN firewall group of Zone I-II. This represents the preset vertical spacing constant.

[0026] Optionally, the topology skeleton switch layout includes a non-terminal core switch layout, a non-terminal management switch layout, and a non-terminal general switch layout.

[0027] The non-terminal core switch layout includes:

[0028] Iterate through each firewall in the Zone I-II LAN firewall group, and place the non-terminal LAN core switches of the Zone I LAN core switch group that are directly connected to that firewall on the left side of the corresponding firewall. Coordinates are , coordinates Decrease sequentially from the base The non-terminal LAN core switches of the Zone II LAN core switch group, which are directly connected to the firewall, are placed sequentially on the right side of the corresponding firewall. Coordinates are , coordinates Decrease sequentially from the base ;in, This represents the x-coordinate of the firewall in Zones I and II. This represents the vertical coordinate of the firewall in Zones I and II. and Indicates the preset offset value;

[0029] Traverse the unplaced non-terminal LAN core switches in Zone I LAN core switch group / Zone II LAN core switch group. If there are idle coordinates between the placed Zone I non-terminal LAN core switches / Zone II non-terminal LAN core switches, then proceed according to... coordinates decrease sequentially The rule is to place the unplaced Zone I non-terminal LAN core switches / Zone II non-terminal LAN core switches in the idle coordinates in sequence; otherwise, ... Based on the coordinates of the deployed Zone I non-terminal LAN core switch / Zone II non-terminal LAN core switch with the smallest coordinates, according to... coordinates decrease sequentially The rules are followed to place the unplaced Zone I non-terminal LAN core switches / Zone II non-terminal LAN core switches in the correct order.

[0030] The layout of the non-terminal management switch includes:

[0031] Traverse the non-terminal LAN management switches in the LAN management switch group of Zone I, to The largest existing non-terminal LAN core switch in Zone I with the highest coordinates. Based on coordinates, according to Coordinates are , coordinates increase sequentially The rules are as follows: non-terminal LAN management switches in Zone I are placed sequentially; among them, This indicates the core switch of the non-terminal LAN in Zone I that has been deployed. coordinate;

[0032] Traverse the non-terminal LAN management switches in the LAN management switch group of Zone II, to The largest existing non-terminal LAN core switch in Zone II with the highest coordinates. Based on coordinates, according to Coordinates are , coordinates increase sequentially The rules are followed to place the non-terminal LAN management switches in Zone II in sequence;

[0033] The layout of the non-terminal general-purpose switch includes:

[0034] Recursively search for other asset groups in Zone I and Zone II LANs that are connected to the already placed Zone I non-terminal LAN core switches and Zone II non-terminal LAN core switches, obtaining their weights. Using the coordinates of the already placed Zone I non-terminal LAN core switches and Zone II non-terminal LAN core switches as a reference, proceed according to the child-first, then parent-first... coordinates decrease sequentially The rules are as follows: ordinary switches in Zone I non-terminal LAN / ordinary switches in Zone II non-terminal LAN are placed sequentially; the weight is used to describe the number of connection hops of the switch.

[0035] Recursively search for non-terminal LAN ordinary switches in Zone I / Zone II that are connected to the firewalls in the Zone I-II LAN firewall group within other asset groups of Zone I / Zone II LAN, and obtain their weights. Using the coordinates of the already deployed Zone I-II LAN firewalls as a reference, proceed according to the child-first, then parent order. coordinates decrease sequentially The rules are as follows: place the non-terminal LAN ordinary switches in Zone I / non-terminal LAN ordinary switches in Zone II in sequence.

[0036] Recursively search for the connection relationships between non-terminal LAN ordinary switches not deployed in other asset groups of Zone I LAN / other asset groups of Zone II LAN, and obtain the weights of non-terminal LAN ordinary switches in Zone I / non-terminal LAN ordinary switches in Zone II; Based on the coordinates of the smallest deployed non-terminal LAN ordinary switch in Zone I / Non-terminal LAN, the order is child-first, then parent-first. coordinates decrease sequentially The rules are as follows: place the non-terminal LAN ordinary switches in Zone I / non-terminal LAN ordinary switches in Zone II in sequence.

[0037] Recursively search for the connection relationships between non-terminal backbone network ordinary switches in the Zone I backbone network ordinary switch group / Zone II backbone network ordinary switch group, in order to Based on the coordinates of the deployed Zone I non-terminal LAN management switch / Zone II non-terminal LAN management switch with the largest coordinates, the order is determined by first the parent and then the child switches. coordinates increase sequentially The rules are as follows: place the non-terminal backbone network ordinary switches in Zone I / non-terminal backbone network ordinary switches in Zone II in sequence.

[0038] Optionally, the topology skeleton asset offset includes:

[0039] Traverse all placed non-terminal switches, and move the non-terminal switches in Zone I along... Offset along the negative axis, shifting the non-terminal switch in Zone II along... Offset in the positive direction of the axis, the offset amount is ;in, This indicates the weight of the non-terminal switch. This indicates the preset offset for different weights. This indicates a preset offset for the same weight. Indicates the sequence number of non-terminal switches with the same weight. This indicates that the last weight is The cumulative offset of the non-terminal switch.

[0040] Optionally, all the remaining asset deployments include:

[0041] Traverse the placed non-terminal switches in the first and second order respectively. Find with Unplaced assets with connections to each other within the same security zone and network type are grouped based on the number of connections and asset type. The maximum number of unplaced assets per row within a group is `maxRow`. Indicates the first The traversed non-terminal switches include non-terminal core switches, non-terminal management switches, and non-terminal ordinary switches.

