A network security information big data analysis system capable of comparing historical data

Abstract

This invention relates to the fields of network security and big data analytics, specifically to a network security information big data analytics system capable of comparing historical data. The system includes: a historical baseline extraction module, used to acquire real-time security data containing the current data node and corresponding long-term historical security baseline data, generating the anomaly weight and risk density of the current data node; a visual cognitive assessment module, communicatively connected to the historical baseline extraction module, generating adaptive visual adjustment instructions; a cognitively driven adaptive rendering module, communicatively connected to the visual cognitive assessment module, generating a dynamic security map after cognitive denoising; and a spatiotemporal evolution dynamic rendering module, communicatively connected to the cognitively driven adaptive rendering module, based on a three-dimensional evolution holographic view presenting long-term attack paths. This invention avoids visual overload for analysts caused by massive concurrent data volumes.

Description

Technical Field

[0001] This invention relates to the fields of network security and big data analytics, specifically to a network security information big data analytics system that can compare historical data. Background Technology

[0002] Network security big data analysis systems are a crucial link in addressing complex network threats, and their data processing and visualization efficiency directly impacts analysts' threat perception speed. These systems primarily access real-time security data and long-term historical baseline data, using comparisons of computing node characteristics and evolution paths to trace the source of covert attacks. Optimizing the visual presentation mechanism of massive amounts of data, reducing cognitive load, and accurately capturing long-term covert risks have become key research directions in the security field. Existing technologies mainly rely on conventional rules for instantaneous comparison of absolute thresholds, failing to fully exploit the small differences accumulated by temporal dynamic mismatches, making them unsuitable for monitoring low-frequency, slow penetration and long-term covert attacks. Furthermore, the use of single absolute value evaluation and static chart displays makes it difficult to reconstruct the spatiotemporal evolution logic of long-term attack chains, and cannot effectively address the monitoring blind spots caused by uniform penetration evasion. In addition, the massive concurrent rendering environment of nodes has extremely high visual complexity, and existing technologies struggle to scientifically quantify visual cognitive bandwidth bottlenecks, exhibiting visual occlusion defects caused by the stacking of massive redundant data, which can easily lead to visual overload and decision distortion for analysts, especially in scenarios with extremely large concurrent data volumes. Therefore, a solution is urgently needed to address the problems existing in current technologies. Summary of the Invention

[0003] The purpose of this invention is to provide a big data analysis system for network security information that can compare historical data, and to solve the following technical problems:

[0004] By introducing physical information entropy to quantify visual load and combining temporal dynamic mismatch accumulation and nonlinear spatial rendering technology, the problem of visual overload for analysts and difficulty in detecting long-term covert attack features caused by rendering massive historical comparison data is solved, realizing accurate capture and intuitive spatiotemporal tracing of covert security risks in complex network topologies.

[0005] The objective of this invention can be achieved through the following technical solutions:

[0006] A big data analysis system for cybersecurity information that can compare historical data, the system comprising:

[0007] The historical baseline extraction module is used to acquire real-time security data containing the current data node and the corresponding long-term historical security baseline data, calculate the deviation of the current data node from the long-term historical security baseline data to extract hidden features, and generate the anomaly weight and risk density of the current data node.

[0008] The visual cognition assessment module communicates with the historical baseline extraction module to obtain the visual complexity parameters of the map to be rendered and the analyst's interactive behavior flow, calculates the information entropy of the current view, and generates an adaptive visual adjustment instruction if the information entropy is not less than a preset cognitive threshold.

[0009] The cognitive-driven adaptive rendering module is connected to the visual cognitive assessment module. Based on the abnormal weight, the risk density and the adaptive visual adjustment instruction, the current data node is divided into normal data nodes and abnormal data nodes. The normal data nodes are visually folded and aggregated, and the abnormal data nodes are processed with nonlinear spatial distortion and high-contrast material or dynamic particle effects to generate a dynamic safety map after cognitive noise reduction.

[0010] The spatiotemporal evolution dynamic rendering module communicates with the cognitive-driven adaptive rendering module. Based on the abnormal data nodes, it extracts long-cycle attack paths, obtains time-series comparison data slices of the long-cycle attack paths from history to the present, uses time as the third dimension and spline interpolation algorithm to generate graphic evolution animation, and presents a three-dimensional evolution holographic view of the long-cycle attack paths.

[0011] In one possible implementation, the historical baseline extraction module includes:

[0012] The data acquisition unit is used to acquire real-time network traffic or log data as the real-time security data, and the corresponding long-term historical security baseline data.

[0013] A deviation calculation unit, connected to the data acquisition unit, is used to calculate the difference between the feature value of the current data node and the feature distribution of the long-term historical safety baseline data using a time series analysis model, so as to obtain the deviation of the current data node from the long-term historical safety baseline data.

[0014] The feature extraction unit, connected to the deviation calculation unit, is used to extract hidden features where the deviation is less than a preset deviation threshold in a single instance but the deviation is greater than or equal to a preset cumulative threshold in the long term.

