A device for network risk assessment of 5G private network

Abstract

A method and device for network risk assessment of a 5G private network relate to the field of information technology. The present invention is composed of a private network dynamic risk identification module, a private network environmental risk identification module and a private network comprehensive risk assessment module; the private network dynamic risk identification module is composed of a private network data collection and analysis submodule, a private network data association submodule and a private network risk identification submodule; the private network environmental risk identification module is composed of a private network vulnerability identification submodule and a private network environmental risk identification submodule. The present invention identifies the network security risks existing in the 5G private network through risk events in signaling and user plane traffic, terminal and server vulnerabilities, private network data management and control, the impact of terminal offline on business and terminal environmental risks, and provides risk warnings.

Description

Technical Field

[0001] The present invention relates to the field of information technology. Background Art

[0002] my country's fifth-generation mobile communication technology 5G license has been issued for three years. As of early June 2022, the three major operators have built more than 5,000 5G private networks, according to public materials, completing the 5G Sailing Plan goal ahead of schedule. At this development speed, coupled with the continuous maturity of the 5G industry ecosystem and the decline in costs, the scale of 5G industrial Internet will usher in explosive growth.

[0003] The industrial Internet has become one of the important parts of the 5G system's Internet of Everything. Manufacturing terminals can not only share the big data and cloud resources of the mobile Internet, but also interact with information in the industrial Internet through mobile windows anywhere and at any time, truly integrating the industrial Internet into mobile e-commerce.

[0004] While enterprises are enjoying the dividends of 5G plus industrial Internet, they must also be aware of the changes and risks that come with the introduction of new technologies: the IP addresses assigned to industrial equipment in the industrial intranet remain unchanged; while the IP addresses of 5G terminals will change when they access the 5G network through the IP assigned by UPF; 5G+Industrial Internet breaks the original industrial "white" environment, and the boundary between industry and the outside becomes blurred; after malicious terminals obtain the private network configuration, they can access 5G industry applications and even enterprise data centers to conduct horizontal attacks. The network security of 5G+Industrial Internet is challenged; malicious terminals attempt to register through gNB, which may cause the resources of gNB to be exhausted and affect the normal business of 5G+Industrial Internet; 5G+Industrial Internet introduces new terminals, such as remote-controlled AGV cars and high-definition industrial cameras / cameras. The types of equipment are diverse and most of the equipment is unattended outdoors, and the equipment is less reliable. It is easy to cause machine-card separation and allow malicious terminals to access the network, resulting in network security incidents of the private network; strengthening the network risk assessment of 5G private networks is of great significance to improving the security level of enterprises and promoting the healthy development of 5G private networks and their ecosystems.

[0005] Currently, network risk assessment for the industrial Internet is mostly done by detecting and identifying security risks in industrial terminals themselves, and obtaining network security risks through log correlation analysis of security products; 5G private networks do not have the level of protection for the industrial Internet, and there are no supporting security products, so network security analysis cannot be performed from security logs, and industrial terminal risks cannot be detected through active detection technology. Network risk assessment needs to combine the characteristics of 5G and the industrial Internet.

[0006] Usually, the cybersecurity risk assessment of the industrial Internet is mostly carried out by reverse analysis of firmware defects and business logic vulnerabilities, obtaining data of industrial security protection equipment such as network gates / firewalls, and assessing the original risks of the industrial Internet. However, after the introduction of 5G private networks, the signaling and data planes do not have the hierarchical protection of the industrial Internet, there are no logs of conventional security products to analyze, and there is no analysis and assessment of the cybersecurity risk of 5G private networks from the perspectives of terminal vulnerabilities, data control conditions, the impact of terminal offline on business, and terminal environmental risks, resulting in limitations in the risk assessment results.

[0007] This technology introduces private network dynamic risk assessment methods and private network environment risk assessment methods, uses machine learning to establish a dynamic network risk baseline for 5G private networks, identifies high-risk 5G private network risk events from massive data, and improves the protection strategy of 5G private networks in a targeted manner.

[0008] Description of the prior art used

[0009] UPF user plane function is responsible for packet routing forwarding, policy implementation, traffic reporting, and QoS processing.

[0010] SMF session management function is responsible for tunnel maintenance, IP address allocation and management, UP function selection, policy implementation and QoS control, billing data collection, roaming, etc.

[0011] The N3 interface in the 5G network interface is located between the 5G access network and the user port function. It uses the GTP-U protocol and is mainly used to transmit uplink and downlink user plane data.

[0012] The N4 interface in the 5G network interface is the interface between SMF and UPF, and is used to transmit control plane information between SMF and UPF.

[0013] The N11 interface in the 5G network interface is the interface between network elements.

[0014] Hive is a data warehouse tool based on Hadoop, which is used for data extraction, transformation and loading. It is a mechanism for storing, querying and analyzing large-scale data stored in Hadoop.

[0015] PFCP Session Delete message and PFCP Session Establish message are links in the 5G signaling process. Support vector machine SVM is a binary classification model. Its basic model is a linear classifier with the largest margin defined in the feature space. The largest margin makes it different from the perceptron. SVM also includes kernel skills, which makes it a nonlinear classifier in essence. The learning strategy of SVM is to maximize the margin, which can be formalized as a problem of solving convex quadratic programming, which is also equivalent to the problem of minimizing the regularized hinge loss function. The learning algorithm of SVM is the optimization algorithm for solving convex quadratic programming. Classification is a very important task in the field of data mining. Its purpose is to learn a classification function or classification model (or classifier), and support vector machine itself is a supervised learning method. Support vector machine (SVM) is a machine learning method based on statistical learning theory developed in the mid-1990s. It improves the generalization ability of the learning machine by seeking the minimum structured risk, and minimizes the empirical risk and confidence range, so as to achieve the purpose of obtaining good statistical laws even with a small number of statistical samples.