[0042] Sort each group from smallest to largest based on the number of connections in each group, and assign cross-group row index values ​​and column index values ​​to the assets in each group;

[0043] by coordinates Based on this, all remaining assets are placed in order of row and column index values, with asset coordinates as follows: ;in, Indicates preset Axis offset value, Indicates the column index value. Indicates the row index value;

[0044] The first order is according to Coordinates from 0 to The non-terminal switches are traversed in the order of smallest coordinates, with the first order being... Coordinates from 0 to The non-terminal switches that have been placed are traversed in order of their largest coordinates.

[0045] Optionally, the graph-partition-based topology layout optimization includes:

[0046] The GN algorithm based on modularity optimization is used to automatically partition the already deployed network topology, resulting in multiple tightly connected sub-network groups.

[0047] The sub-network groups obtained from the segmentation are abstracted into super nodes to construct a super graph, and a hierarchical layout algorithm is used to globally arrange the super graph.

[0048] Secondly, the present invention provides an alarm tracing method, based on the intelligent network spatial topology construction method for integrating multi-source data as described in any one of the first aspects, comprising:

[0049] Based on the JSON data and alarm data, the alarm topology node ID related to the alarm is obtained through the alarm service, and alarm source tracing is performed to obtain the complete alarm attack path;

[0050] The complete alarm attack path is highlighted on the interactive and visual topology map, enabling intuitive visualization of the attack chain.

[0051] Optionally, the alarm data is used to describe security events or abnormal activities that occur in the network, and each alarm data record includes the initiating asset ID, the affected asset ID, the alarm type, and the alarm content;

[0052] The alarm types include malware infection, password brute-force, and host scanning;

[0053] The alarm content includes a timestamp, severity level, and detailed description;

[0054] The step involves obtaining the alarm topology node ID related to the alarm through the alarm service based on the topology diagram and alarm data, and performing alarm source tracing to obtain the complete alarm attack path, including:

[0055] Iterate through each alarm record in the alarm data and extract the initiating asset ID and the affected asset ID.

[0056] Match the initiating asset ID and the affected asset ID in the JSON data to locate the corresponding topology node, obtain the alarm topology node ID, and generate an alarm-node mapping list; the alarm topology node ID includes the initiating node ID and the affected node ID;

[0057] Based on the alarm-node mapping list, with the initiating node as the starting point of the path and the affected node as the ending point of the path, the shortest path search is performed in the topology graph using the Dijkstra algorithm or the A* algorithm to obtain the alarm attack path for each alarm record.

[0058] Compared with existing technologies, the beneficial effects achieved by this invention are as follows:

[0059] 1. Using physical connection data as one of the core inputs, the mapping service directly lays out the network based on these actual connections through a series of algorithms (such as asset grouping, switch location calculation, and connection hierarchy adjustment). This allows the generated topology map to show the actual interconnection between devices (e.g., which server is specifically connected to which port group of which switch). When a physical link failure occurs, maintenance personnel can accurately locate the problem based on this map without having to consult separate, potentially outdated cabling tables, greatly improving troubleshooting efficiency and maintenance accuracy.

[0060] 2. A unique approach combining alert analysis services with high-fidelity physical topology. The alert analysis service utilizes precise node and connection relationships within the topology JSON to execute an alert tracing and pathfinding algorithm, calculating the shortest path from the originating asset to the affected asset. This allows the front-end not only to highlight alert points but also to dynamically render the entire attack path (including all connections along the way). This effect links isolated alerts into a clear attack storyline, enabling security analysts to readily identify the attack's entry point, lateral movement path, and final target, thereby facilitating precise containment and response. This elevates network security from passive alerting to a new level of proactive analysis.

[0061] 3. Power industry standards are deeply integrated into the data model (defining security zone fields) and layout algorithms (security zone correction, layout of switches by security zone, and calculation of firewall locations). The algorithm automatically and correctly assigns devices to zones and visually clearly separates and associates horizontal and vertical security devices such as Zone I, Zone II, and cross-zone firewalls, generating a professional topology diagram that meets power industry regulatory requirements and operational habits, filling the technological gap in automated mapping in this field. Attached Figure Description

[0062] Figure 1 This is a flowchart of a method for constructing an intelligent network spatial topology that integrates multi-source data, according to an embodiment of the present invention.

[0063] Figure 2 This is a diagram showing the asset grouping results provided according to an embodiment of the present invention;

[0064] Figure 3 This is a diagram showing the layout result of a topology skeleton firewall according to an embodiment of the present invention;

[0065] Figure 4 This is a diagram showing the layout result of the topology skeleton switch according to an embodiment of the present invention;

[0066] Figure 5 This is a diagram showing the topology skeleton asset offset results provided according to an embodiment of the present invention;

[0067] Figure 6 This is a layout diagram of all remaining assets provided according to an embodiment of the present invention;

[0068] Figure 7 This is a schematic diagram of the topology layout before optimization based on graph segmentation according to an embodiment of the present invention;

[0069] Figure 8 This is a schematic diagram of the optimized topology layout based on graph segmentation according to an embodiment of the present invention;

[0070] Figure 9 An interactive, visualized topology diagram provided according to an embodiment of the present invention. Detailed Implementation

[0071] The technical solution of the present invention will be described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the embodiments and specific features in the embodiments are detailed descriptions of the technical solution of the present application, rather than limitations thereof. In the absence of conflict, the embodiments and technical features in the embodiments can be combined with each other.