[0015] The weight generation unit, connected to the feature extraction unit, is used to generate the anomaly weight and risk density for each current data node based on the hidden features.

[0016] In one possible implementation, the visual cognition assessment module includes:

[0017] The parameter acquisition unit is used to acquire the visual complexity parameters of node density, edge crossover rate, and color disorder of the graph to be rendered.

[0018] The behavior flow acquisition unit is used to acquire the interactive behavior flow of the analyst, such as the frequency of mouse hover or the number of zooms.

[0019] The information entropy calculation unit, connected to the parameter acquisition unit and the behavior flow acquisition unit, is used to construct a visual cognitive load model based on the visual complexity parameter and the interaction behavior flow, and to calculate the information entropy of the current view in real time by calculating the distribution probability of each visual element in the current view.

[0020] The instruction generation unit, connected to the information entropy calculation unit, is used to generate the adaptive visual adjustment instruction when the information entropy is greater than or equal to the preset cognitive threshold.

[0021] In one possible implementation, the cognitive-driven adaptive rendering module includes:

[0022] The data receiving unit is used to receive the anomaly weight, the risk density, and the adaptive visual adjustment instruction;

[0023] The folding aggregation unit, connected to the data receiving unit, is used to fold the normal data nodes into semi-transparent macro background clusters using a community-based node merging graph aggregation algorithm.

[0024] A spatial distortion unit, connected to the data receiving unit, is used to apply nonlinear spatial distortion, such as fisheye magnification or gravitational lensing effect, to the abnormal data node, thereby increasing the visual distance between the abnormal data node and the normal data node.

[0025] The special effects processing unit, connected to the space distortion unit, is used to give the abnormal data nodes high-contrast material or dynamic particle effects.

[0026] The map generation unit is connected to the folding and aggregation unit and the special effects processing unit, and is used to generate the dynamic security map after cognitive noise reduction.

[0027] In one possible implementation, the spatiotemporal evolution dynamic rendering module includes:

[0028] A path extraction unit is used to extract the long-cycle attack path based on the abnormal data nodes.

[0029] The slice acquisition unit, connected to the path extraction unit, is used to acquire the time-series comparison data slices of the long-cycle attack path from history to the present.

[0030] An animation generation unit, connected to the slice acquisition unit, is used to generate the graphic evolution animation by using time as the third dimension and the spline interpolation algorithm.

[0031] The view presentation unit, connected to the animation generation unit, is used to present the three-dimensional evolution holographic view of the long-cycle attack path.

[0032] In one possible implementation, the visual cognitive assessment module is also used for:

[0033] When the information entropy is less than the preset cognitive threshold and greater than or equal to the preset minimum cognitive threshold, the rendering state of the current view remains unchanged.

[0034] When the information entropy is less than the preset minimum cognitive threshold, a prompt instruction is generated to remind the analyst that there may be missing data or rendering anomalies.

[0035] In one possible implementation, the anomaly weight is calculated by weighted summation based on the cumulative value of the deviation and the rate of change of the deviation; the risk density is calculated by multiplying the anomaly weight by an amplification factor consisting of the out-degree connection number of the current data node.

[0036] In one possible implementation, the opacity of the semi-transparent macro background cluster is dynamically adjusted inversely to the product of the number of nodes contained in the macro background cluster and the risk density.

[0037] The beneficial effects of this invention are:

[0038] 1) This invention calculates the deviation of the long-term baseline of the current node through the historical baseline extraction module, and extracts the hidden features that have small single deviations but accumulate to a preset threshold over a long period of time. This mechanism breaks through the limitations of the traditional instantaneous comparison of absolute thresholds, effectively mines the small differences accumulated by temporal dynamic mismatch, and realizes accurate monitoring of low-frequency slow penetration and long-term covert attacks.

[0039] 2) This invention generates anomaly weights and risk densities based on the cumulative value of deviation and the rate of change, and uses the spline interpolation algorithm of the spatiotemporal evolution dynamic rendering module to generate a three-dimensional evolution holographic view of long-cycle attack paths; this mechanism breaks the limitation of single static evaluation, reconstructs the spatiotemporal evolution logic of the attack chain, and effectively eliminates the monitoring blind spots caused by uniform penetration evasion.

[0040] 3) This invention calculates information entropy based on visual complexity parameters and interactive behavior flow to quantify cognitive bottlenecks, and drives adaptive rendering to fold normal nodes into background clusters with dynamically adjusted opacity, while performing nonlinear spatial distortion and special effects processing on abnormal nodes; this eliminates visual occlusion caused by massive redundant data and avoids visual overload for analysts caused by a large amount of concurrent data. Attached Figure Description

[0041] The invention will now be further described with reference to the accompanying drawings.

