A method and system for predicting a security risk event

Abstract

The application provides a kind of prediction method and system of security risk event, method includes: obtaining the original message data corresponding to security risk event, and the original message data is written into log according to preset format, generates message log data;The message log data is preliminarily detected;When the preliminary safety detection result is safe, then the message log data is input into the security prediction model constructed in advance to carry out safety prediction and obtain prediction safety value, and whether the current security risk event is safe is judged according to prediction safety value.The application constructs security prediction model based on historical data, detects security risk event by two-stage safety detection method, improves the accuracy of safety detection.

Description

Technical Field

[0001] This invention relates to the field of security detection technology, and specifically to a method and system for predicting security risk events. Background Technology

[0002] As informatization levels increase, enterprises are acquiring more and more network and security devices, resulting in a proliferation of scattered and massive log records. Maintenance personnel struggle to accurately and promptly identify useful information from these logs, leading to delayed emergency alerts and hindering the comprehensive analysis and utilization of scattered information. Furthermore, the inability to grasp the overall security status of the enterprise results in untimely adjustments to security strategies, thereby exposing the system to higher security risks.

[0003] Industrial information security log platforms can collect and aggregate alarms and network security status from various security subsystems, forming a comprehensive oversight of the entire security system. This overcomes the problem of each subsystem operating independently, by aggregating and analyzing security data from various monitoring units to create a network security posture report. Combined with an internal security database, it enables the development of emergency plans and the establishment of a regionalized intelligent security prevention, early warning, and emergency response system, thereby enhancing the overall information security protection capabilities of the enterprise. Therefore, there is an urgent need for more precise security detection of security risks in network devices. Summary of the Invention

[0004] Therefore, the technical problem to be solved by the present invention is to overcome the defects of security risk event detection in the prior art, thereby providing a method and system for predicting security risk events, which can build a security prediction model based on historical data and detect security risk events through a two-level security detection method, thereby improving the accuracy of detection.

[0005] The technical solution of the present invention to solve the above-mentioned technical problems is as follows:

[0006] In a first aspect, the present invention provides a method for predicting security risk events, comprising the following steps:

[0007] Obtain the original message data corresponding to the security risk event, and write the original message data into the log according to a preset format to generate message log data;

[0008] Perform preliminary security checks on the message log data;

[0009] When the initial security detection result is safe, the message log data is input into the pre-built security prediction model for security prediction, and the current security risk event is judged as safe based on the prediction result.

[0010] The security risk event prediction method provided in this invention involves acquiring the original message data corresponding to the security risk event and writing it into a log to generate message log data. Preliminary security checks are performed on the message log data. If the check result is secure, the message log data is input into a pre-built security prediction model for security prediction. Based on the prediction result, the method determines whether the current security risk event is secure. This invention constructs a security prediction model based on historical data and uses a two-stage security detection method to detect security risk events, thus improving the accuracy of security detection.

[0011] Optionally, the message log data includes: node, device type, device name, IP address, time, event level, alarm type, source IP address, destination IP address, event protocol, alarm information, and detailed information.

[0012] This invention obtains the original message data corresponding to security risk events and writes the message data into a log according to a preset format to generate rich message log data. The detailed data can improve the accuracy of security detection.

[0013] Optionally, the preliminary security checks performed on the message log data may include at least one of the following: TCP / IP network connection anomaly detection, netstat command network connection anomaly detection, industrial control command anomaly detection, network storm detection, and network session anomaly detection.

[0014] This invention performs preliminary security checks on the header information of message log data to confirm whether a header breach is safe during transmission, thereby making a preliminary judgment on the security of the transmitted data. The preliminary security checks include at least one of the following: TCP / IP network connection anomaly detection, netstat command network connection anomaly detection, industrial control command anomaly detection, network storm detection, and network session anomaly detection. By ensuring data transmission security before conducting further security checks targeting security risk events, the workload of subsequent security checks can be reduced to some extent.