[0072] It should be noted that the term "and / or" in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. Additionally, the character " / " in this article generally indicates that the preceding and following related objects have an "or" relationship.

[0073] Example 1

[0074] This invention discloses a method for constructing an intelligent network spatial topology by integrating multi-source data, with reference to... Figure 1 As shown, the specific steps include the following:

[0075] S1, based on asset data and physical connection relationship data, sequentially performs asset grouping, topology skeleton firewall layout, topology skeleton switch layout, topology skeleton asset offset, layout of all remaining assets, and topology layout optimization based on graph segmentation through physical mapping service to obtain a JSON data that can completely describe the topology structure;

[0076] S2, based on the JSON data, a visual topology map is rendered in the browser using a WebGL-based front-end rendering engine, and events are added to the visual topology map through event-driven processing to support users in dragging and editing the topology, resulting in an interactive visual topology map.

[0077] Specifically, in step S1, basic data is collected, including asset data and physical connection relationship data; the asset data is used to describe all physical devices in the network, and each asset data record includes:

[0078] Asset ID: A unique identifier for an asset;

[0079] Full name of the asset: The complete name of the asset;

[0080] Asset Abbreviation: The abbreviation or common name of an asset, used for label display in the topology diagram;

[0081] Asset IP: The primary IP address of the asset, used for network communication and alarm association;

[0082] Asset type: Identifies the type of asset, such as: firewall, switch, router, server, workstation, monitoring device, security equipment, etc.; switches include management switches, core switches, and general switches;

[0083] Security Zone: Identifies the security zone to which an asset belongs, following the power system security zoning standard, and its values ​​are: Zone I, Zone II, Zone I-II.

[0084] Region: Identifies the physical or logical region to which an asset belongs, such as a thermal power plant or a power station;

[0085] Network type: Identifies the type of network to which the asset is connected, such as: local area network, backbone network, etc.

[0086] Physical connectivity data describes the physical link connections between network devices. Each physical connectivity record includes:

[0087] Source Asset ID: Identifies the asset ID at the beginning of the connection line;

[0088] Destination Asset ID: Identifies the asset ID at the end of the connection line;

[0089] Source Asset Security Zone: The security zone to which the source asset belongs, with the same value as the "Security Zone" field in the asset data;

[0090] Target Asset Security Zone: The security zone to which the target asset belongs, with the same value as the "Security Zone" field in the asset data;

[0091] Connection Status: Indicates the current status of the connection relationship, used to support incremental updates and topology maintenance. Its values ​​are: Added, Confirmed, Deleted.

[0092] In step S1.1, refer to Figure 2 As shown, based on the power network's unique principle of "security zoning and dedicated network," this embodiment organizes network security assets according to their logical location and function within the power monitoring system using a dual-dimensional grouping method. The asset grouping specifically includes:

[0093] 1) Grouping by network type: First, divide the assets into local area network (LAN) groups and backbone network groups. The LAN groups carry internal company business, while the backbone network groups are responsible for vertical connectivity.

[0094] 2) Subdivided by security zone and asset type: In the LAN group, strictly following the power monitoring system security zoning standard, it is further subdivided into: Zone I LAN core switch group, Zone I LAN management switch group, Zone I LAN other asset group, Zone I-II LAN firewall group, Zone II LAN core switch group, Zone II LAN management switch group, and Zone II LAN other asset group;

[0095] The backbone network group is further subdivided into: Zone I backbone network general switch group, Zone I backbone network other asset group, Zone II backbone network general switch group, and Zone II backbone network other asset group.

[0096] In this embodiment, assets with only one connection and a switch at the other end are classified as terminal assets, and all other assets are classified as non-terminal assets.

[0097] In step S1.2, in this embodiment, the firewall group of the I-II zone LAN is arranged vertically on the central axis of the topology diagram, with a preset starting coordinate. Based on, along The firewalls are placed sequentially along the positive axis (downwards). Their layout coordinates are calculated using the following deterministic formula: for the [number]th firewall in the firewall list... Each device, its coordinates satisfy Among them, among them, This indicates the first firewall group in the I-II zone LAN. The coordinates of the firewall, This indicates the firewall serial number in the LAN firewall group of Zone I-II. This represents the preset vertical spacing constant. The algorithm steps are as follows: First, initialize the parameters and read all LAN firewall groups in zones I and II; then, traverse the list, directly apply the above formula to calculate and assign precise planar coordinates to each firewall. This process results in... Figure 3 The layout shown depicts all firewalls arranged vertically on the left side of the canvas, thus establishing the central axis of the security framework for the entire power network topology.

[0098] In step S1.3, the switch layout is the core link in constructing the power network topology skeleton. The topology skeleton switch layout of this embodiment profoundly reflects the business characteristics of the power industry's connection relationship data "collecting network security data with switches as the core". In terms of layout strategy, it realizes the key transformation from general graph structure to power-specific topology. The overall layout concept is to use the vertically arranged firewall group as the central axis, and arrange the selected non-terminal switches vertically on one side of the axis, thereby forming a topology skeleton that clearly represents the hierarchical relationship of the power network.