[0042] Figure 1 This is a schematic diagram of a network security information big data analysis system that can compare historical data, provided in an embodiment of this application. Detailed Implementation

[0043] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0044] Please see Figure 1 This embodiment provides an overall operating mechanism for a network security information big data analysis system that can compare historical data; after the system starts, the historical baseline extraction module accesses the data stream and obtains a set containing multiple current data nodes. Real-time security data, synchronously retrieve corresponding long-term historical security baseline data. ;

[0045] The historical baseline extraction module compares and calculates the deviation between the current data node and the long-term historical safety baseline data. It extracts hidden features that are difficult to detect by conventional rules and assigns abnormal weights to each current data node. and risk density The visual cognition assessment module monitors the front-end rendering status in real time, extracts the visual complexity parameters of the graph to be rendered in the current view and the analyst's interaction behavior flow, and constructs a mathematical model to calculate the information entropy of the current view. ;

[0046] The visual cognition assessment module determines information entropy. Greater than or equal to the preset cognitive threshold At that time, adaptive visual adjustment instructions are generated; the cognitive-driven adaptive rendering module receives abnormal weights. Risk density And adaptive visual adjustment instructions, based on abnormal weights and risk density Divide the current data nodes into normal data nodes and abnormal data nodes;

[0047] For normal data nodes, the cognitive-driven adaptive rendering module performs visual folding and aggregation of spatial coordinates in the image generation layer. At the same time, it applies a non-linear spatial distortion matrix to visually magnify abnormal data nodes and overlays high-contrast materials or dynamic particle effects to output a dynamic safety map after cognitive noise reduction.

[0048] The spatiotemporal evolution dynamic rendering module extracts long-cycle attack paths based on abnormal data nodes. Obtain long-term attack paths Time-series comparative data slices at different historical timestamps , time Mapped to the third dimension in a three-dimensional coordinate system, spline interpolation algorithm is used to smoothly connect the time-series comparative data slices. Data breakpoints are used to generate graphical evolution animations to present long-cycle attack paths. A three-dimensional evolutionary holographic view;

[0049] In scenarios involving covert order-brushing and low-frequency data crawling monitoring during e-commerce promotions, when the system accesses API call logs that last for several months, analysts face the risk of visual overload if tens of millions of historical comparison nodes are directly rendered.

[0050] The visual cognitive assessment module perceived high information entropy. The cognitive-driven adaptive rendering module folds a large number of normal transaction nodes into the background, and spatially warps and pulls in the very few abnormal terminal nodes that show hidden crawling behavior. The spatiotemporal evolution dynamic rendering module generates a three-dimensional evolution holographic view, replaying the process of the crawler gradually penetrating and obtaining core commodity price data over the past few months.

[0051] The non-obvious improvement of this mechanism lies in introducing the theory of physical information entropy into the calculation of visual load. Through the cascade mechanism of dynamic noise reduction and visual focusing, it ensures that long-term hidden security risks are revealed in massive historical comparison data, and verifies the robustness of the system's visual presentation in extremely high-concurrency business scenarios.

[0052] In a preferred embodiment of the present invention, this embodiment elaborates in detail the cascade mechanism of data processing and covert feature extraction within the historical baseline extraction module; the data acquisition unit collects real-time network traffic or log data as real-time security data, and simultaneously acquires the corresponding long-term historical security baseline data;

[0053] The deviation calculation unit uses a time series analysis model to extract the feature values ​​of the current data node in a specific dimension. Calculate the mean of its characteristic distribution compared to long-term historical safety baseline data. The difference is used to determine the deviation of the current data node from the long-term historical safety baseline data. ;

[0054] Feature extraction unit determines single deviation Less than the preset deviation threshold When this is done, it is included in the time-series sliding window to calculate the cumulative value of long-term deviation. ;

[0055] When the feature extraction unit determines the cumulative value of the deviation. Greater than or equal to the preset cumulative threshold At that time, the hidden features of the node with low frequency and slow speed are extracted; the weight generation unit generates the abnormal weight and risk density of each current data node based on the hidden features; in the above processing, the time series analysis model performs periodic sampling and extraction of network features of specific dimensions such as data packet length and request frequency;

[0056] In calculating the cumulative value of long-term deviation At that time, the time-series sliding window maintains a fixed-length first-in-first-out queue to carry historical observation states; the system will process each instance of data generated within the window that is less than the deviation threshold. Single deviation Push each element into the queue one by one, and sum the values ​​of all valid elements in the queue to obtain the cumulative deviation value. ;

[0057] To maintain data freshness and prevent the calculation results from overflowing indefinitely, the queue implements a strict first-in, first-out (FIFO) queue update strategy: as the latest timestamp data is pushed in, once the queue reaches its maximum length, the oldest historical deviation value is forcibly removed from the queue, and the current accumulated deviation value is used instead. Simultaneous deduction and offsetting will be carried out;

[0058] This sliding accumulation mechanism based on queue boundary management not only transforms low-frequency, slow, and scattered differences into quantifiable long-term accumulated indicators, but also more effectively constructs a memory overflow prevention mechanism for finite-time integrators, ensuring that the determination of hidden features is always based on the effective threat flux within the most recent observation period.

[0059] Furthermore, to prevent the extremely small basis deviations generated by high-concurrency normal business traffic from rapidly filling the aforementioned fixed-length queue, which would cause low-frequency covert attack features to be prematurely removed from the queue and become ineffective, the feature extraction unit, in addition to processing single deviations... A dynamic basis filtering mechanism is executed before pushing the data into the queue.