[0016] KKT conditions are for general optimization problems with equality and inequality constraints. 1. Lagrange multiplier method and KKT conditions are needed in the process of solving the optimization parameters of support vector machine. 2. When dealing with g(x), if the optimal solution is within the range of g(x)<0, the entire constraint has no effect on the final result, so this constraint can be relaxed. Summary of the invention

[0017] In view of the shortcomings of the prior art, the present invention provides a method and device for network risk assessment of a 5G private network, which consists of a private network dynamic risk identification module, a private network environmental risk identification module and a private network comprehensive risk assessment module; the private network dynamic risk identification module consists of a private network data collection and analysis submodule, a private network data association submodule and a private network risk identification submodule; the private network risk identification submodule consists of a signaling security identifier, a data security identifier and a network security identifier; the private network environmental risk identification module consists of a private network vulnerability identification submodule and a private network environmental risk identification submodule; the private network environmental risk identification submodule consists of a data control risk identifier, a terminal failure risk identifier and a terminal environment identifier;

[0018] The private network data collection and analysis submodule deploys user plane information collection equipment on the N3 interface to collect all information on the N3 interface as user plane information; deploys signaling plane information collection equipment on the N4 and N11 interfaces to collect all information on the N4 and N11 interfaces as signaling plane information; the private network data collection and analysis submodule collects user plane information and signaling plane information by deploying user plane information collection equipment on the UPF network element side and signaling plane information collection equipment on the 5G core network side;

[0019] The private network data collection and analysis submodule identifies the protocol type, source data interface, tunnel number, source IP address and port number, destination IP address and port number, uplink and downlink traffic, protocol type, device type, service type, device version information and user plane load in the user plane information;

[0020] The private network data collection and parsing submodule identifies the protocol type, source data interface, tunnel number, user permanent identifier, universal public user identifier, permanent equipment identifier, uplink and downlink protocol flow identifier, 5G cell information, slice information, base station information and signaling plane payload in the signaling plane information;

[0021] The private network data association submodule backfills the user permanent identifier, universal public user identifier, permanent device identifier, 5G cell information, slice information, and base station information in the signaling plane into the user plane information through the tunnel number according to the mapping relationship between the user permanent identifier, universal public user identifier, permanent device identifier, 5G cell information, slice information, and base station information in the signaling plane, and the mapping relationship between the tunnel number and the source IP address, destination IP address, and user plane load in the user plane information; after completing the association backfilling, the private network data association submodule outputs the signaling plane log and the user plane log; the signaling plane log contains the original signaling plane information; the user plane log contains the original user plane information, and includes the user permanent identifier, universal public user identifier, permanent device identifier, 5G cell information, slice information, and base station information;

[0022] The private network data association submodule stores the signaling plane logs and user plane logs in the hive database;

[0023] The signaling security identifier obtains the signaling plane log from the hive database and conducts signaling security risk assessment on key fields; key fields include: source IP address, destination IP address, user permanent identifier, universal public user identifier, permanent device identifier, and signaling payload; key fields are combined into risk assessment rules, including: the association between user permanent identifier, universal public user identifier, and permanent device identifier as a machine-card relationship list; the UPF address is defined as an IP whitelist, the base station IP address is defined as an IP whitelist, the IP address of the session management function SMF is defined as an IP whitelist, and the IP address of the access and mobility management function AMF is defined as IP whitelist; when the user permanent identifier, universal public user identifier and permanent device identifier in the key field are inconsistent with the machine-card relationship list, it is judged as a machine-card separation risk; when the source IP address in the key field is not in the IP whitelist, it is judged as a "whitelist" risk; when the destination IP address in the key field is not in the IP whitelist, it is judged as a "whitelist" risk; when the number of signaling plane logs containing the same user permanent identifier parsed within the interval time exceeds the threshold, it is judged as a terminal security access event; the interval time and threshold are obtained by setting; the signaling security identifier outputs the identified security events as signaling security logs;

[0024] The data security identifier obtains user face-to-face logs from the hive database and conducts data security risk analysis on key fields; key fields include: industrial Internet protocol type, source IP address, destination IP address, and fields parsed from the industrial Internet protocol;

[0025] The data security identifier obtains data classification and grading rules in a pre-set manner. In the data classification and grading rules, data categories are divided into industrial enterprise data, industrial Internet platform data and industrial Internet identification resolution data; industrial enterprise data is divided into R&D domain data, production domain data, operation and maintenance domain data, management domain data and external data; the fields and data classifications after the industrial Internet protocol are parsed are mapped to form a data classification table; the data level can be divided into three levels, namely general industrial data, important industrial data and core industrial data. The data classification table and the data level table are mapped to form a complete data classification and grading rule:

[0026]

[0027]

[0028] When the user-side log carries the fields parsed by the industrial Internet protocol and hits the data classification and grading rules, the data security identifier outputs the data identification log; the data identification log includes the identification time, industrial Internet protocol name, parsed fields, data classification, data grading, number of data groups, and number of data;

[0029] The data security identifier obtains user-side logs from the hive database and analyzes abnormal data transmission behaviors for key fields. The key fields include: source IP address, destination IP address, upstream and downstream traffic, traffic start and end time, user permanent identifier, application layer protocol, protocol parsing field, and effective nuclear load; key fields are combined into risk analysis rules; when the data level in the data identification log is industrial important data and industrial core data, it means that sensitive data is transmitted in plain text in this data flow. The data security identifier triggers the sensitive data plain text transmission risk rule and determines it as a sensitive data plain text transmission risk; when the source IP address or destination IP address of the same user permanent identifier in the user-side log If the address is not within the data flow baseline, the data flow scope risk rule is triggered and it is determined to be a data flow scope risk; the data flow scope baseline is obtained through setting; when the uplink and downlink traffic generation time of the same user permanent identifier in the user plane log is not within the data flow time baseline, the data flow time risk rule is triggered and it is determined to be a data flow time risk; the data flow time baseline is obtained through setting; when the destination IP address of the same user permanent identifier in the user plane log is not within the IP address baseline within the campus, the data leakage risk rule is triggered and it is determined to be a data leakage risk; the IP address baseline within the campus is obtained through setting; the data security identifier outputs the identified risks as data risk logs;

[0030] The network risk identifier obtains user-side logs from the hive database, and associates and compares key fields with the intelligence center obtained by the web crawler. The key fields include: source IP address, destination IP address, user permanent identifier, application layer protocol, protocol parsing field, and effective core load; the web crawler obtains information regularly, and the information obtained includes: malicious IP, core load hash, and domain name; when the key field hits the information of the intelligence center, it is judged that a network risk has occurred, and it is divided into network behavior attack subcategories and malicious program attack subcategories according to the matching network risk type; the network risk identifier outputs the identified risks as network risk logs;