[0099] refer to Figure 4 As shown, the topology backbone switch layout uses the existing firewall columns as a spatial reference. Zone I is located to the left of the firewall in Zone I-II (negative X-axis direction), and Zone II is located to the right of the firewall in Zone I-II (positive X-axis direction). Together, they form a comb-like basic structure with clear semantics—the firewall acts as the ridge to establish the security boundary, and the switches act as the teeth to represent the network backbone, thus forming a preliminary topology backbone that conforms to the logic of power services; specifically including:

[0100] S1.3.1, Layout of non-terminal core switches:

[0101] Iterate through each firewall in the Zone I-II LAN firewall group, and place the non-terminal LAN core switches of the Zone I LAN core switch group that are directly connected to that firewall on the left side of the corresponding firewall. Coordinates are , coordinates Decrease sequentially from the base The non-terminal LAN core switches of the Zone II LAN core switch group, which are directly connected to the firewall, are placed sequentially on the right side of the corresponding firewall. Coordinates are , coordinates Decrease sequentially from the base ;in, This represents the x-coordinate of the firewall in Zones I and II. This represents the vertical coordinate of the firewall in Zones I and II. and Indicates the preset offset value;

[0102] Traverse the unplaced non-terminal LAN core switches in Zone I LAN core switch group / Zone II LAN core switch group. If there are idle coordinates between the placed Zone I non-terminal LAN core switches / Zone II non-terminal LAN core switches, then proceed according to... coordinates decrease sequentially The rule is to place the unplaced Zone I non-terminal LAN core switches / Zone II non-terminal LAN core switches in the idle coordinates in sequence; otherwise, ... Based on the coordinates of the deployed Zone I non-terminal LAN core switch / Zone II non-terminal LAN core switch with the smallest coordinates, according to... coordinates decrease sequentially The rules are followed to place the unplaced Zone I non-terminal LAN core switches / Zone II non-terminal LAN core switches in the correct order.

[0103] S1.3.2, Layout of Non-Terminal Management Switch:

[0104] Traverse the non-terminal LAN management switches in the LAN management switch group of Zone I, to The largest existing non-terminal LAN core switch in Zone I with the highest coordinates. Based on coordinates, according to Coordinates are , coordinates increase sequentially The rules are as follows: non-terminal LAN management switches in Zone I are placed sequentially; among them, This indicates the core switch of the non-terminal LAN in Zone I that has been deployed. coordinate;

[0105] Traverse the non-terminal LAN management switches in the LAN management switch group of Zone II, to The largest existing non-terminal LAN core switch in Zone II with the highest coordinates. Based on coordinates, according to Coordinates are , coordinates increase sequentially The rules are followed to place the non-terminal LAN management switches in Zone II in sequence;

[0106] S1.3.3, Layout of non-terminal general-purpose switches:

[0107] Recursively search for other asset groups in Zone I and Zone II LANs that are connected to the already placed Zone I non-terminal LAN core switches and Zone II non-terminal LAN core switches, obtaining their weights. Using the coordinates of the already placed Zone I non-terminal LAN core switches and Zone II non-terminal LAN core switches as a reference, proceed according to the child-first, then parent-first... coordinates decrease sequentially The rules are as follows: ordinary switches in Zone I non-terminal LAN / ordinary switches in Zone II non-terminal LAN are placed sequentially; the weight is used to describe the number of connection hops of the switch.

[0108] Recursively search for non-terminal LAN ordinary switches in Zone I / Zone II that are connected to the firewalls in the Zone I-II LAN firewall group within other asset groups of Zone I / Zone II LAN, and obtain their weights. Using the coordinates of the already deployed Zone I-II LAN firewalls as a reference, proceed according to the child-first, then parent order. coordinates decrease sequentially The rules are as follows: place the non-terminal LAN ordinary switches in Zone I / non-terminal LAN ordinary switches in Zone II in sequence.

[0109] Recursively search for the connection relationships between non-terminal LAN ordinary switches not deployed in other asset groups of Zone I LAN / other asset groups of Zone II LAN, and obtain the weights of non-terminal LAN ordinary switches in Zone I / non-terminal LAN ordinary switches in Zone II; Based on the coordinates of the smallest deployed non-terminal LAN ordinary switch in Zone I / Non-terminal LAN, the order is child-first, then parent-first. coordinates decrease sequentially The rules are as follows: place the non-terminal LAN ordinary switches in Zone I / non-terminal LAN ordinary switches in Zone II in sequence.

[0110] Recursively search for the connection relationships between non-terminal backbone network ordinary switches in the Zone I backbone network ordinary switch group / Zone II backbone network ordinary switch group, in order to Based on the coordinates of the deployed Zone I non-terminal LAN management switch / Zone II non-terminal LAN management switch with the largest coordinates, the order is determined by first the parent and then the child switches. coordinates increase sequentially The rules are as follows: place the non-terminal backbone network ordinary switches in Zone I / non-terminal backbone network ordinary switches in Zone II in sequence.

[0111] In step S1.4, refer to Figure 5 As shown, after completing the initial vertical layout of the non-terminal switches, this embodiment uses a refined topology skeleton asset offset algorithm to optimize the visualization of the topology structure. This algorithm ensures clear identification of network connections through multi-level offset calculations. The offset principle is as follows: offsets are made according to the connection weights of the switches, with slight offsets for switches of the same weight; Zone I is offset to the left, and Zone II is offset to the right. Specifically, this includes:

[0112] Traverse all placed non-terminal switches, and move the non-terminal switches in Zone I along... Offset along the negative axis, shifting the non-terminal switch in Zone II along... Offset in the positive direction of the axis, the offset amount is ;in, This indicates the weight of the non-terminal switch. This indicates the preset offset for different weights. This indicates a preset offset for the same weight. Indicates the sequence number of non-terminal switches with the same weight. This indicates that the last weight is The cumulative offset of the non-terminal switch.