[0060] The system calculates the mean of the current network noise in real time, only when a single deviation occurs. Less than the preset deviation threshold Only when the value is significantly greater than the mean of the base noise is it considered a valid suspected feature and added to the queue.

[0061] Regular background fluctuations that are lower than or equal to the mean of the floor noise are directly discarded. Through this signal-to-noise ratio-based queue admission cleaning, the time-series sliding window can filter out massive amounts of invalid background traffic, ensuring that the queue memory is always used to carry low-frequency abnormal features with potential threat increments.

[0062] In the scenario of monitoring minor tampering with the core ledgers of multinational financial institutions, the attack terminal sends only a very small number of encrypted probe packets to overseas nodes each day, and the single feature value... The deviation is far below the preset threshold for regular alarms. ;

[0063] The feature extraction unit calculates the cumulative value of long-term deviation by capturing small fluctuations over several consecutive weeks. Exceeding the preset cumulative threshold The design successfully extracted hidden features and generated a high-level risk density. It breaks through the limitations of traditional instantaneous comparison with absolute thresholds. By accumulating small differences through temporal dynamic mismatch, it accurately captures long-term covert network attacks and demonstrates excellent feature capture robustness in complex network topologies.

[0064] In a preferred embodiment of the present invention, this embodiment provides a computational mechanism for a visual cognitive assessment module to quantify the cognitive load on an analyst caused by a rendered graph; a parameter acquisition unit scans the video memory in real time to obtain the node density of the rendered graph. Edge cross rate and color disorder Visual complexity parameters;

[0065] Regarding node density Edge cross rate and color disorder Each corresponding preset physical limit value is set as the normalization denominator benchmark, and a linear mapping mechanism is used for normalization, with the average value taken as the objective load base. Specifically, for node density and edge crossover rate, the preset physical limit value is the physical pixel limit corresponding to the maximum supported resolution of the current display; for color scrambling... The preset physical limit value is the maximum bit depth color level supported by the display device;

[0066] The behavior flow acquisition unit monitors the input device and acquires the analyst's mouse hover frequency. or number of scaling times The interactive behavior flow; the information entropy calculation unit constructs a visual cognitive load model based on visual complexity parameters and interactive behavior flow, and calculates the distribution probability of each visual element in the current view. Real-time calculation of the information entropy of the current view ;

[0067] When the information entropy calculation unit obtains the information entropy Greater than or equal to the preset cognitive threshold At that time, the instruction generation unit generates adaptive visual adjustment instructions; when constructing the visual cognitive load model, this model does not use a complex neural network, but decomposes the visual load into an objective visual crowding dimension, namely node density. Edge cross rate Color confusion , and the subjective cognitive disorientation dimension, namely hovering frequency Scaling times ;

[0068] To avoid the numerical equivalence error caused by simple multiplication—that is, to avoid misjudging the same probability as objectively extremely crowded but no operations versus objectively not crowded but frequent operations—the probability distribution is used. The calculation logic adopts segmented business logic: the parameters of the visual crowding dimension are normalized by a linear mapping mechanism. The physical pixel limit corresponding to the maximum supported resolution of the current display is set as the normalization denominator for node density and edge cross rate, and the average value is taken as the objective load base.

[0069] The parameters of the cognitive disorientation dimension are also normalized and the average value is taken as the subjective load multiplier. If the objective load base is determined to be greater than 0.8 and the subjective load multiplier is less than 0.1, it indicates that the analyst has fallen into a stagnant state of visual cognitive overload. At this time, the initial load score of the visual element is forcibly assigned a very large preset penalty value to ensure that subsequent noise reduction is triggered.

[0070] In other normal intervals, the objective load base and subjective load multiplier are weighted and summed, such as assigning a weight of 0.6 to objective and 0.4 to subjective, to obtain the initial load score of the visual element; to ensure that the mathematical premises of classical information theory are met, the system applies weights to all elements in the current view. The first visual element undergoes global normalization, that is, the first... The initial load score of each visual element divided by all The sum of the initial load scores of each visual element is used to derive a probability distribution that strictly satisfies the condition that the sum is 1. ;

[0071] To prevent the denominator from being zero due to all elements scoring zero in extreme cases, the system forcibly adds a minimal constant to the normalized denominator for numerical stability protection; information entropy Then, classical information theory logic is used for calculation:

[0072]

[0073] in, For indexing visual elements, This represents the total number of visual elements contained in the current view. For the first The probability distribution of each visual element occupying an analyst's cognitive bandwidth. To determine the summation sign, we use the probability distribution of all visual elements. Find the negative sum of the product of the logarithm and the probability to quantify the degree of chaos in the global view;

[0074] Preset cognitive threshold It is not a static constant, but rather dynamically calibrated during system initialization based on the statistical average of cognitive load limits from analysts' historical eye-tracking test data; in the scenario of troubleshooting abnormal commands in the industrial control network of a large logistics hub, when the historical states of hundreds of thousands of sensor nodes are rendered on the same screen, the view exhibits an extremely high edge overlap rate. and color disorder Analysts exhibited a high frequency of mouse hovering. and scaling times ;

