Network security situation awareness method and system based on centrality and intimacy analysis

Abstract

The present invention provides a network security situation awareness method and system based on centrality and intimacy analysis, which can fully consider the situation awareness of threat propagation, meet real-time requirements, and accurately evaluate network security. The method includes: step 1, alarm generation; step 2, alarm single filtering; step 3, alarm double filtering; step 4, centrality analysis: generating a network alarm graph based on the double-filtered alarm information, using centrality analysis to obtain important host nodes in the target network, and participate in subsequent intimacy calculation; network alarm graph, the nodes in the graph are hosts in the target network, and the edges are filtered alarm information; the central node set is obtained according to the centrality result; step 5, intimacy calculation: for the remaining common nodes in the target network, the intimacy with the central node obtained in step 4 is calculated respectively, and the maximum intimacy value is obtained as the situation value of the common node, and the situation change value of each host and the entire network over time is obtained.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security situation awareness, and specifically relates to a network security situation awareness method and system based on centrality and intimacy analysis. Background Art

[0002] Situational awareness is an important research field in network security. It can evaluate and predict possible security threats in the network before malicious attacks occur, which is indispensable for maintaining a secure network environment. Therefore, efficient and accurate network security situational awareness and evaluation methods have always been the research direction of academia.

[0003] At present, the mainstream network security situation awareness can be divided into two categories: qualitative assessment and quantitative assessment. Qualitative assessment mainly evaluates the security of the target network through non-quantitative information such as expert knowledge and experience; quantitative assessment uses quantitative indicators to calculate and analyze the target network security risks. Comprehensive assessment is a combination of qualitative and quantitative assessments; the model is established according to the rules, and the qualitative and quantitative assessment method of the target network security based on all possible behaviors or states in the model is called a model-based assessment method.

[0004] A single qualitative assessment relies too much on expert experience and knowledge, and unreasonable quantification may lead to misinterpretation of certain factors during the assessment, resulting in inaccurate final results, which in turn affects the security results of the network. Most of the current quantitative assessment methods only consider the vulnerability information of a single host, and do not include the threat propagation between hosts in the assessment process. Although comprehensive assessment combines the advantages of both, it takes too long to process, making it difficult to meet real-time requirements, and does not fully consider threat propagation, and the assessment accuracy is still insufficient. In summary, the current situational awareness methods still have the problem of being unable to conduct qualitative and quantitative assessments of the security of the target network in real time and accurately. Summary of the invention

[0005] The present invention is made to solve the above-mentioned problems, and its purpose is to provide a network security situation awareness method and system based on centrality and intimacy analysis, which fully considers the situation awareness of threat propagation and meets the real-time requirements, and can accurately evaluate the security of the target network.

[0006] In order to achieve the above purpose, the present invention adopts the following scheme:

[0007] <Method>

[0008] like Figure 1 As shown, the present invention provides a network security situation awareness method based on centrality and intimacy analysis, comprising the following steps:

[0009] Step 1, alarm generation: Use intrusion detection tools to generate alarm information for traffic data containing attack events on the target network;

[0010] Step 2, alarm first filtering: at least based on the source IP, destination IP, and protocol fields, the alarm information generated by the same attack event is merged, and duplicate alarm information is directly filtered. The merged alarm information is the result of the first filtering and participates in the subsequent steps;

[0011] Step 3, double filtering of alarms: Based on the detailed information of assets in the target network, the alarm output results of the first filtering are analyzed to determine the possibility of the attack events corresponding to the alarms, and the alarm information corresponding to some attack events that are obviously unlikely to occur is further filtered out, and the remaining part is used for subsequent steps;

[0012] Step 4, centrality analysis: Generate a network alarm graph based on the double-filtered alarm information, use centrality analysis to obtain important host nodes in the target network, and participate in subsequent intimacy calculations;