[0113] In step S1.5, after completing the construction and offset optimization of the switch skeleton, the next step is the layout phase for other types and remaining switches, where the remaining assets are mounted below the horizontal bus of the switches. The core task of this phase is to rationally place all remaining assets within the established topology skeleton to form a complete power network topology. (Refer to...) Figure 6 As shown, it specifically includes:

[0114] Traverse the placed non-terminal switches in the first and second order respectively. Find with Unplaced assets with connections to each other within the same security zone and network type are grouped based on the number of connections and asset type. The maximum number of unplaced assets per row within a group is `maxRow`. Indicates the first The traversed non-terminal switches include non-terminal core switches, non-terminal management switches, and non-terminal ordinary switches.

[0115] Sort each group from smallest to largest based on the number of connections in each group, and assign cross-group row index values ​​and column index values ​​to the assets in each group;

[0116] by coordinates Based on this, all remaining assets are placed in order of row and column index values, with asset coordinates as follows: ;in, Indicates preset Axis offset value, Indicates the column index value. Indicates the row index value;

[0117] The first order is according to Coordinates from 0 to The non-terminal switches are traversed in the order of smallest coordinates, with the first order being... Coordinates from 0 to The non-terminal switches that have been placed are traversed in order of their largest coordinates.

[0118] In step S1.6, after completing the basic topology layout, a large number of switches can lead to excessive vertical space expansion, severely affecting the visualization effect. (Refer to...) Figure 7 As shown; to address this problem, this embodiment proposes a graph-partition-based topology layout optimization solution, which significantly improves space efficiency through intelligent grouping and rearrangement, referencing Figure 8 As shown; specifically including:

[0119] The Girvan-Newman algorithm (GN algorithm) based on modularity optimization is used to automatically partition the already laid out network topology. This algorithm divides the complex network into multiple tightly connected sub-network groups by iteratively calculating the betweenness centrality of each edge in the network and prioritizing the removal of the connection with the highest betweenness centrality. The characteristic of this partitioning process is that it is entirely based on the connection topology of the network and does not change the relative positional relationships and visual attributes of the nodes within each sub-network group, thus maintaining the original local layout unchanged.

[0120] The resulting sub-network groups are abstracted as supernodes to construct a supergraph, and a hierarchical layout algorithm (Sugiyama Algorithm) is used to globally arrange the supergraph. This algorithm determines the optimal position of each supernode in the global coordinate system through three steps: hierarchical allocation, cross-cutting reduction, and coordinate mapping. Finally, a translation transformation is used to place the sub-network groups, preserving their internal layout, into the calculated specified positions, achieving a visual reorganization of the overall topology.

[0121] This solution maintains the integrity of the topological logic while improving the visualization efficiency of the hierarchical relationship of the network structure by about 50%, providing a professional and reliable solution for the visualization analysis of power network security.

[0122] In step S2, refer to Figure 9 As shown, this embodiment uses the WebGL-based graphics rendering engine G6 as the core rendering technology to achieve smooth rendering of large-scale network nodes and connections on the browser side; its specific implementation includes:

[0123] Data conversion: Convert the topology JSON data output by the physical mapping service into a graph data format that can be recognized and rendered by the G6 engine;

[0124] Power-themed customization: All node icons do not use general graphics, but instead use a dedicated icon library for power network security. For example, specific icons are used to distinguish firewalls, switches, servers, workstations, and power-specific equipment (such as vertical encryption devices), making the topology diagram conform to industry understanding and highly professional.

[0125] Advanced connection processing: To solve the visual confusion caused by line intersections in complex topologies, the system performs special rendering processing at the line intersection points, drawing a circular node at the intersection point to clearly distinguish different connection lines and effectively avoid misreading caused by line overlap.

[0126] To enable flexible adjustment and maintenance of the topology graph, this embodiment adds event editing functionality by adding a series of mouse event listeners to the node elements in the topology graph, including:

[0127] Drag and drop events: The system binds mouse events (mousedown, mousemove, mouseup) to each node; when the user presses the mouse button on a node, the system records the initial position; when the mouse moves, the node's coordinates are updated in real time to the current mouse position, thus achieving the drag-follow effect of the node; mousedown indicates pressing the mouse button, mouseup indicates releasing the mouse button, and mousemove indicates moving the mouse.

[0128] Real-time recalculation of connections: During the drag-and-drop process, the core advantage of this embodiment is that it can automatically recalculate the paths of all connections connected to the node in real time; the engine will not simply drag the node and cause the connection to be distorted, but will dynamically update the control points of the connection to ensure that the connection line remains a visually straight line (or a preset curved shape) during and after the drag-and-drop process, thereby ensuring the cleanliness and accuracy of the topology map during the editing process.

[0129] Example 2:

[0130] Based on the same inventive concept as Embodiment 1, this embodiment of the invention discloses an alarm tracing method, which is based on the intelligent network spatial topology construction method for fusing multi-source data as described in any one of Embodiment 1, including:

[0131] S1. Based on the JSON data and alarm data, obtain the alarm topology node ID related to the alarm through the alarm service, and perform alarm source tracing to obtain the complete alarm attack path;

[0132] S2, Highlight the complete alarm attack path on the interactive visual topology map to achieve intuitive visualization of the attack chain.

[0133] In step S1, the alarm data is used to describe security events or abnormal activities occurring in the network, and each alarm data record includes:

[0134] Initiating Asset ID: One or more asset IDs that may have initiated this alert event or attack;

[0135] Affected Asset ID: One or more asset IDs that are directly affected by this alert event;

[0136] Alarm type: Describe the type of alarm, such as "malware infection", "password brute force", "host scan", etc.