[0031] The private network risk identification submodule stores the signaling security log, data identification log, data risk log and network risk log in the big data hive for data modeling and correlation analysis, and then establishes abnormal analysis indicators according to the private network dynamic risk assessment model: when the risk type is 5G private network risk, the risk classification is data security, and the risk subcategory is abnormal data transmission behavior, the risk feature is X1 and the risk weight is W1; when the risk type is 5G private network risk, the risk classification is data security, and the risk subcategory is data classification and grading, the risk feature is X2 and the risk weight is W2; the risk type is 5G private network risk, the risk classification is data security, and the risk subcategory is data classification and grading, the risk feature is X2 and the risk weight is W2. For private network risk, when the risk classification is signaling risk and the risk subcategory is signaling security incident, the risk characteristic is X3 and the risk weight is W3; when the risk type is 5G private network risk, the risk classification is signaling risk and the risk subcategory is terminal security incident, the risk characteristic is X4 and the risk weight is W4; when the risk type is 5G private network risk, the risk classification is network risk and the risk subcategory is network behavior attack, the risk characteristic is X5 and the risk weight is W5; when the risk type is 5G private network risk, the risk classification is network risk and the risk subcategory is malicious program attack, the risk characteristic is X6 and the risk weight is W6;

[0032] The private network vulnerability identification submodule obtains user face-to-face logs from the hive database, and associates and compares key fields with the vulnerability information obtained by the web crawler. The key fields include: device hardware information, middleware version information and development dependency version information; the web crawler regularly obtains vulnerability information published by the National Information Security Vulnerability Sharing Platform and the General Vulnerability Disclosure Platform. The vulnerability information includes: vulnerability number, vulnerability type, vulnerability name, and vulnerability-related products; the private network vulnerability identification submodule analyzes the vulnerability description and impact range, triggering scenario, and the device hardware information, middleware version information, development dependency version information, etc., identifies the vulnerability information of terminals, middleware, databases, etc., and forms a private network terminal vulnerability library, a private network middleware vulnerability library, and a private network server vulnerability library; the private network terminal vulnerability library, the private network middleware vulnerability library, and the private network server vulnerability library are divided into high-risk vulnerabilities, medium-risk vulnerabilities, and low-risk vulnerabilities according to the vulnerabilities disclosed by the National Information Security Vulnerability Sharing Platform and the General Vulnerability Disclosure Platform; the private network vulnerability identification submodule outputs the identified vulnerability information as a private network vulnerability log;

[0033] The data control risk identifier completes the data control risk identification of the industry application server; the data control risk identifier obtains the key fields of the user-side log from the hive database and obtains the log of the industry application server for risk assessment. The key fields include: source IP address, destination IP address, user permanent identifier, and database execution operation type; the data control risk identifier compares the risk identification table pre-set in the log of the industry application server. The risk identification table sets the data level, which is divided into industrial general data, industrial important data, and industrial core data. Different data levels in the risk identification table allow different types of operations to be executed. The operation types include: query, write, export, desensitization, batch query, and batch export. Each operation type sets a threshold for the number of executions;

[0034] The data control risk identifier first identifies the data level in the risk identification table corresponding to the database execution operation object in the user-side log; when the operation type allowed by the data level in the risk identification table corresponding to the database execution operation object in the user-side log does not correspond to the database execution operation type in the user-side log, it is determined that a data permission risk occurs; when the operation type allowed by the data level in the risk identification table corresponding to the database execution operation object in the user-side log is consistent with the database execution operation type in the user-side log, when the number of executions of the operation type exceeds the threshold, it is determined that a data sharing risk occurs;

[0035] The data control risk identifier outputs data permission risk and data sharing risk as data control risk events into data control risk logs;

[0036] The terminal fault risk identifier uses a pre-set equipment terminal fault risk assessment rule table, which includes equipment identification, equipment value, component replacement cost, whether offline occurs, and fault importance field. The fault importance is divided into three types: low, medium, and high. The terminal fault risk identifier reads the user plane log from the hive database and obtains the user permanent identifier, source IP address, and destination IP address. After deduplication, the user permanent identifier, source IP address, and destination IP address are filled in the equipment identification field of the risk assessment rule table. The equipment value is depreciated at 10% of the original price each year. The equipment value and component replacement cost are combined to become the equipment cost. The component replacement cost is the incurred component replacement cost. The equipment cost is set to three levels of low, medium, and high according to the price difference method. The offline judgment condition is: read the signaling plane log, when the terminal does not generate PFCP for 2 consecutive hours after the N4 interface PFCP Session Delete message occurs SessionEstablish message is received, the terminal is considered offline; the fault importance is determined as follows: if the terminal is extremely important and cannot be offline, the risk weight is high if it is offline; if the terminal is offline for a short time, causing a certain degree of loss, but the scope and degree of impact are controlled, the risk weight is medium; if the terminal can be offline for a long time and the impact is negligible, the risk weight is low;

[0037] The terminal failure risk identifier outputs the device value and terminal importance of the offline terminal failure risk as a terminal failure risk log;

[0038] The terminal environment identifier indicates the location of the park where the 5G cell is located, the indoor and outdoor environments by pre-setting the 5G cell information mapping table; the terminal environment identifier reads the user plane log from the hive database, obtains the 5G cell information and the user permanent identifier, and associates and compares them with the 5G cell information mapping table, and outputs the terminal environment log after the association is completed;

[0039] The private network environment risk identification submodule stores the private network vulnerability log, data control risk log, terminal failure risk log and terminal environment log in the big data hive for data modeling and correlation analysis, and then establishes abnormal analysis indicators according to the private network environment risk assessment model: when the risk type is private network environment risk, the risk classification is terminal vulnerability risk, and the risk subcategory is high risk, the risk feature is X7 and the risk weight is W7; when the risk type is private network environment risk, the risk classification is terminal vulnerability risk, and the risk subcategory is medium risk, the risk feature is X8, The risk weight is W8; when the risk type is private network environment risk, the risk classification is terminal vulnerability risk, and the risk subcategory is low risk, the risk characteristic is X9 and the risk weight is W9; when the risk type is private network environment risk, the risk classification is data control risk, and the risk subcategory is data sharing risk, the risk characteristic is X10 and the risk weight is W10; when the risk type is private network environment risk, the risk classification is data control risk, and the risk subcategory is data permission risk, the risk characteristic is X11 and the risk weight is W11; when the risk type is private network environment risk, the risk classification is data control risk, and the risk subcategory is data permission risk, the risk characteristic is X12 and the risk weight is W13;

[0040] For terminal failure risk, when the risk subcategory is equipment cost, the risk characteristic is X12 and the risk weight is W12;

[0041] For network environment risk, when the risk classification is terminal failure risk and the risk subcategory is equipment importance, the risk characteristic is X13 and the risk weight is W13. For risk type is private network environment risk, when the risk classification is terminal environment risk and the risk subcategory is terminal environment, the risk characteristic is X14 and the risk weight is W14.