[0013] Step 4-1, generate a network alarm graph from the filtered alarm information. The nodes in the graph are hosts in the target network, and the edges are the filtered alarm information. The alarm has four priorities 1-4. The smaller the priority, the more important it is. The edge priority alert priority Converted to edge weight alert weight , the conversion formula is as follows:

[0014] alert weight =5-alert priority ,

[0015] Step 4-2, use centrality analysis to obtain the centrality of each node in the network alarm graph, and use the centrality to reflect the importance of the node in the network. Finally, the central node set C is obtained based on the centrality results;

[0016] Step 5, intimacy calculation: for the remaining common nodes in the target network, calculate the intimacy with the central node obtained in step 4 respectively, and take the maximum intimacy as the situation value of the common node, and obtain the situation change value of each host and the entire network over time (the situation change curve of each host and the network over time);

[0017] The calculation formula for calculating the intimacy between node i and node j is as follows:

[0018]

[0019] Where n is the number of paths from i to j, is the length of the kth path from i to j; one of i and j is a central node and the other is a common node;

[0020] Suppose the kth path from i to j involves a total of u edges (0, 1, ...u-1), and the weight of the xth edge is alert weightx , then the calculation formula for a single path length is as follows:

[0021]

[0022] In the formula, λ x represents the attenuation factor of the x-th edge. The attenuation factor λ is calculated based on the historical data of the target network and the most accurate data on network security is selected as the optimal hyperparameter for the attenuation factor of each edge.

[0023] Preferably, the network security situation awareness method based on centrality and intimacy analysis provided by the present invention, in step 1, for the source attack data set, uses an intrusion detection tool to generate a number of alarm messages, these alarm messages include alarms for the same attack event and alarm messages with a lower probability of occurrence, and each alarm message contains at least the alarm time, source IP, destination IP, source port, destination port, and usage protocol information.

[0024] Preferably, in the network security situation awareness method based on centrality and intimacy analysis provided by the present invention, in step 2, the alarm interval generated by the same attack event is short, and for each alarm information, a data set to be fused is generated according to the time window; assuming that the alarm information a p The occurrence time is len(a) is the total number of alarms, and the time window threshold t diff , then each warning message a p The dataset A to be fused p as follows:

[0025]

[0026] In the formula, a p and a q Respectively represent the pth and qth alarm information.

[0027] Preferably, in the network security situation awareness method based on centrality and intimacy analysis provided by the present invention, in step 3, if the operating system information in the alarm is inconsistent with the operating system of the destination host, or the vulnerability targeted by the alarm does not exist in the destination host, the alarm is filtered and does not participate in subsequent steps.

[0028] Preferably, in the network security situation awareness method based on centrality and intimacy analysis provided by the present invention, in step 5, the attenuation factor λ is recommended to be around 0.5.

[0029] <System>

[0030] Furthermore, the present invention also provides a network security situation awareness system based on centrality and intimacy analysis that can automatically implement the above <method>, including:

[0031] The alarm generation department uses intrusion detection tools to generate alarm information for traffic data containing attack events on the target network;

[0032] The first filtering unit merges the alarm information generated by the same attack event based on at least the source IP, destination IP, and protocol fields. Duplicate alarm information is directly filtered. The merged alarm information is the result of the first filtering and is involved in subsequent steps.

[0033] The secondary filtering unit analyzes the possibility of the attack events corresponding to the alarm output results of the primary filtering based on the detailed asset information in the target network, and further filters out the alarm information corresponding to some attack events that are obviously unlikely to occur, and the remaining part is used for subsequent steps;

[0034] The centrality analysis unit generates a network alarm graph based on the double-filtered alarm information, uses centrality analysis to obtain important host nodes in the target network, and participates in subsequent intimacy calculations; it includes an alarm graph generation unit and a central node acquisition unit;