[0137] Alarm content: A detailed description of the alarm, including timestamp, severity level, and specific description.

[0138] The alarm analysis service receives topology JSON data and real-time alarm data generated by the physical mapping service. Through correlation analysis and path calculation, it accurately locates and visualizes isolated alarm events within the topology context, enabling a leap from simply seeing an alarm to understanding the attack. Specifically, this includes:

[0139] Iterate through each alarm record in the alarm data and extract the initiating asset ID and the affected asset ID.

[0140] Match the initiating asset ID and the affected asset ID in the JSON data to locate the corresponding topology node, obtain the alarm topology node ID, and generate an alarm-node mapping list. This list clearly records which topology nodes initiated alarms and which topology nodes were affected, providing accurate target data for the front end to perform animation rendering such as highlighting and blinking. The alarm topology node ID includes the initiating node ID and the affected node ID.

[0141] Based on the alarm-node mapping list, with the initiating node as the starting point of the path and the affected node as the ending point of the path, the shortest path search is performed in the topology graph using the Dijkstra algorithm or the A* algorithm to obtain the alarm attack path for each alarm record.

[0142] In step S2, to transform abstract alarm data into intuitive visual threat signals, this embodiment comprehensively utilizes the native capabilities of the graphics engine and CSS animations to implement a multi-layered, highly expressive alarm animation system, specifically including:

[0143] G6 Engine Core Motion Effects: Utilizing the built-in node and edge state update function of the G6 engine, basic alarm visualization is achieved;

[0144] Color change: When alarm data is received, the system will dynamically switch the color of the corresponding topology node to the color corresponding to the alarm level (e.g., red for critical alarms and orange for warnings).

[0145] Image switching: For alarm nodes, their icons can be dynamically replaced with special images with warning indicators (such as exclamation marks) to further enhance visual cues;

[0146] Enhanced Rendering with CSS Animation: To achieve complex dynamic effects that are difficult to achieve with native G6 functionality, this embodiment innovatively combines CSS animation with WebGL rendering. On the Canvas layer rendered by G6, corresponding topological nodes are covered by HTML DOM elements, and CSS animations are applied to these DOM elements. These CSS animations can produce extremely eye-catching visual effects, including but not limited to: high-frequency flashing, breathing pulses, diffusion ripples, and border flow. This combined technology makes the alarm status no longer a simple static color change, but a dynamic and unmissable visual focus.

[0147] Attack path highlighting: For attack paths calculated by the alarm analysis service, the system highlights all the lines on the path in red (or a specified color), and can also add CSS flowing animations to clearly present the attacker's attack movement path to the operation and maintenance personnel, greatly improving the efficiency of alarm tracing and analysis.

[0148] In summary, the intelligent network spatial topology construction method and alarm tracing method that integrate multi-source data proposed in this embodiment have the following beneficial effects:

[0149] Compared with existing topology generation techniques based on static template matching, this invention, through its complete technical solution, achieves significant technological advancements in topology realism, automation, domain applicability, and security analysis value. Specific effects are as follows:

[0150] 1. The generated topology map is highly realistic, accurately reflecting the physical network structure and solving the problem of the disconnect between the logical view and physical reality. Traditional technologies only match assets and template virtual nodes by keywords, completely ignoring the physical connections between devices. The generated topology map is essentially a logical view and cannot reflect the actual network cabling. This method uses physical connection data as one of the core inputs and directly lays out the network based on these real connections through a series of algorithms (such as asset grouping, switch location calculation, and connection level adjustment) in the mapping service. This allows the generated topology map to show the actual interconnection between devices (such as which server is specifically connected to which port group of which switch). When a physical link failure occurs, maintenance personnel can accurately locate the problem based on this map without having to consult separate, potentially outdated cabling tables, greatly improving troubleshooting efficiency and maintenance accuracy.

[0151] 2. Possessing in-depth security analysis capabilities, this method elevates alerts from isolated events to traceable attack chains, addressing the pain point of visible alerts but unclear paths. Traditional methods can only display alert nodes in isolation on the topology, preventing security analysts from quickly understanding how attackers moved from point A to point B, i.e., lacking attack path prediction capabilities. This method uniquely combines alert analysis services with high-fidelity physical topology. The alert analysis service utilizes precise node and connection relationships in the topology JSON to execute alert tracing and pathfinding algorithms, calculating the shortest path from the originating asset to the affected asset. This allows the front-end not only to highlight alert points but also to dynamically render the entire attack path (including all connections along the way). This effect links isolated alerts into a clear attack storyline, enabling security analysts to readily identify the attack entry point, lateral movement path, and final target, thereby enabling precise containment and response, elevating network security from passive alerting to a new level of proactive analysis.

[0152] 3. This method achieves professional and practical topology visualization for specific industries such as power. General templates cannot express the unique security zone (Zone I, Zone II) concept and equipment logic of power systems, and there is no mature automatic topology generation solution for power network security protection. This method deeply integrates power industry standards into the data model (defining security zone fields) and layout algorithms (security zone correction, layout of switches by security zone, and calculation of firewall positions). Through algorithms, it automatically and correctly classifies devices into zones and visually clearly separates and associates horizontal and vertical security devices such as Zone I, Zone II, and cross-zone firewalls, generating a professional topology map that meets the regulatory requirements and operation and maintenance habits of the power industry, filling the technical gap in automated mapping in this field.