[0042] The private network comprehensive risk assessment module uses the support vector machine (SVM) to classify and train the risk features and risk weights collected in hive. The specific process of substituting into the support vector machine is as follows: T x+b=0 describes the hyperplane, where W=(W1,W2,…,W14) is the normal vector of the hyperplane, representing the risk weight and determining the direction of the hyperplane; X=(x1,x2,…,1) is the feature of the hyperplane, representing the risk feature, and b is the displacement term, determining the distance between the hyperplane and the original

[0043] The distance between points; for any feature x in the sample space, the distance to the hyperplane is written as Find the constraints that satisfy The parameters w and b are such that γ is maximized.

[0044] When the sample data set can be correctly divided, no matter whether the label of the original sample data is +1 or -1, y i (w T x i+b) will be a positive number greater than or equal to 1. By introducing the Lagrange factor to transform it into a dual problem, it can be written as:

[0045] Use L(w, b, a) to find the partial derivatives of w and b respectively, and set the partial derivatives to 0 to get

[0046] For equality constraints, the Lagrange factor can be used directly to find the extreme value. For inequality constraints, the KKT condition constraints must be satisfied for solution. The KKT conditions corresponding to the model are: a; (y, fx;)-1) = 0,, ft x,)-1 = 0,, sn; Substituting W into the original function, we can get Use General

[0047] The quadratic programming algorithm is used to solve the final private network feature classifier; the risk feature vector after feature selection by the private network dynamic risk identification module and the private network environment risk identification module is input into the private network feature classifier to obtain the categories into which the risks corresponding to the risk feature vector are divided.

[0048] Beneficial Effects

[0049] The cybersecurity risk assessment of the Industrial Internet is mostly carried out by reverse analysis of firmware defects and business logic vulnerabilities, obtaining data of industrial security protection equipment such as network gates / firewalls, and assessing the original risks of the Industrial Internet. However, after the introduction of 5G private networks, the signaling and data planes do not have the hierarchical protection of the Industrial Internet, there are no logs of conventional security products to analyze, and there is no analysis and assessment of the cybersecurity risk of 5G private networks from the perspectives of terminal vulnerabilities, data control conditions, the impact of terminal offline on business, and terminal environmental risks, resulting in limitations in the risk assessment results.

[0050] The present invention identifies network security risks in 5G private networks through risk events in signaling and user plane traffic, terminal and server vulnerabilities, private network data management and control, impact of terminal offline on business, and terminal environment risks, and provides risk warnings. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 It is a system structure diagram of the present invention. DETAILED DESCRIPTION

[0052] See also Figure 1, a method and device for implementing a network risk assessment of a 5G private network provided by the present invention is composed of a private network dynamic risk identification module 1, a private network environment risk identification module 2 and a private network comprehensive risk assessment module 3; the private network dynamic risk identification module 1 is composed of a private network data collection and analysis submodule 10, a private network data association submodule 11 and a private network risk identification submodule 12; the private network risk identification submodule 12 is composed of a signaling security identifier 120, a data security identifier 121 and a network security identifier 122; the private network environment risk identification module 2 is composed of a private network vulnerability identification submodule 20 and a private network environment risk identification submodule 21; the private network environment risk identification submodule 21 is composed of a data control risk identifier 210, a terminal failure risk identifier 211 and a terminal environment identifier 212;

[0053] The private network data collection and analysis submodule 10 deploys a user plane information collection device on the N3 interface to collect all the information of the N3 interface as the user plane information; deploys a signaling plane information collection device on the N4 and N11 interfaces to collect all the information of the N4 and N11 interfaces as the signaling plane information; the private network data collection and analysis submodule 10 collects user plane information and signaling plane information by respectively deploying a user plane information collection device on the UPF network element side and deploying a signaling plane information collection device on the 5G core network side;

[0054] The private network data collection and analysis submodule 10 identifies the protocol type, source data interface, tunnel number, source IP address and port number, destination IP address and port number, uplink and downlink traffic, protocol type, device type, service type, device version information and user plane load in the user plane information;

[0055] The private network data collection and analysis submodule 10 identifies the protocol type, source data interface, tunnel number, user permanent identifier, universal public user identifier, permanent equipment identifier, uplink and downlink protocol flow identifier, 5G cell information, slice information, base station information and signaling plane load in the signaling plane information;

[0056] The private network data association submodule 11 backfills the user permanent identifier, universal public user identifier, permanent device identifier, 5G cell information, slice information, and base station information in the signaling plane into the user plane information through the tunnel number according to the mapping relationship between the user permanent identifier, universal public user identifier, permanent device identifier, 5G cell information, slice information, and base station information in the signaling plane, and the mapping relationship between the tunnel number and the source IP address, the destination IP address, and the user plane load in the user plane information; after completing the association backfilling, the private network data association submodule 11 outputs the signaling plane log and the user plane log; the signaling plane log contains the original signaling plane information; the user plane log contains the original user plane information, and contains the user permanent identifier, universal public user identifier, permanent device identifier, 5G cell information, slice information, and base station information;

[0057] The private network data association submodule 11 stores the signaling plane log and the user plane log in the hive database;

[0058] The signaling security identifier 120 obtains the signaling plane log from the hive database and conducts signaling security risk assessment on key fields; the key fields include: source IP address, destination IP address, user permanent identifier, universal public user identifier, permanent device identifier, and signaling payload; the key fields are combined into risk assessment rules, including: the association relationship between the user permanent identifier, universal public user identifier, and permanent device identifier as a machine-card relationship list; the UPF address is defined as an IP whitelist, the base station IP address is defined as an IP whitelist, the IP address of the session management function SMF is defined as an IP whitelist, the access and mobile

[0059] The IP address of the management function AMF is defined as an IP whitelist; when the user permanent identifier, universal public user identifier and permanent device identifier in the key field are inconsistent with the machine-card relationship list, it is determined to be a machine-card separation risk; when the source IP address in the key field is not in the IP whitelist, it is determined to be a "whitelist" risk; when the destination IP address in the key field is not in the IP whitelist, it is determined to be a "whitelist" risk; when the number of signaling plane logs containing the same user permanent identifier parsed within an interval exceeds a threshold, it is determined to be a terminal security access event; the interval time and threshold are obtained by setting; the signaling security identifier 120 outputs the identified security event as a signaling security log;