[0015] Optionally, the construction process of the security prediction model includes: acquiring log messages from historical transmission data, and generating corresponding training data sets by judging the end marker of each log message; constructing an initial neural network model and loading each training data set for iterative training, and obtaining the corresponding security detection vector and the loss value of the corresponding labeled data; modifying the model parameters of the initial neural network model based on the security detection vector and the loss value through backpropagation until the loss value is less than or equal to a preset threshold, or the number of iterations reaches a preset maximum number of iterations, and generating a trained security prediction model.

[0016] This invention acquires log messages from historical transmission data, distinguishes different events by judging the end-of-line (FIN) marker of the log messages, and adds data from the same event to the same training dataset. This allows for the identification of related data, and by combining correlation information, it more accurately detects security risks. Secondly, a neural network model is constructed and trained on related data to generate a trained security prediction model. The security prediction model includes a neural network and a storage structure, where the neural network comprises multiple neuron structures. The input to the security prediction model is the log message data, and the input to each neuron structure is the data in the storage structure and the output of the previous neuron structure. Utilizing the learning capability of the neural network, it automatically learns the characteristics of security risk events during the detection of uncertain security risk events, thereby automatically adapting to the changes in event characteristics over time to achieve optimal prediction of security risk events and improve the accuracy of security detection.

[0017] Optionally, the process of obtaining the security detection vector includes: dividing the training data set into a first category data set and a second category data set, wherein the categories of the first category data set include: port number, acknowledgment number, data offset field, reserved field, and flag field, and the categories of the second category data set include: sequence number field and acknowledgment number field; judging the first category data set and obtaining a training simple vector; constructing an initial neural network model and loading the second category data set into the initial neural network model to obtain a training complex security value; and constructing a security detection vector based on the training complex security value and the training simple vector.

[0018] This invention requires two security detection methods for the same data. Therefore, it distinguishes between data categories: a first category based on data format, including port number, acknowledgment number, data offset field, reserved field, and flag field; and a second category based on data sequence, including sequence number field and acknowledgment number field. By separately judging these two categories of data, various security vulnerabilities can be detected, thus accurately determining data security.

[0019] Optionally, the process of judging the first category data set and obtaining a training simple vector includes: performing an AND operation on the data corresponding to each category in each of the first category data sets to obtain an equality judgment value; and constructing a training simple vector based on each equality judgment value, wherein the training simple vector is used to characterize whether the data in the first category data set are equal.

[0020] This invention can determine whether the data content is erroneous by judging the data format category. Since the transmission port, acknowledgment number, data offset field, reserved field and flag field of the same data are fixed values, the AND operation is performed on each type of data in the first category data set to determine whether the data is erroneous, thereby determining whether the data is secure during transmission.

[0021] Optionally, the process of obtaining the training complexity safety value includes: generating corresponding second sub-data sets by sequentially extracting data from corresponding positions in each of the second data sets in sequential order; obtaining the number of data in each of the second sub-data sets as the length value of the corresponding second sub-data set; based on the length value, sequentially inputting the data from each data set in the second sub-data set into each neuron structure of the initial neural network model to obtain the corresponding detection value, and storing the detection value in the corresponding storage structure until the length value is zero; and inputting each of the detection values ​​into the hidden layer of the initial neural network to obtain the corresponding training complexity safety value.

[0022] This invention, by judging the sequential characteristics of data, can more accurately determine data security. The sequence number and confirmation number fields in the second data set are extracted according to their sequential correspondence to generate a second sub-data set. The length value of each sub-data set controls the sequential input of data into its corresponding neuron structure. The detection value output by the neuron structure is saved to the corresponding storage structure. Each time data is input into a neuron structure, the length value is decremented by 1, and the next data is retrieved and re-input into the next neuron structure, until the length value is 0. At this point, the final output detection value is the detection value of the corresponding sub-data set. If the length value is not 0, the detection value is stored in the storage structure of the corresponding neuron structure; if the length value is 0, the data in the storage structure is reset to zero. This allows data with sequential relationships to be judged in conjunction with previous data, and the detection value obtained based on the data set length value considers all sequential relationships, enabling more accurate judgment of data security. Each sub-data set corresponds to a detection value. By inputting each detection value into the hidden layer of the neural network, we can obtain the features between data with different meanings, and make a joint judgment to obtain an accurate judgment on whether the data is safe.