[0153] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0154] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0155] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0156] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0157] The embodiments of the present invention have been described above with reference to the accompanying drawings. However, the present invention is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of the present invention without departing from the spirit and scope of the claims. All of these forms are within the protection scope of the present invention.

Claims

1. A method for constructing an intelligent network spatial topology by integrating multi-source data, characterized in that, include: Based on asset data and physical connection relationship data, the physical mapping service sequentially performs asset grouping, topology skeleton firewall layout, topology skeleton switch layout, topology skeleton asset offset, layout of all remaining assets, and topology layout optimization based on graph segmentation to obtain a JSON data that can completely describe the topology structure. Based on the JSON data, a visual topology map is rendered in the browser using a WebGL-based front-end rendering engine. Events are then added to the visual topology map via event-driven processing to allow users to drag and drop and edit the topology, resulting in an interactive visual topology map.

2. The intelligent network spatial topology construction method integrating multi-source data according to claim 1, characterized in that, The asset data is used to describe all physical devices in the network. Each asset data record includes asset ID, full asset name, abbreviation of asset, asset IP, asset type, security zone, region, and network type. The asset types include hosts, firewalls, switches, monitoring devices, and security equipment; The switches include management switches, core switches, and general-purpose switches; The security zone includes Zone I, Zone II, and Zone I-II; The network types include local area networks (LANs) and backbone networks; The physical connection relationship data is used to describe the physical link connection status between network devices. Each physical connection relationship record includes source asset ID, destination asset ID, source asset security zone, destination asset security zone, and connection status. The source asset ID represents the asset ID at the beginning of the connection relationship; The destination asset ID represents the asset ID at the termination end of the connection relationship; The connection status indicates the current state of the connection relationship, including newly added, confirmed, and deleted.

3. The intelligent network spatial topology construction method integrating multi-source data according to claim 2, characterized in that, The asset groupings include: Based on the network type of the assets, all assets are divided into local area network groups and backbone network groups; For all assets in a LAN group, they are divided into Zone I LAN core switch group, Zone I LAN management switch group, Zone I LAN other asset group, Zone I-II LAN firewall group, Zone II LAN core switch group, Zone II LAN management switch group, and Zone II LAN other asset group according to the security zone and asset type. All assets within the backbone network group are divided into four groups based on their security zone and asset type: Zone I backbone network general switch group, Zone I backbone network other asset group, Zone II backbone network general switch group, and Zone II backbone network other asset group. Assets with only one connection and whose peer is a switch are classified as terminal assets, and all other assets are classified as non-terminal assets.

4. The intelligent network spatial topology construction method integrating multi-source data according to claim 3, characterized in that, The topology skeleton firewall layout includes: For each firewall in the LAN firewall group of Zone I-II, starting at a preset coordinate... Based on this, place firewalls sequentially according to the following formula: ， in, This indicates the first firewall group in the I-II zone LAN. The coordinates of the firewall, This indicates the firewall serial number in the LAN firewall group of Zone I-II. This represents the preset vertical spacing constant.

5. The method for constructing intelligent network spatial topology by integrating multi-source data according to claim 4, characterized in that, The topology backbone switch layout includes a non-terminal core switch layout, a non-terminal management switch layout, and a non-terminal general switch layout. The non-terminal core switch layout includes: Iterate through each firewall in the Zone I-II LAN firewall group, and place the non-terminal LAN core switches of the Zone I LAN core switch group that are directly connected to that firewall on the left side of the corresponding firewall. Coordinates are , coordinates Decrease sequentially from the base The non-terminal LAN core switches of the Zone II LAN core switch group, which are directly connected to the firewall, are placed sequentially on the right side of the corresponding firewall. Coordinates are , coordinates Decrease sequentially from the base ;in, This represents the x-coordinate of the firewall in Zones I and II. This represents the vertical coordinate of the firewall in Zones I and II. and Indicates the preset offset value; Traverse the unplaced non-terminal LAN core switches in Zone I LAN core switch group / Zone II LAN core switch group. If there are idle coordinates between the placed Zone I non-terminal LAN core switches / Zone II non-terminal LAN core switches, then proceed according to... coordinates decrease sequentially The rule is to place the unplaced Zone I non-terminal LAN core switches / Zone II non-terminal LAN core switches in the idle coordinates in sequence; otherwise, ... Based on the coordinates of the deployed Zone I non-terminal LAN core switch / Zone II non-terminal LAN core switch with the smallest coordinates, according to... coordinates decrease sequentially The rules are followed to place the unplaced Zone I non-terminal LAN core switches / Zone II non-terminal LAN core switches in the correct order. The layout of the non-terminal management switch includes: Traverse the non-terminal LAN management switches in the LAN management switch group of Zone I, to The largest existing non-terminal LAN core switch in Zone I with the highest coordinates. Based on coordinates, according to Coordinates are , coordinates increase sequentially The rules are as follows: non-terminal LAN management switches in Zone I are placed sequentially; among them, This indicates the core switch of the non-terminal LAN in Zone I that has been deployed. coordinate; Traverse the non-terminal LAN management switches in the LAN management switch group of Zone II, to The largest existing non-terminal LAN core switch in Zone II with the highest coordinates. Based on coordinates, according to Coordinates are , coordinates increase sequentially The rules are followed to place the non-terminal LAN management switches in Zone II in sequence; The layout of the non-terminal general-purpose switch includes: Recursively search for other asset groups in Zone I and Zone II LANs that are connected to the already placed Zone I non-terminal LAN core switches and Zone II non-terminal LAN core switches, obtaining their weights. Using the coordinates of the already placed Zone I non-terminal LAN core switches and Zone II non-terminal LAN core switches as a reference, proceed according to the child-first, then parent-first... coordinates decrease sequentially The rules are as follows: ordinary switches in Zone I non-terminal LAN / ordinary switches in Zone II non-terminal LAN are placed sequentially; the weight is used to describe the number of connection hops of the switch. Recursively search for non-terminal LAN ordinary switches in Zone I / Zone II that are connected to the firewalls in the Zone I-II LAN firewall group within other asset groups of Zone I / Zone II LAN, and obtain their weights. Using the coordinates of the already deployed Zone I-II LAN firewalls as a reference, proceed according to the child-first, then parent order. coordinates decrease sequentially The rules are as follows: place the non-terminal LAN ordinary switches in Zone I / non-terminal LAN ordinary switches in Zone II in sequence. Recursively search for the connection relationships between non-terminal LAN ordinary switches not deployed in other asset groups of Zone I LAN / other asset groups of Zone II LAN, and obtain the weights of non-terminal LAN ordinary switches in Zone I / non-terminal LAN ordinary switches in Zone II; Based on the coordinates of the smallest deployed non-terminal LAN ordinary switch in Zone I / Non-terminal LAN, the order is child-first, then parent-first. coordinates decrease sequentially The rules are as follows: place the non-terminal LAN ordinary switches in Zone I / non-terminal LAN ordinary switches in Zone II in sequence. Recursively search for the connection relationships between non-terminal backbone network ordinary switches in the Zone I backbone network ordinary switch group / Zone II backbone network ordinary switch group, in order to Based on the coordinates of the deployed Zone I non-terminal LAN management switch / Zone II non-terminal LAN management switch with the largest coordinates, the order is determined by first the parent and then the child switches. coordinates increase sequentially The rules are as follows: place the non-terminal backbone network ordinary switches in Zone I / non-terminal backbone network ordinary switches in Zone II in sequence.