[0060] The data security identifier 121 obtains user face-to-face logs from the hive database and conducts data security risk analysis on key fields; the key fields include: industrial Internet protocol type, source IP address, destination IP address, and fields parsed from the industrial Internet protocol;

[0061] The data security identifier 121 obtains data classification and grading rules in a pre-set manner. In the data classification and grading rules, data categories are divided into industrial enterprise data, industrial Internet platform data and industrial Internet identification resolution data; industrial enterprise data is divided into R&D domain data, production domain data, operation and maintenance domain data, management domain data and external data; the fields and data classifications after the industrial Internet protocol are parsed are mapped to form a data classification table; the data level can be divided into three levels, namely, general industrial data, important industrial data and core industrial data. The data classification table and the data level table are mapped to form a complete data classification and grading rule:

[0062] When the user-side log carries the fields parsed by the industrial Internet protocol and hits the data classification and grading rules, the data security identifier 121 outputs the data identification log; the data identification log includes the identification time, the industrial Internet protocol name, the parsed fields, the data classification, the data grading, the number of data groups, and the number of data;

[0063] The data security identifier 121 obtains the user-side log from the hive database and analyzes the abnormal data transmission behavior of key fields. The key fields include: source IP address, destination IP address, upstream and downstream traffic, traffic start and end time, user permanent identifier, application layer protocol, protocol parsing field, and effective nuclear load; the key fields are combined into risk analysis rules; when the data level in the data identification log is industrial important data and industrial core data, it means that there is sensitive data in plain text transmission in this data flow. The data security identifier 121 triggers the sensitive data plain text transmission risk rule and determines it as a sensitive data plain text transmission risk; when the source IP address or destination IP of the same user permanent identifier in the user-side log If the address is not within the data flow baseline, the data flow range risk rule is triggered and it is determined to be a data flow range risk; the data flow range baseline is obtained through setting; when the uplink and downlink traffic generation time of the same user permanent identifier in the user plane log is not within the data flow time baseline, the data flow time risk rule is triggered and it is determined to be a data flow time risk; the data flow time baseline is obtained through setting; when the destination IP address of the same user permanent identifier in the user plane log is not within the IP address baseline within the campus, the data leakage risk rule is triggered and it is determined to be a data leakage risk; the IP address baseline within the campus is obtained through setting; the data security identifier 121 outputs the identified risk as a data risk log;

[0064] The network risk identifier 122 obtains user-side logs from the hive database, and associates and compares key fields with the intelligence center obtained by the web crawler. The key fields include: source IP address, destination IP address, user permanent identifier, application layer protocol, protocol parsing field, and effective core load; the web crawler regularly obtains information from the National Internet Emergency Center, Tencent Threat Intelligence Center, and Qi'anxin Threat Intelligence Center. The information obtained includes: malicious IP, core load hash, and domain name; when the key field hits the intelligence center information, it is judged that a network risk has occurred, and it is divided into network behavior attack subcategories and malicious program attack subcategories according to the matching network risk type; the network risk identifier 122 outputs the identified risks as network risk logs;

[0065] The private network risk identification submodule 12 stores the signaling security log, data identification log, data risk log and network risk log in the big data hive for data modeling and correlation analysis, and then according to the private network dynamic risk assessment model;

[0066] Establish abnormal analysis indicators: when the risk type is 5G private network risk, the risk classification is data security, and the risk subcategory is abnormal data transmission behavior, the risk characteristic is X1 and the risk weight is W1; when the risk type is 5G private network risk, the risk classification is data security, and the risk subcategory is data classification and grading, the risk characteristic is X2 and the risk weight is W2; when the risk type is 5G private network risk, the risk classification is signaling risk, and the risk subcategory is signaling security incident, the risk characteristic is X3 and the risk weight is W3; when the risk type is 5G private network risk, the risk classification is signaling risk, and the risk subcategory is terminal security incident, the risk characteristic is X4 and the risk weight is W4; when the risk type is 5G private network risk, the risk classification is network risk, and the risk subcategory is network behavior attack, the risk characteristic is X5 and the risk weight is W5; when the risk type is 5G private network risk, the risk classification is network risk, and the risk subcategory is malicious program attack, the risk characteristic is X6 and the risk weight is W6;

[0067] The private network vulnerability identification submodule 20 obtains user face-to-face logs from the hive database, and associates and compares key fields with the vulnerability information obtained by the web crawler. The key fields include: device hardware information, middleware version information and development dependency version information; the web crawler regularly obtains vulnerability information published by the national information security vulnerability sharing platform and the general vulnerability disclosure platform, and the vulnerability information includes: vulnerability number, vulnerability type, vulnerability name, and vulnerability-related products; the private network vulnerability identification submodule 20 analyzes the vulnerability description and impact range, triggering scenario, etc. with the device hardware information, middleware version information, development dependency version information, etc., identifies the vulnerability information existing in the terminal, middleware, database, etc., and forms a private network terminal vulnerability library, a private network middleware vulnerability library and a private network server vulnerability library; the private network terminal vulnerability library, the private network middleware vulnerability library and the private network server vulnerability library are divided into high-risk vulnerabilities, medium-risk vulnerabilities and low-risk vulnerabilities according to the vulnerability conditions disclosed by the national information security vulnerability sharing platform and the general vulnerability disclosure platform; the private network vulnerability identification submodule 20 outputs the identified vulnerability information as a private network vulnerability log;

[0068] The data control risk identifier 210 completes the data control risk identification of the industry application server; the data control risk identifier 210 obtains the user-side log from the hive database to read the key fields and obtains the log of the industry application server for risk assessment, and the key fields include: source IP address, destination IP address, user permanent identifier, and database execution operation type; the data control risk identifier 210 compares the risk identification table pre-set in the log of the industry application server, and the risk identification table sets the data level, which is divided into industrial general data, industrial important data and industrial core data. Different data levels in the risk identification table allow different types of operations to be executed, and the operation types include: query, write, export, desensitization, batch query and batch export, and each operation type sets the execution number threshold;

[0069] The data control risk identifier 210 first identifies the data level in the risk identification table corresponding to the database execution operation object in the user-side log; when the type of operation allowed to be executed by the data level in the risk identification table corresponding to the database execution operation object in the user-side log does not correspond to the type of database execution operation in the user-side log, it is determined that a data permission risk occurs; when the type of operation allowed to be executed by the data level in the risk identification table corresponding to the database execution operation object in the user-side log is consistent with the type of database execution operation in the user-side log, when the number of executions of the operation type exceeds the threshold, it is determined that a data sharing risk occurs;