[0035] The alarm graph generation unit generates a network alarm graph from the filtered alarm information. The nodes in the graph are hosts in the target network, and the edges are the filtered alarm information. The alarms have four priorities 1-4. The smaller the priority, the more important it is. The edge priority is alerted. prlority Converted to edge weight alert weight , the conversion formula is as follows:

[0036] alert weight =5-alert priority ,

[0037] The central node acquisition unit uses centrality analysis to obtain the centrality of each node in the network alarm graph, and reflects the importance of the node in the network through the centrality. Finally, the central node set C is obtained according to the centrality result;

[0038] The intimacy calculation unit calculates the intimacy of the remaining common nodes in the target network with the central node obtained in the centrality analysis unit, and obtains the maximum intimacy value as the situation value of the common node, and obtains the situation change value of each host and the entire network over time; the calculation formula for the intimacy calculation of node i and node j is as follows:

[0039]

[0040] Where n is the number of paths from i to j, is the length of the kth path from i to j; one of i and j is a central node and the other is a common node;

[0041] Suppose the kth path from i to j involves a total of u edges (0, 1, ...u-1), and the weight of the xth edge is alert weightx , then the calculation formula for a single path length is as follows:

[0042]

[0043] In the formula, λ x represents the attenuation factor of the xth edge. The attenuation factor λ is calculated based on the historical data of the target network, and the set of data with the most accurate network security estimation is selected as the optimal hyperparameter of the attenuation factor of each edge.

[0044] The control unit is connected to the alarm generation unit, the first filtering unit, the second filtering unit, the centrality analysis unit, and the intimacy calculation unit to control their operations.

[0045] The network security situation awareness system based on centrality and intimacy analysis provided by the present invention may also include: an input display unit, which is communicatively connected to the control unit and is used to allow the user to input operation instructions and perform corresponding displays.

[0046] Preferably, the network security situation awareness system based on centrality and intimacy analysis provided by the present invention, in the alarm generation unit, uses an intrusion detection tool to generate a number of alarm messages for the source attack data set, and these alarm messages include alarms for the same attack event and alarm messages with a lower probability of occurrence, and each alarm message includes at least the alarm time, source IP, destination IP, source port, destination port, and usage protocol information.

[0047] Preferably, in the network security situation awareness system based on centrality and intimacy analysis provided by the present invention, in the first filtering unit, the alarm interval generated by the same attack event is short, and for each alarm information, a data set to be fused is generated according to the time window; assuming that the alarm information a p The occurrence time is len(a) is the total number of alarms, and the time window threshold t diff , then each warning message a p The dataset A to be fused p as follows:

[0048]

[0049] In the formula, a p and a q Respectively represent the pth and qth alarm information.

[0050] Preferably, in the network security situation awareness system based on centrality and intimacy analysis provided by the present invention, in the double filtering unit, if the operating system information in the alarm is inconsistent with the operating system of the destination host, or the vulnerability targeted by the alarm does not exist in the destination host, the alarm will be filtered and will not participate in subsequent steps.

[0051] Functions and Effects of the Invention

[0052] The network security situation awareness method and system based on centrality and intimacy analysis provided by the present invention performs situation awareness based on intimacy and centrality, fully considers the threat propagation of hosts in the network, and alerts the priority of edges. priority Converted to edge weight alert weight , and takes the dangerous connections of each host in the target network into consideration, selects the more important hosts in the network by centrality, and then calculates the intimacy between the remaining hosts and the important hosts by a specific formula, and obtains the maximum intimacy as the situation value of the common node, and obtains the situation change value of each host and the entire network over time, with fast calculation speed and good real-time performance, which effectively improves the speed of situation perception and evaluation and meets the real-time requirements. In addition, the present invention has universality, is independent of the generation method of the alarm information, and can be applied to various types of networks. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 It is a flow chart of a network security situation awareness method based on centrality and intimacy analysis involved in an embodiment of the present invention;

[0054] Figure 2 A network alarm diagram involved in an embodiment of the present invention;

[0055] Figure 3 The embodiment of the present invention relates to a situation curve comparison diagram using the method of the present invention, the prior art method and actual measured data. DETAILED DESCRIPTION

[0056] The specific implementation scheme of the network security situation awareness method and system based on centrality and intimacy analysis involved in the present invention is described in detail below with reference to the accompanying drawings.