[0023] Secondly, embodiments of the present invention provide a system for predicting security risk events, the system comprising:

[0024] The data acquisition module is used to acquire the original message data corresponding to the security risk event, and write the original message data into the log according to a preset format to generate message log data;

[0025] The security detection module is used to perform preliminary security detection on the message log data;

[0026] The security prediction module is used to input the message log data into a pre-built security prediction model to make a security prediction and obtain a predicted security value when the initial security detection result is safe, and to determine whether the current security risk event is safe based on the predicted security value.

[0027] The security risk event prediction system provided in this invention obtains the original message data corresponding to the security risk event and writes it into a log to generate message log data. Preliminary security checks are performed on the message log data. If the check result is secure, the message log data is input into a pre-built security prediction model for security prediction. Based on the prediction result, the system determines whether the current security risk event is secure. This invention constructs a security prediction model based on historical data and detects security risk events through a two-stage security detection method, thus improving the accuracy of security detection.

[0028] Thirdly, embodiments of the present invention provide a computer device, including: a memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the computer instructions to perform the method described in the first aspect, or any optional embodiment of the first aspect.

[0029] Fourthly, embodiments of the present invention provide a computer-readable storage medium storing computer instructions for causing the computer to perform the method described in the first aspect, or any optional embodiment of the first aspect. Attached Figure Description

[0030] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0031] Figure 1 A flowchart illustrating a method for predicting security risk events provided in an embodiment of the present invention;

[0032] Figure 2 A schematic diagram of the structure of a security risk event prediction system provided in an embodiment of the present invention;

[0033] Figure 3 This is a schematic diagram of the structure of a computer device provided in an embodiment of the present invention. Detailed Implementation

[0034] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0035] Furthermore, the technical features involved in the different embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0036] This invention provides a method for predicting security risk events, such as... Figure 1 As shown, the method specifically includes the following steps:

[0037] Step S1: Obtain the original message data corresponding to the security risk event, and write the original message data into the log according to the preset format to generate message log data.

[0038] Specifically, in this embodiment of the invention, if a security risk event occurs during data transmission by a network device or security device, the event needs to be detected to determine its security. Therefore, the original message data corresponding to the security risk event is first obtained. The header information from the transport layer data transmission process is written into a log to generate message log data, which can be used to determine data security at the application layer. The message log content generated in this embodiment includes, but is not limited to: node, device type, device name, IP address, time, event level, alarm type, source IP address, destination IP address, event protocol, alarm information, and detailed information.

[0039] Step S2: Perform preliminary security checks on the message log data.

[0040] Specifically, in this embodiment of the invention, the generated message log data undergoes preliminary security testing. A preliminary security value indicates that the testing result is secure; a preliminary security value of 1 indicates that the event is initially detected as secure, while a preliminary security value of 0 indicates that the event is initially detected as insecure. The preliminary security testing includes at least one of the following: TCP / IP network connection anomaly detection, netstat command network connection anomaly detection, industrial control command anomaly detection, network storm detection, and network session anomaly detection, but is not limited to these. For example, TCP / IP network connection anomaly detection is performed, and a protocol anomaly detection value is obtained. A protocol anomaly detection value of 1 indicates that the network connection is normal, while 0 indicates that the network connection is abnormal.

[0041] Step S3: When the preliminary security detection result is safe, the message log data is input into the pre-built security prediction model to make a security prediction and obtain a predicted security value. Based on the predicted security value, it is determined whether the current security risk event is safe.