[0070] The data control risk identifier 210 outputs the data permission risk and the data sharing risk as data control risk events into a data control risk log;

[0071] The terminal fault risk identifier 211 uses a pre-set equipment terminal fault risk assessment rule table, which includes equipment identification, equipment value, component replacement cost, whether offline occurs, and fault importance field, and the fault importance is divided into three types: low, medium, and high. The terminal fault risk identifier 211 reads the user plane log from the hive database, and obtains the user permanent identifier, source IP address, and destination IP address, and fills the user permanent identifier, source IP address, and destination IP address into the equipment identification field of the risk assessment rule table after deduplication. The equipment value is depreciated at 10% of the original price each year, and the equipment value and component replacement cost are combined to become the equipment cost, and the component replacement cost is the incurred component replacement cost; the equipment cost is set to three levels of low, medium, and high according to the price difference equal division method; the offline judgment condition is: read the signaling plane log, when the terminal generates the N4 interface PFCP Session Delete message and no PFCPSession is generated for 2 consecutive hours Establish message, the terminal is considered offline; the fault importance is determined as follows: if the terminal is extremely important and cannot be offline, and if it is offline it will directly threaten the user's life and property safety or social stability and national security, then the risk weight is high; if the terminal is offline for a short time, causing a certain degree of loss, but the scope and degree of impact are controlled, then the risk weight is medium; if the terminal can be offline for a long time and the impact can be ignored, then the risk weight is low;

[0072] The terminal failure risk identifier 211 outputs the device value and terminal importance of the offline terminal failure risk as a terminal failure risk log;

[0073] The terminal environment identifier 212 indicates the park location, indoor and outdoor environment of the 5G cell by setting the 5G cell information mapping table in advance; the terminal environment identifier 212 reads the user plane log from the hive database, obtains the 5G cell information and the user permanent identifier, and associates and compares them with the 5G cell information mapping table, and outputs the terminal environment log after the association is completed;

[0074] The private network environment risk identification submodule 21 stores the private network vulnerability log, data control risk log, terminal failure risk log and terminal environment log in the big data hive for data modeling and correlation analysis, and then establishes abnormal analysis indicators according to the private network environment risk assessment model: when the risk type is private network environment risk, the risk classification is terminal vulnerability risk, and the risk subcategory is high risk, the risk characteristic is X7 and the risk weight is W7; when the risk type is private network environment risk, the risk classification is terminal vulnerability risk, and the risk subcategory is medium risk, the risk characteristic is X8 and the risk weight is W8; when the risk type is private network environment risk, the risk classification is terminal vulnerability risk, and the risk subcategory is low risk, the risk characteristic is X9 and the risk weight is W9; when the risk type is private network environment risk, When the risk classification is data control risk and the risk subcategory is data sharing risk, the risk characteristic is X10 and the risk weight is W10; when the risk type is private network environment risk, the risk classification is data control risk and the risk subcategory is data permission risk, the risk characteristic is X11 and the risk weight is W11; when the risk type is private network environment risk, the risk classification is terminal failure risk and the risk subcategory is equipment cost, the risk characteristic is X12 and the risk weight is W12; when the risk type is private network environment risk, the risk classification is terminal failure risk and the risk subcategory is equipment importance, the risk characteristic is X13 and the risk weight is W13; when the risk type is private network environment risk, the risk classification is terminal environment risk and the risk subcategory is terminal environment, the risk characteristic is X14 and the risk weight is W14;

[0075] The private network comprehensive risk assessment module 3 uses the support vector machine SVM to classify and train the risk features and risk weights collected in hive; the specific process of substituting into the support vector machine is: T x+b=0 describes the hyperplane, where W=(W1,W2,…W14) is the normal vector of the hyperplane, representing the risk weight and determining the direction of the hyperplane; X=(x1,x2,…,1) is the feature of the hyperplane, representing the risk feature, and b is the displacement term, determining the distance between the hyperplane and the origin; the distance from any feature x in the sample space to the hyperplane is written as Find the constraints that satisfy The parameters w and b are used to maximize γ. When the sample data set can be correctly divided, no matter whether the label of the original sample data is +1 or -1, y i (w T x i +b) will be a positive number greater than or equal to 1. By introducing the Lagrange factor to transform it into a dual problem, it can be written as:

[0076] Use L(w, b, a) to find the partial derivatives of w and b respectively, and set the partial derivatives to 0 to get

[0077] For equality constraints, the Lagrange factor can be used directly to find the extreme value. For inequality constraints, the KKT condition constraints must be satisfied for solution. The KKT conditions corresponding to the model are: a; (y, fx;)-1) = 0,, ft x,)-1 = 0, a i ≥0; Substituting W into the original function, we can get A general quadratic programming algorithm is used to solve the problem and obtain the final private network feature classifier 30; the risk feature vector after feature selection by the private network dynamic risk identification module 1 and the private network environment risk identification module 2 is input into the private network feature classifier 30 to obtain the category into which the risk corresponding to the risk feature vector is divided.