6. The method for constructing intelligent network spatial topology by integrating multi-source data according to claim 5, characterized in that, The topology skeleton asset offset includes: Traverse all placed non-terminal switches, and move the non-terminal switches in Zone I along... Offset along the negative axis, shifting the non-terminal switch in Zone II along... Offset in the positive direction of the axis, the offset amount is ;in, This indicates the weight of the non-terminal switch. This indicates the preset offset for different weights. This indicates a preset offset for the same weight. Indicates the sequence number of non-terminal switches with the same weight. This indicates that the last weight is The cumulative offset of the non-terminal switch.

7. The method for constructing intelligent network spatial topology by integrating multi-source data as described in claim 6, characterized in that, All other asset allocations include: Traverse the placed non-terminal switches in the first and second order respectively. Find with Unplaced assets with connections to each other within the same security zone and network type are grouped based on the number of connections and asset type. The maximum number of unplaced assets per row within a group is `maxRow`. Indicates the first The traversed non-terminal switches include non-terminal core switches, non-terminal management switches, and non-terminal ordinary switches. Sort each group from smallest to largest based on the number of connections in each group, and assign cross-group row index values ​​and column index values ​​to the assets in each group; by coordinates Based on this, all remaining assets are placed in order of row and column index values, with asset coordinates as follows: ;in, Indicates preset Axis offset value, Indicates the column index value. Indicates the row index value; The first order is according to Coordinates from 0 to The non-terminal switches are traversed in the order of smallest coordinates, with the first order being... Coordinates from 0 to The non-terminal switches that have been placed are traversed in order of their largest coordinates.

8. The method for constructing intelligent network spatial topology by fusing multi-source data according to claim 7, characterized in that, The graph-based topology layout optimization includes: The GN algorithm based on modularity optimization is used to automatically partition the already deployed network topology, resulting in multiple tightly connected sub-network groups. The sub-network groups obtained from the segmentation are abstracted into super nodes to construct a super graph, and a hierarchical layout algorithm is used to globally arrange the super graph.

9. An alarm source tracing method, characterized in that, The intelligent network spatial topology construction method based on any one of claims 1 to 8, which integrates multi-source data, includes: Based on the JSON data and alarm data, the alarm topology node ID related to the alarm is obtained through the alarm service, and alarm source tracing is performed to obtain the complete alarm attack path; The complete alarm attack path is highlighted on the interactive and visual topology map, enabling intuitive visualization of the attack chain.

10. The method for constructing intelligent network spatial topology by integrating multi-source data according to claim 9, characterized in that, The alarm data is used to describe security events or abnormal activities that occur in the network. Each alarm data record includes the initiating asset ID, the affected asset ID, the alarm type, and the alarm content. The alarm types include malware infection, password brute-force, and host scanning; The alarm content includes a timestamp, severity level, and detailed description; The step involves obtaining the alarm topology node ID related to the alarm through the alarm service based on the topology diagram and alarm data, and performing alarm source tracing to obtain the complete alarm attack path, including: Iterate through each alarm record in the alarm data and extract the initiating asset ID and the affected asset ID. Match the initiating asset ID and the affected asset ID in the JSON data to locate the corresponding topology node, obtain the alarm topology node ID, and generate an alarm-node mapping list; the alarm topology node ID includes the initiating node ID and the affected node ID; Based on the alarm-node mapping list, with the initiating node as the starting point of the path and the affected node as the ending point of the path, the shortest path search is performed in the topology graph using the Dijkstra algorithm or the A* algorithm to obtain the alarm attack path for each alarm record.

Images