[0075] The information entropy calculation unit integrates objective visual parameters with subjective operational behavior to calculate the information entropy. Exceeding the cognitive threshold The instruction generation unit then issues adaptive visual adjustment instructions. The non-obvious improvement of this mechanism lies in the dimensionality reduction coupling and segmentation constraint of human engineering interaction indicators and graphics parameters, which scientifically quantifies the visual cognitive bandwidth bottleneck and provides a reliable triggering basis for subsequent adaptive noise reduction, effectively avoiding decision distortion caused by the evaluation of the number of single nodes.

[0076] In a preferred embodiment of the present invention, this embodiment describes the graphics rendering steps of primitive dimensionality reduction and visual focusing performed by the cognitive-driven adaptive rendering module based on cognitive load feedback; the data receiving unit receives abnormal weights, risk density and adaptive visual adjustment instructions; the folding and aggregation unit uses a node merging graph aggregation algorithm based on community discovery to fold normal data nodes with low risk density into semi-transparent macro background clusters.

[0077] The spatial distortion unit employs nonlinear spatial distortion, either fisheye magnification or gravitational lensing, on anomalous data nodes with high outlier weights. This nonlinear expansion within the local coordinate system increases the visual distance between anomalous and normal data nodes. The special effects processing unit applies high-contrast materials or dynamic particle effects to abnormal data nodes.

[0078] The graph generation unit merges layers to generate a dynamic security graph after cognitive noise reduction. In the node merging graph aggregation algorithm based on community discovery, the system uses the communication connection frequency between normal data nodes as the edge weight. When the internal communication frequency between a group of nodes is significantly higher than their communication frequency with external nodes, the algorithm summarizes the group of nodes into the same close community, calculates the spatial coordinate centroid of all nodes in the community, and replaces it as a macroscopic background cluster primitive.

[0079] When performing nonlinear space warping with gravitational lensing effect, the space warping unit defines a fixed gravitational radius with the anomalous data node as the center point; for normal data nodes that fall within this radius, the system constructs spatial repulsion logic based on the Euclidean distance between their original coordinates and the center point.

[0080] To avoid wasting computational resources on meaningless calculations of tiny displacements of nodes across the entire graph, the repulsive displacement is strictly set to 0 when the Euclidean distance is greater than or equal to the radius of gravitational influence.

[0081] For nodes within the radius, the specific repulsion calculation did not use the time-consuming fluid dynamics equations. Instead, it directly used the natural base as the base, took the negative value of the ratio of the Euclidean distance to the radius of gravitational action to construct an exponentially decaying multiplier, and used this exponentially decaying multiplier as the basic transitional term for subsequent displacement calculations.

[0082] Furthermore, in order to solve the problem of screen tearing caused by the direct truncation at the boundary of the gravitational radius, which causes the displacement to suddenly change from non-zero to zero, the system calculates the above-mentioned exponential decay multiplier, then forcibly subtracts the basic decay constant under the boundary critical state, that is, the negative first power of the natural base, and uses the result as the final effective repulsion coefficient.

[0083] The magnitude of the displacement is equal to the maximum repulsion base multiplied by the effective repulsion coefficient, thus ensuring that the node displacement decays smoothly outward and converges continuously and seamlessly to an absolute zero value when reaching the boundary of the gravitational radius. The maximum repulsion base is not a fixed constant, but is dynamically calculated inversely proportional to the zoom level of the current view. That is, the more macroscopic the view, the larger the required number of physical pixels for repulsion, ensuring a clear visual separation between abnormal and normal data nodes. ;

[0084] In particular, to prevent normal data nodes from exactly coinciding with the coordinates of abnormal data nodes, i.e., the Euclidean distance is strictly 0, which would lead to a computational singularity where the geometric direction of outward repulsion cannot be determined, the system forcibly introduces a minimal perturbation vector containing pseudo-random angles to determine the repulsion direction under this critical state.

[0085] Through this physical distance mapping model with clear boundary truncation and anti-overlapping perturbation compensation, the system forcibly and smoothly excludes the surrounding irrelevant nodes, expanding the visual space for abnormal data nodes.

[0086] In the scenario of multi-tenant network isolation escape monitoring in cloud computing platforms, facing millions of virtual machine nodes, the folding aggregation unit converges most of the normally operating tenant nodes into a semi-transparent macro background cluster, the spatial distortion unit applies a gravitational lensing effect to the few abnormal data nodes that attempt cross-domain access to perform nonlinear spatial distortion, and the special effects processing unit adds high-contrast materials to them.

[0087] The dynamic security map output by the map generation unit, after cognitive noise reduction, retains the global network physical topology while stripping away irrelevant data interference through extreme visual contrast. This design, through a non-linear rendering mechanism that separates spatial distortion and visual folding, forcibly guides the analyst's attention to high-risk threat areas, demonstrating high availability in a massive concurrent rendering environment.