[0042] Specifically, in this embodiment of the invention, a security prediction model is pre-constructed. The security prediction model in this embodiment is an RNN neural network model, including an RNN neural network and a storage structure. The RNN neural network includes multiple RNN neuron structures, whose input is message log data; the input of each RNN neuron structure is data in the storage structure and the output of the previous RNN neuron structure. After inputting the message log data into the trained security prediction model, a predicted security value can be obtained, where 1 indicates the security risk event is secure, and 0 indicates the security risk event is insecure. If, after secondary detection, the conclusion is that the security risk event is indeed insecure, corresponding alarm data is sent. The security prediction model construction process is as follows:

[0043] 1. Obtain log packets from historical transmission data and generate corresponding training datasets by determining the end-of-transmission flags of each log packet. The obtained log packets may correspond to data from multiple events; therefore, they are distinguished by determining the end-of-transmission flag (FIN flag). When both ends exchange TCP segments with the FIN flag and each end acknowledges the FIN packet sent by the other end, the TCP connection will be closed. The FIN bit literally means that one side of the connection will not send any more new data. However, retransmitted data will be sent until the receiving end acknowledges all information. Therefore, if the FIN flag of data is 0, the data will continue to be added to the current dataset; if the FIN flag of data is 1, the data collection for the current dataset will end, and the collection of the next dataset will begin. Therefore, the training dataset contains multiple datasets, each corresponding to a different historical security risk event.

[0044] 2. Construct an initial neural network model according to the RNN neural network format, initialize its parameters, load each of the aforementioned training datasets, perform iterative training, and obtain the corresponding security detection vector and the loss value of the corresponding labeled data. The process of obtaining the security detection vector is as follows:

[0045] (1) The training dataset is divided into first-class datasets according to data format, including: port number, acknowledgment number, data offset field, reserved field, and flag field. Since the transmission port, acknowledgment number, data offset field, reserved field, and flag field of the same data are fixed values, an AND operation is performed on each type of data in the first-class dataset to obtain an equality judgment value, which determines whether the data is erroneous and thus whether the data is secure during transmission. For example, the port numbers in the first-class dataset are extracted, and it is determined whether multiple port numbers in the first-class dataset are the same to obtain a port security value; a port security value of 1 indicates that the port numbers are the same, and a port security value of 0 indicates that the port numbers are different. If all port numbers are the same, the equality judgment value is 1, indicating security. If at least one port number is different, the equality judgment value is 0, indicating insecurity. A training simple vector is constructed based on each equality judgment value. The training simple vector is used to characterize whether the data in the first-class dataset are equal.

[0046] (2) The training data set is divided into a second category data set according to the data sequence characteristics, including a sequence number field and a confirmation number field. A corresponding second sub-data set is generated by extracting corresponding data from each of the second data sets in sequence. The number of data sets in each second sub-data set is used as the length value of the corresponding second sub-data set. For example, the second category data set in this embodiment includes a sequence number field data set: [2,4,3] and a confirmation number field data set: [7,8,9], but is not limited thereto. The corresponding data from the two data sets are extracted in sequence to obtain the second sub-data sets: [2,7], [4,8], and [3,9], with a length value of 3. The length value of each sub-data set controls the sequential input of data from each sub-data set into the corresponding neuron structure. The detection value output by the neuron structure is saved to the corresponding storage structure. Each time data is input into the neuron structure, the length value is decremented by 1, and the next data is obtained and re-input into the next neuron structure until the length value is 0. At this point, the final output detection value is the detection value of the corresponding sub-data set. If the length value is not 0, the detection value is stored in the storage structure of the corresponding neuron structure; if the length value is 0, the data in the storage structure is zeroed out. Each sub-data set corresponds to a detection value. Inputting each detection value into the hidden layer of the neural network can obtain the features between data with different meanings, and make a joint judgment to obtain an accurate judgment on whether the data is safe. 0 indicates that the data is not safe, and 1 indicates that the data is safe.

[0047] (3) Construct a security detection vector based on the training complex security value and the training simple vector.

[0048] 3. Based on the security detection vector and the loss value, the model parameters of the initial neural network model are modified through backpropagation until the loss value is less than or equal to a preset threshold, or the number of iterations reaches a preset maximum number of iterations, thus generating a trained security prediction model. For example, the maximum number of iterations selected in this invention is 1200, but it is not limited to this.