Claims

1. A device for network risk assessment of a 5G private network, characterized in that It consists of a private network dynamic risk identification module, a private network environmental risk identification module and a private network comprehensive risk assessment module; the private network dynamic risk identification module consists of a private network data collection and analysis submodule, a private network data association submodule and a private network risk identification submodule; the private network risk identification submodule consists of a signaling security identifier, a data security identifier and a network security identifier; the private network environmental risk identification module consists of a private network vulnerability identification submodule and a private network environmental risk identification submodule; the private network environmental risk identification submodule consists of a data control risk identifier, a terminal failure risk identifier and a terminal environment identifier; The private network data collection and analysis submodule deploys user plane information collection equipment on the N3 interface and collects all information on the N3 interface as user plane information; Deploy signaling plane information collection equipment on the N4 and N11 interfaces to collect all information on the N4 and N11 interfaces as signaling plane information; The private network data collection and analysis submodule collects user plane information and signaling plane information by deploying user plane information collection equipment on the UPF network element side and signaling plane information collection equipment on the 5G core network side. The private network data collection and analysis submodule identifies the protocol type, source data interface, tunnel number, source IP address and port number, destination IP address and port number, uplink and downlink traffic, protocol type, device type, service type, device version information and user plane load in the user plane information; The private network data collection and parsing submodule identifies the protocol type, source data interface, tunnel number, user permanent identifier, universal public user identifier, permanent equipment identifier, uplink and downlink protocol flow identifier, 5G cell information, slice information, base station information and signaling plane load in the signaling plane information; The private network data association submodule backfills the user permanent identifier, universal public user identifier, permanent device identifier, 5G cell information, slice information, base station information and tunnel number in the signaling plane information according to the mapping relationship between the user permanent identifier, universal public user identifier, permanent device identifier, 5G cell information, slice information and base station information in the signaling plane information to the user plane information through the tunnel number, and the mapping relationship between the tunnel number and the source IP address, the destination IP address and the user plane load in the user plane information; after completing the association backfilling, the private network data association submodule outputs the signaling plane log and the user plane log; the signaling plane log contains the original signaling plane information; The user plane log contains the original user plane information, and includes the user permanent identifier, universal public user identity, permanent device identity, 5G cell information, slice information and base station information; The private network data association submodule stores the signaling plane logs and user plane logs in the big data hive database; The signaling security identifier obtains signaling logs from the big data hive database and conducts signaling security risk analysis on key fields; The key fields include: source IP address, destination IP address, user permanent identifier, universal public user identifier, permanent device identifier and signaling plane load; the key fields are combined into risk assessment rules, including: the association relationship between user permanent identifier, universal public user identifier and permanent device identifier as a machine-card relationship list; the UPF address is defined as an IP whitelist, the base station IP address is defined as an IP whitelist, the IP address of the session management function SMF is defined as an IP whitelist, and the IP address of the access and mobility management function AMF is defined as an IP whitelist; when the user permanent identifier, universal public user identifier and permanent device identifier in the key fields are inconsistent with the machine-card relationship list, it is determined to be a machine-card separation risk; when the source IP address in the key field is not in the IP whitelist, it is determined to be a whitelist risk; when the destination IP address in the key field is not in the IP whitelist, it is determined to be a whitelist risk; when the number of signaling plane logs containing the same user permanent identifier parsed within the interval time exceeds the threshold, it is determined to be a terminal security access event; the interval time and threshold are obtained by setting; the signaling security identifier outputs the identified security event as a signaling security log; The data security identifier obtains user-side logs from the big data hive database and conducts data security risk analysis on key fields; the key fields include: industrial Internet protocol type, source IP address, destination IP address, and fields after industrial Internet protocol parsing; The data security identifier obtains data classification and grading rules in a pre-set manner. In the data classification and grading rules, data categories are divided into industrial enterprise data, industrial Internet platform data and industrial Internet identification resolution data; industrial enterprise data is divided into R&D domain data, production domain data, operation and maintenance domain data, management domain data and external data; the fields and data classifications after the industrial Internet protocol are mapped to form a data classification table; data classification is divided into three levels, namely general industrial data, important industrial data and core industrial data. The data classification table and data classification are mapped to form a complete data classification and grading rule: When the user-side log carries the fields after the industrial Internet protocol is parsed and hits the data classification and grading rules, the data security identifier outputs the data identification log; the data identification log includes the identification time, industrial Internet protocol name, industrial Internet identification parsing data, data classification, data classification, number of data groups and number of data; The data security identifier obtains user-side logs from the big data hive database and analyzes abnormal data transmission behavior for key fields. The key fields include: source IP address, destination IP address, upstream and downstream traffic, traffic start and end time, user permanent identifier, application layer protocol, protocol parsing field and effective load; key fields are combined into risk analysis rules; when the data in the data identification log is classified as industrial important data and industrial core data, it means that sensitive data is transmitted in plain text in this data flow. The data security identifier triggers the sensitive data plain text transmission risk rule and determines it as a sensitive data plain text transmission risk; when the source IP address or destination IP address of the same user permanent identifier in the user-side log is If the P address is not within the data flow baseline, the data flow scope risk rule is triggered and it is determined to be a data flow scope risk; the data flow baseline is obtained through setting; when the uplink and downlink traffic generation time of the same user permanent identifier in the user plane log is not within the data flow time baseline, the data flow time risk rule is triggered and it is determined to be a data flow time risk; the data flow time baseline is obtained through setting; when the destination IP address of the same user permanent identifier in the user plane log is not within the IP address baseline within the campus, the data leakage risk rule is triggered and it is determined to be a data leakage risk; the IP address baseline within the campus is obtained through setting; the data security identifier outputs the identified risks as data risk logs; The network security identifier obtains user-side logs from the big data hive database, and associates and compares key fields with the intelligence information obtained by the web crawler. The key fields include: source IP address, destination IP address, user permanent identifier, application layer protocol, protocol parsing field and effective load; the web crawler regularly obtains intelligence information, and the intelligence information obtained includes: malicious IP, load hash and domain name; when the key field hits the intelligence information, it is judged that a network risk has occurred, and it is divided into network behavior attack subcategories and malicious program attack subcategories according to the matching network risk types; the network security identifier outputs the identified risks as network risk logs; The private network risk identification submodule stores the signaling security log, data identification log, data risk log and network risk log in the big data hive database for data modeling and correlation analysis, and then establishes abnormal analysis indicators according to the private network dynamic risk assessment model: when the risk type is 5G private network risk, the risk classification is data security, and the risk subcategory is abnormal data transmission behavior, the risk feature is X1 and the risk weight is W1; when the risk type is 5G private network risk, the risk classification is data security, and the risk subcategory is data classification and grading, the risk feature is X2 and the risk weight is W2; the risk type is 5G private network risk, the risk classification is data security, and the risk subcategory is data classification and grading, the risk feature is X2 and the risk weight is W2. For 5G private network risk, when the risk classification is signaling risk and the risk subcategory is signaling security incident, the risk characteristic