[0088] In a preferred embodiment of the present invention, this embodiment provides a construction step for a spatiotemporal evolution dynamic rendering module to transform static two-dimensional comparison results into a dynamic three-dimensional spatiotemporal evolution holographic view; the path extraction unit extracts long-period attack paths based on abnormal data nodes. The slice acquisition unit obtains long-cycle attack paths. Time-series data slices comparing history to the present The animation generation unit will time As a third dimension, spline interpolation algorithm is used to slice adjacent time-series comparative data. The coordinates and states between them are smoothly interpolated mathematically to generate a graphic evolution animation; the view presentation unit presents a long-cycle attack path. A three-dimensional evolutionary holographic view;

[0089] In the specific interpolation process, due to the time-series comparison of data slices The generation of animation typically depends on discrete security log timestamps, resulting in significant time gaps between two slices. The animation generation unit uses a cubic spline function to construct a time-based 3D coordinate system for the same anomalous data node in different slices. The equation is a continuous polynomial equation with independent variables; this equation requires that the position coordinates, movement speed (first derivative), and acceleration (second derivative) at adjacent time data points remain continuously equal.

[0090] By solving this equation, the system can calculate the virtual three-dimensional coordinates at any tiny time segment between two real discrete log time points. This interpolation design based on kinematic smoothing constraints transforms discrete, jumping data logs into smooth trajectories that conform to the inertia of real physical motion. In the scenario of tracing the incubation and spread of ransomware within a large medical institution's intranet, the slice acquisition unit extracts time-series comparison data slices of the ransomware over several months. Animation generation units are based on time. As the third dimension, spline interpolation algorithm is used to fill in the data gaps between discrete logs and generate a graphical evolution animation;

[0091] The 3D evolution holographic view output by the view presentation unit intuitively shows the lateral movement trajectory of the abnormal node from the peripheral department workstation to the core image database; this technology breaks the time limitation of static charts and reconstructs the causal logic of long-cycle attack chains through multi-dimensional spatial interpolation animation mechanism, providing security analysts with a highly continuous spatiotemporal tracing perspective.

[0092] In a preferred embodiment of the present invention, this embodiment supplements the abnormal boundary handling and state maintenance mechanism of the visual cognition assessment module; the visual cognition assessment module in information entropy Less than the preset cognitive threshold And greater than or equal to the preset minimum cognitive threshold When the current view rendering state remains unchanged, the underlying computing power allocation is optimized; when the visual cognition assessment module determines the information entropy... Less than the preset minimum cognitive threshold At that time, a prompt instruction is generated to alert the analyst that there may be missing data or rendering anomalies;

[0093] In the scenario of troubleshooting data bus anomalies in a cross-regional power grid dispatch center, if the number of nodes in the monitoring view suddenly drops and there is a lack of interactive status, the visual perception assessment module calculates the information entropy. Falling below the preset minimum cognitive threshold The system then generates prompts and commands to drive the front end to issue alarms, prompting analysts to investigate issues such as interruption of historical baseline data streams or memory crashes. The in-situ construction of this mechanism effectively prevents defense loopholes caused by information overload and lack of information. By establishing a closed-loop cognitive load monitoring system through bidirectional threshold comparison, the system's robustness under extreme data fluctuation conditions is improved.

[0094] In a preferred embodiment of the present invention, this embodiment provides a numerical calculation step for scientifically quantifying anomaly weights and risk densities; the system extracts the cumulative value of deviation. And calculate the rate of change of deviation within the current time window. The preset cumulative system tolerance limit is the maximum allowable deviation threshold configured in the security policy within a unit period.

[0095] The extreme value of the maximum mutation rate in historical statistics is the maximum observed value of the rate of change of deviation recorded by the system in historical operating data. The cumulative value of the deviation is then considered. The normalized precipitation index is obtained by dividing the cumulative amount by the preset system tolerance limit. The rate of change of deviation Divide by the historical maximum mutation rate extreme value to obtain the normalized burst index. ;

[0096] In the specific calculation logic, the rate of change of deviation The method of obtaining the value is as follows: subtract the cumulative value of the deviation at the end of the current time window from the cumulative value of the deviation at the end of the previous time window, divide the difference by the absolute time span of the time window, and thus quantify the rate of change of threat evolution.

[0097] In abnormal weights In the calculation, a historical accumulation weighting coefficient was set. and instantaneous burst weighting coefficient Historical accumulation weighting coefficient Used to measure the severity of long-term latent threats, instantaneous outbreak weighting coefficient Used to measure the destructive power of short-term mutation behavior;

[0098] Furthermore, due to the cumulative value of the deviation... Historical accumulation representing absolute total amount, while the rate of change of deviation. The slope representing the increment per unit time has significant differences in physical dimensions and numerical magnitude. If linear weighting is directly applied, the larger numerical magnitude will completely mask the weighting effect of the other.