[0049] The security risk event prediction method provided in this invention involves acquiring the original message data corresponding to the security risk event and writing it into a log to generate message log data. Preliminary security checks are performed on the message log data. If the check result is secure, the message log data is input into a pre-built security prediction model for security prediction. Based on the prediction result, the method determines whether the current security risk event is secure. This invention constructs a security prediction model based on historical data and uses a two-stage security detection method to detect security risk events, thus improving the accuracy of security detection.

[0050] This invention provides a system for predicting security risk events, such as... Figure 2 As shown, the system includes:

[0051] Data acquisition module 1 is used to acquire the original message data corresponding to the security risk event, and write the original message data into a log according to a preset format to generate message log data. For details, please refer to the relevant description of step S1 in the above method embodiment, which will not be repeated here.

[0052] Security detection module 2 is used to perform preliminary security detection on the message log data. For details, please refer to the relevant description of step S2 in the above method embodiment, which will not be repeated here.

[0053] The security prediction module 3 is used to input the message log data into a pre-built security prediction model to perform security prediction and obtain a predicted security value when the preliminary security detection result is safe. Based on the predicted security value, it then determines whether the current security risk event is safe. For details, please refer to the relevant description of step S3 in the above method embodiment, which will not be repeated here.

[0054] The security risk event prediction system provided in this invention obtains the original message data corresponding to the security risk event and writes it into a log to generate message log data. Preliminary security checks are performed on the message log data. If the check result is secure, the message log data is input into a pre-built security prediction model for security prediction. Based on the prediction result, the system determines whether the current security risk event is secure. This invention constructs a security prediction model based on historical data and detects security risk events through a two-stage security detection method, thus improving the accuracy of security detection.

[0055] Figure 3 A schematic diagram of a computer device according to an embodiment of the present invention is shown, including: a processor 901 and a memory 902, wherein the processor 901 and the memory 902 can be connected via a bus or other means. Figure 3 Taking the example of a connection between China and Israel via a bus.

[0056] Processor 901 can be a Central Processing Unit (CPU). Processor 901 can also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or combinations of the above types of chips.

[0057] The memory 902, as a non-transitory computer-readable storage medium, can be used to store non-transitory server programs, non-transitory computer-executable programs, and modules, such as the program instructions / modules corresponding to the methods in the above method embodiments. The processor 901 executes various functional applications and data processing of the processor by running the non-transitory server programs, instructions, and modules stored in the memory 902, thereby implementing the methods in the above method embodiments.

[0058] The memory 902 may include a program storage area and a data storage area. The program storage area may store the operating system and applications required for at least one function; the data storage area may store data created by the processor 901, etc. Furthermore, the memory 902 may include high-speed random access memory and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, the memory 902 may optionally include memory remotely located relative to the processor 901, and these remote memories may be connected to the processor 901 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0059] One or more modules are stored in memory 902, and when executed by processor 901, they perform the methods described in the above method embodiments.

[0060] The specific details of the aforementioned computer equipment can be understood by referring to the relevant descriptions and effects in the above method embodiments, and will not be repeated here.

[0061] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The implemented program can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above methods. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), random access memory (RAM), flash memory, hard disk drive (HDD), or solid-state drive (SSD), etc.; the storage medium can also include combinations of the above types of memory.

[0062] Although embodiments of the invention have been described in conjunction with the accompanying drawings, those skilled in the art can make various modifications and variations without departing from the spirit and scope of the invention, and such modifications and variations all fall within the scope defined by the appended claims.