is X3 and the risk weight is W3; for 5G private network risk, when the risk classification is signaling risk and the risk subcategory is terminal security incident, the risk characteristic is X4 and the risk weight is W4; for 5G private network risk, when the risk classification is network risk and the risk subcategory is network behavior attack, the risk characteristic is X5 and the risk weight is W5; for 5G private network risk, when the risk classification is network risk and the risk subcategory is malicious program attack, the risk characteristic is X6 and the risk weight is W6; The private network vulnerability identification submodule obtains user-side logs from the big data hive database, and associates and compares key fields with the vulnerability information obtained by the web crawler. The key fields include: device hardware information, middleware version information and development dependency version information; the web crawler regularly obtains vulnerability information published by the National Information Security Vulnerability Sharing Platform and the General Vulnerability Disclosure Platform. The vulnerability information includes: vulnerability number, vulnerability type, vulnerability name and vulnerability-related products; the private network vulnerability identification submodule analyzes and identifies the vulnerability information in the terminal, middleware and big data hive database through the vulnerability description and impact range trigger scenario and device hardware information, middleware version information, development dependency version information, and forms a private network terminal vulnerability library, a private network middleware vulnerability library and a private network server vulnerability library; the private network terminal vulnerability library, the private network middleware vulnerability library and the private network server vulnerability library are based on the vulnerabilities disclosed by the National Information Security Vulnerability Sharing Platform and the General Vulnerability Disclosure Platform. The vulnerability situations are divided into high-risk vulnerabilities, medium-risk vulnerabilities, and low-risk vulnerabilities; the private network vulnerability identification submodule outputs the identified vulnerability information as a private network vulnerability log; the data control risk identifier completes the data control risk identification of the industry application server; the data control risk identifier obtains the user-side log from the big data hive database to read the key fields and obtains the log of the industry application server for risk assessment. The key fields include: source IP address, destination IP address, user permanent identifier, and database execution operation type; the data control risk identifier compares the risk identification table pre-set in the log of the industry application server. The risk identification table sets the data level, which is divided into industrial general data, industrial important data, and industrial core data. Different data levels in the risk identification table allow different types of operations to be executed. The operation types include: query, write, export, desensitization, batch query, and batch export. Each operation type sets a threshold for the number of executions; The data control risk identifier first identifies the data classification in the risk identification table corresponding to the database execution operation object in the user-side log; when the operation type allowed by the data classification in the risk identification table corresponding to the database execution operation object in the user-side log does not correspond to the database execution operation type in the user-side log, it is determined that a data permission risk occurs; when the operation type allowed by the data classification in the risk identification table corresponding to the database execution operation object in the user-side log is consistent with the database execution operation type in the user-side log, when the number of executions of the operation type exceeds the threshold, it is determined that a data sharing risk occurs; The data control risk identifier outputs data permission risk and data sharing risk as data control risk events as data control risk logs; the terminal fault risk identifier uses a pre-set equipment terminal fault risk assessment rule table, which includes equipment identification, equipment value, component replacement cost, whether offline occurs, and fault importance. The fault importance is divided into three types: low, medium, and high. The terminal fault risk identifier reads the user plane log from the big data hive database and obtains the user permanent identifier, source IP address, and destination IP address. After removing the duplication of the user permanent identifier, source IP address, and destination IP address, it fills them into the equipment identification field of the risk assessment rule table. The equipment value is depreciated at 10% of the original price each year. The equipment value and component replacement cost are combined to become the equipment cost. The component replacement cost is the incurred component replacement cost. The equipment cost is set to three levels of low, medium, and high according to the price difference method. The judgment condition for offline occurrence is: read the signaling plane log, when the terminal does not generate a PFCP Session for 2 consecutive hours after the N4 interface PFCP Session Delete message is generated Establish message, the terminal is considered offline. The fault importance is determined as follows: if the terminal is highly important and offline is unacceptable, the risk weight is high; if the terminal is offline for a short time and the scope and extent of the loss are controlled, the risk weight is medium; if the terminal accepts long-term offline and the impact is negligible, the risk weight is low. The terminal fault risk identifier converts the device value and fault importance of the offline terminal into a terminal fault risk log; The terminal environment identifier indicates the location of the park where the 5G cell is located, the indoor and outdoor environments by pre-setting the 5G cell information mapping table; the terminal environment identifier reads the user plane log from the big data hive database, obtains the 5G cell information and the user permanent identifier, and associates and compares them with the 5G cell information mapping table, and outputs the terminal environment log after the association is completed; The private network environment risk identification submodule stores the private network vulnerability log, data control risk log, terminal failure risk log and terminal environment log in the big data hive database for data modeling and correlation analysis, and then establishes abnormal analysis indicators according to the private network environment risk assessment model: when the risk type is private network environment risk, the risk classification is terminal vulnerability risk, and the risk subcategory is high risk, the risk characteristic is X7 and the risk weight is W7; when the risk type is private network environment risk, the risk classification is terminal vulnerability risk, and the risk subcategory is medium risk, the risk characteristic is X8 and the risk weight is W8; when the risk type is private network environment risk, the risk classification is terminal vulnerability risk, and the risk subcategory is low risk, the risk characteristic is X9 and the risk weight is W9; when the risk type is private network environment risk, When the risk classification is data control risk and the risk subcategory is data sharing risk, the risk characteristic is X10 and the risk weight is W10; when the risk type is private network environment risk, the risk classification is data control risk and the risk subcategory is data permission risk, the risk characteristic is X11 and the risk weight is W11; when the risk type is private network environment risk, the risk classification is terminal failure risk and the risk subcategory is equipment cost, the risk characteristic is X12 and the risk weight is W12; when the risk type is private network environment risk, the risk classification is terminal failure risk and the risk subcategory is equipment importance, the risk characteristic is X13 and the risk weight is W13; when the risk type is private network environment risk, the risk classification is terminal environment risk and the risk subcategory is terminal environment, the risk characteristic is X14 and the risk weight is W14; The private network comprehensive risk assessment module uses the support vector machine (SVM) to classify and train the risk features and risk weights collected in the big data hive database; the specific process of substituting into the support vector machine is as follows: T x+b=0 describes the hyperplane, where W=(W1,W2,…,W14) is the normal vector of the hyperplane, representing the risk weight and determining the direction of the hyperplane; X=(x1,x2,…,x 14 ) is the feature of the hyperplane, representing the risk feature, and b is the displacement term, which determines the distance between the hyperplane and the origin. For any feature x in the sample space, the distance from the hyperplane is written as Find the constraints that satisfy The parameters W and b are used to maximize γ. When the sample data set is correctly divided, regardless of the label y of the original sample data i Is it +1 or -1, y i (W T x i +b) are all positive numbers greater than or equal to 1. By introducing the Lagrange factor, it is transformed into a dual problem, which can be written as Use L(W, b, a) to find the partial derivatives of W and b respectively, and set the partial derivatives to 0 to get the original function: For equality constraints, the Lagrange factor is directly used to find the extreme value. For inequality constraints, the KKT condition constraints are satisfied to solve. The KKT condition corresponding to the model is: a i (y i f(x i )-1)=0,y i f(x i )-1=0,a i ≥0; Substitute w into the original function to get The quadratic programming algorithm is used to solve and obtain the final private network feature classifier; the risk feature vector after feature selection by the private network dynamic risk identification module and the private network environment risk identification module is input into the private network feature classifier to obtain the category into which the risk corresponding to the risk feature vector is divided.

Images