[0099] Therefore, before performing the weighted summation, the system forces both to undergo dimensional unification and normalization based on business benchmarks: the cumulative value of the deviation is... The normalized precipitation index is obtained by dividing the cumulative amount by the preset system tolerance limit. The rate of change of deviation Divide by the historical maximum mutation rate extreme value to obtain the normalized burst index. ;

[0100] The specific formula for weighted summation is as follows:

[0101]

[0102] in, This addresses anomalous weights; the mechanism eliminates weight ineffectiveness caused by dimensional misalignment; simultaneously, due to anomalous weights... It only reflects the degree of variation of the node itself, while risk density... To reflect the threat radiating to the surrounding topology, the system, in calculating risk density, introduces the out-degree connection number of the node in the current network topology—that is, the number of independent target nodes initiating connections outward—as an amplification factor, based on the aforementioned weighted summation. Specifically, the out-degree connection number is set to... Risk density The calculation formula is:

[0103]

[0104] in, These are abnormal weights. The number of out-degree connections. The preset topological radiation penalty coefficient; a constant. It serves as the base risk level, ensuring that when a node does not initiate any outward connections, the node's risk density equals the anomaly weight itself.

[0105] In real-world business scenarios, to balance slow penetration and sudden attacks, historical data weighting coefficients are used. It is usually set to 0.4 to ensure sensitivity to long-term minor anomalies; instantaneous burst weighting coefficient Set to 0.6 to emphasize rapid response to sudden high-concurrency attacks; preset topology radiation penalty coefficient. Usually set to ;

[0106] In the scenario of slow exhaustion attack monitoring of online payment gateways, the low-frequency connection establishment in the early stage by a malicious source node leads to the normalized sedimentation index. The normalized burst exponential index slowly rose to 0.5, then suddenly surged due to a spike in concurrent requests. It rose sharply to 0.8;

[0107] The system calculates the abnormal weights based on the aforementioned weighting coefficients. for If the malicious source node simultaneously launches probes to 5 different internal database interfaces, i.e., the outgoing degree connection count is 5, then its risk density is... Then magnified to This allows for precise scaling of the node's anomaly weight and risk density. The design introduces dynamic change rate and topological out-degree as joint evaluation factors, overcoming the shortcomings of single absolute value evaluation which is easily evaded by uniform and slow penetration. By integrating the total amount of historical anomalies, the current rate of change of anomalies, and the lateral radiation range, it achieves a dynamic and precise characterization of the threat level of covert attacks.

[0108] In a preferred embodiment of the present invention, this embodiment describes the refinement steps of adaptive rendering of the opacity of semi-transparent macro background clusters; the system counts the number of nodes contained in the macro background clusters. And extract its risk density. The opacity α of a semi-transparent macro-background cluster is related to the number of nodes contained in the macro-background cluster. and risk density The product is inversely proportional to the product and dynamically adjusted; the specific inverse proportional adjustment logic is achieved by introducing a visual attenuation constant. To achieve this, the calculation formula is:

[0109]

[0110] The denominator is incremented by 1 to prevent computational overflow when the product is zero; visual attenuation constant. This represents the upper limit of the baseline background visibility allowed by the system, and is usually set according to the contrast capability of the display device, for example, 0.8;

[0111] In the visual noise reduction scenario of conventional telemetry data on multinational automakers' connected vehicle platforms, when the telemetry nodes of hundreds of thousands of normally driving vehicles are aggregated into a macroscopic background cluster, the number of nodes... The risk density is extremely high, but since all vehicles are normal, the risk density is low. Extremely low, approaching 0, making the product term extremely small, at which point the opacity... Approaching the visual attenuation constant A value of 0.8 indicates a relatively clear background that does not cause visual interference;

[0112] Conversely, if a cluster has an extremely large number of nodes, and the risk density of normal data nodes within it is high... If the opacity is relatively high within the normal threshold range, the product term will increase moderately accordingly, and its opacity will be relatively high. The corresponding decrease will make it thinner, thereby further reducing the visual weight of the background cluster and preventing it from visually occluding the trajectories of surrounding high-risk abnormal nodes. This mechanism effectively eliminates the visual occlusion effect caused by the stacking of massive low-correlation redundant data, ensuring that the trajectories of high-risk abnormal nodes can penetrate the data background and be clearly displayed, verifying the visual optimization effect of the inverse proportional dynamic opacity calculation logic in complex topological layering environments.

[0113] The foregoing has provided a detailed description of one embodiment of the present invention, but this description is merely a preferred embodiment and should not be construed as limiting the scope of the invention. All equivalent variations and modifications made within the scope of the claims of this invention should still fall within the patent coverage of this invention.