Claims

1. A method for predicting security risk events, characterized in that, The method comprises the following steps: obtaining original message data corresponding to a security risk event, and writing the original message data into a log in a preset format to generate message log data; performing preliminary security detection on the message log data; when the preliminary security detection result is safe, inputting the message log data into a pre-constructed security prediction model to perform security prediction and obtain a predicted security value, and determining whether the current security risk event is safe according to the predicted security value; the construction process of the security prediction model comprises: obtaining log messages in historical transmission data, and generating a corresponding training data set by judging the end markers of each log message; constructing an initial neural network model and loading each training data set for iterative training, and obtaining a corresponding security detection vector and a loss value of corresponding labeled data; based on the security detection vector and the loss value, modifying the model parameters of the initial neural network model through back propagation until the loss value is less than or equal to a preset threshold, or the number of iterations reaches a preset maximum number of iterations, to generate a trained security prediction model; the process of obtaining the security detection vector comprises: dividing the training data set into a first category data set and a second category data set, wherein the categories of the first category data set include port number, acknowledgement number, data offset field, reserved field and flag bit field, and the categories of the second category data set include sequence number field and acknowledgement number field; judging the first category data set and obtaining a training simple vector; constructing an initial neural network model, and loading the second category data set into the initial neural network model to obtain a training complex security value; constructing a security detection vector according to the training complex security value and the training simple vector.

2. The method of predicting a security risk event of claim 1, wherein, The message log data comprises node, device type, device name, IP address, time, event level, alarm type, source IP address, destination IP address, event protocol, alarm information and detailed information. 3.The method of claim 1, wherein, The preliminary security detection on the message log data comprises at least one of TCP / IP network connection anomaly detection, netstat command network connection anomaly detection, industrial control instruction anomaly detection, network storm detection and network session anomaly detection.

4. The method of claim 1, wherein, The process of judging the first category data set and obtaining a training simple vector comprises: performing AND operation on the data corresponding to each category in each first category data set to obtain an equality judgment value; constructing a training simple vector according to each equality judgment value, wherein the training simple vector is used to represent whether the data in the first category data set is equal.

5. The method of claim 1, wherein, The process of obtaining a training complex security value comprises: generating a corresponding second sub-data set by extracting data in corresponding positions in each second category data set in front-back order; obtaining the number of data sets in each second sub-data set as a length value of the corresponding second sub-data set; Input data of each data set in the second data set in sequence into each neuron structure of the initial neural network model based on the length value to obtain a corresponding detection value, and store the detection value into a corresponding storage structure until the length value is zero; Input each detection value into a hidden layer of the initial neural network to obtain a corresponding training complex security value.

6. A system for predicting a security risk event, the system comprising: The method comprises the following steps: A data acquisition module is configured to acquire original message data corresponding to a security risk event, and write the original message data into a log in a preset format to generate message log data; A security detection module is configured to perform preliminary security detection on the message log data; A security prediction module is configured to, when the preliminary security detection result is safe, input the message log data into a pre-constructed security prediction model to perform security prediction and obtain a prediction security value, and determine whether the current security risk event is safe according to the prediction security value; The construction process of the security prediction model comprises the following steps: Acquire log messages in historical transmission data, and generate corresponding training data sets by judging end markers of each log message; Construct an initial neural network model, load each training data set for iterative training, and obtain a corresponding security detection vector and a loss value of corresponding labeled data; Modify model parameters of the initial neural network model based on the security detection vector and the loss value through back propagation until the loss value is less than or equal to a preset threshold value, or the number of iterations reaches a preset maximum number of iterations, to generate a trained security prediction model; The process of obtaining the security detection vector comprises the following steps: Divide the training data set into a first category data set and a second category data set, wherein the categories of the first category data set include a port number, an acknowledgement number, a data offset field, a reserved field, and a flag bit field, and the categories of the second category data set include a sequence number field and an acknowledgement number field; Judge the first category data set to obtain a training simple vector; Construct an initial neural network model, and load the second category data set into the initial neural network model to obtain a training complex security value; Construct a security detection vector according to the training complex security value and the training simple vector.

7. An electronic device, comprising: The method comprises the following steps: A memory and a processor are communicatively connected, the memory stores computer instructions, and the processor executes the computer instructions to perform the method for predicting a security risk event according to any one of claims 1-5.

8. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer instructions for causing the computer to perform the method for predicting a security risk event according to any one of claims 1-5.

Images