Claims

1. A network security information big data analysis system capable of comparing historical data, characterized in that, The system includes: The historical baseline extraction module is used to acquire real-time security data containing the current data node and the corresponding long-term historical security baseline data, calculate the deviation of the current data node from the long-term historical security baseline data to extract hidden features, and generate the anomaly weight and risk density of the current data node. The visual cognition assessment module communicates with the historical baseline extraction module to obtain the visual complexity parameters of the map to be rendered and the analyst's interactive behavior flow, calculates the information entropy of the current view, and generates an adaptive visual adjustment instruction if the information entropy is not less than a preset cognitive threshold. The cognitive-driven adaptive rendering module is connected to the visual cognitive assessment module. Based on the abnormal weight, the risk density and the adaptive visual adjustment instruction, the current data node is divided into normal data nodes and abnormal data nodes. The normal data nodes are visually folded and aggregated, and the abnormal data nodes are processed with nonlinear spatial distortion and high-contrast material or dynamic particle effects to generate a dynamic safety map after cognitive noise reduction. The spatiotemporal evolution dynamic rendering module communicates with the cognitive-driven adaptive rendering module. Based on the abnormal data nodes, it extracts long-cycle attack paths, obtains time-series comparison data slices of the long-cycle attack paths from history to the present, uses time as the third dimension and spline interpolation algorithm to generate graphic evolution animation, and presents a three-dimensional evolution holographic view of the long-cycle attack paths.

2. The network security information big data analysis system capable of comparing historical data as described in claim 1, characterized in that, The historical baseline extraction module includes: The data acquisition unit is used to acquire real-time network traffic or log data as the real-time security data, and the corresponding long-term historical security baseline data. A deviation calculation unit, connected to the data acquisition unit, is used to calculate the difference between the feature value of the current data node and the feature distribution of the long-term historical safety baseline data using a time series analysis model, so as to obtain the deviation of the current data node from the long-term historical safety baseline data. The feature extraction unit, connected to the deviation calculation unit, is used to extract hidden features where the deviation is less than a preset deviation threshold in a single instance but the deviation is greater than or equal to a preset cumulative threshold in the long term. The weight generation unit, connected to the feature extraction unit, is used to generate the anomaly weight and risk density for each current data node based on the hidden features.

3. The network security information big data analysis system capable of comparing historical data as described in claim 1, characterized in that, The visual cognition assessment module includes: The parameter acquisition unit is used to acquire the visual complexity parameters of node density, edge crossover rate, and color disorder of the graph to be rendered. The behavior flow acquisition unit is used to acquire the interactive behavior flow of the analyst, such as the frequency of mouse hover or the number of zooms. The information entropy calculation unit, connected to the parameter acquisition unit and the behavior flow acquisition unit, is used to construct a visual cognitive load model based on the visual complexity parameter and the interaction behavior flow, and to calculate the information entropy of the current view in real time by calculating the distribution probability of each visual element in the current view. The instruction generation unit, connected to the information entropy calculation unit, is used to generate the adaptive visual adjustment instruction when the information entropy is greater than or equal to the preset cognitive threshold.

4. A network security information big data analysis system capable of comparing historical data as described in claim 1, characterized in that, The cognitive-driven adaptive rendering module includes: The data receiving unit is used to receive the anomaly weight, the risk density, and the adaptive visual adjustment instruction; The folding aggregation unit, connected to the data receiving unit, is used to fold the normal data nodes into semi-transparent macro background clusters using a community-based node merging graph aggregation algorithm. A spatial distortion unit, connected to the data receiving unit, is used to apply nonlinear spatial distortion, such as fisheye magnification or gravitational lensing effect, to the abnormal data node, thereby increasing the visual distance between the abnormal data node and the normal data node. The special effects processing unit, connected to the space distortion unit, is used to give the abnormal data nodes high-contrast material or dynamic particle effects. The map generation unit is connected to the folding and aggregation unit and the special effects processing unit, and is used to generate the dynamic security map after cognitive noise reduction.

5. A network security information big data analysis system capable of comparing historical data as described in claim 1, characterized in that, The spatiotemporal evolution dynamic rendering module includes: A path extraction unit is used to extract the long-cycle attack path based on the abnormal data nodes. The slice acquisition unit, connected to the path extraction unit, is used to acquire the time-series comparison data slices of the long-cycle attack path from history to the present. An animation generation unit, connected to the slice acquisition unit, is used to generate the graphic evolution animation by using time as the third dimension and the spline interpolation algorithm. The view presentation unit, connected to the animation generation unit, is used to present the three-dimensional evolution holographic view of the long-cycle attack path.

6. A network security information big data analysis system capable of comparing historical data according to claim 1, characterized in that, The visual cognition assessment module is also used for: When the information entropy is less than the preset cognitive threshold and greater than or equal to the preset minimum cognitive threshold, the rendering state of the current view remains unchanged. When the information entropy is less than a preset minimum cognitive threshold, a prompt instruction is generated to remind the analyst that there may be missing data or rendering anomalies.

7. A network security information big data analysis system capable of comparing historical data as described in claim 1, characterized in that, The anomaly weight is calculated by weighted summation based on the cumulative value of the deviation and the rate of change of the deviation; the risk density is calculated by multiplying the anomaly weight by an amplification factor consisting of the out-degree connection number of the current data node.

8. A network security information big data analysis system capable of comparing historical data according to claim 4, characterized in that, The opacity of the semi-transparent macro background cluster is dynamically adjusted inversely to the product of the number of nodes contained in the macro background cluster and the risk density.

Images