[0057] <Example 1>

[0058] like Figure 1 As shown, the network security situation awareness method based on centrality and intimacy analysis involved in this embodiment 1 has the following specific steps:

[0059] Step 1: Alarm generation: Use intrusion detection tools to generate alarm information for traffic data containing attack events on the target network.

[0060] For the source attack data set, an intrusion detection tool is used to generate several alarm messages. These alarm messages include alarms for the same attack event and alarm messages with a lower probability of occurrence. Each alarm message contains information such as alarm time, source IP, destination IP, source port, destination port, and protocol used.

[0061] For the source attack data set, an intrusion detection tool is used to generate several alarm information, which includes alarm time, source IP, destination IP, source port, destination port, protocol used, etc. The generated alarm is a collection of redundant information, that is, there are alarms for the same attack event and alarms with a low probability of occurrence. This alarm information will be used as a source data set to participate in subsequent steps.

[0062] Step 2, alarm first filtering: After obtaining the alarm information, the alarm information generated by the same attack event is merged based on the source IP, destination IP, used protocol and other fields. The duplicate alarm information is directly filtered. The merged alarm information is the result of the first filtering and participates in the subsequent steps.

[0063] The alarm intervals generated by the same attack event are relatively short. For each alarm message, a data set to be fused is generated based on the time window. p The occurrence time is len(a) is the total number of alarms, and the time window threshold t diff , then each warning message a p The dataset A to be fused p as follows:

[0064]

[0065] In the formula, a p and a q Respectively represent the pth and qth alarm information.

[0066] For each alarm a p The dataset A to be fused p The alarms in the same attack event are calculated for similarity and the alarms generated by the same attack event are merged. Specifically, the alarms generated by the same attack event should be initiated by the same LAN and the destination host should also be in the same LAN, so the same bit ratio of the host IP is used to reflect the IP similarity, and the matching is performed from left to right. The calculation formula is as follows:

[0067] IP_sim=sum(sim bytes) / 32

[0068] In the formula, sum(sim bytes) represents the number of bits that are the same in the two IP addresses.

[0069] In addition, the same attack event should have the following common features: source port, destination port, attack type, protocol used, and attack priority. Based on the above fields in the alarm, the calculation formula for alarm similarity is as follows:

[0070] alert_sim=∑key p *weight(key p ),

[0071] In the formula, key p Indicates the field of the pth alarm information. Weight indicates the key. p The corresponding weight.

[0072] If the similarity between two alarms is greater than a threshold, the two alarms are considered to belong to the same attack event and are fused. The fused alarm does not participate in all subsequent steps.

[0073] Step 3, double filtering of alarms: Based on the detailed asset information in the target network, analyze the possibility of the attack event corresponding to the alarm output result of the first filtering, and further filter out the alarm information corresponding to some attack events that are obviously not going to happen. The remaining part is used for subsequent steps, thereby efficiently filtering redundant alarms and reducing the number of alarm samples that need to be analyzed.

[0074] There are irrelevant alarms for unsuccessful events in the alarm. The operating system and vulnerability targeted by this type of alarm do not match the target host, so the attack event corresponding to the alarm will not occur. Double filter the alarm information output in step 2. If the operating system information in the alarm is inconsistent with the operating system of the target host, or the vulnerability targeted by the alarm does not exist in the target host, the alarm is filtered and does not participate in the subsequent steps.

[0075] Step 4, centrality analysis: Generate a network alarm graph based on the double-filtered alarm information, use centrality analysis to obtain the more important host nodes in the target network, and participate in the subsequent intimacy calculation.

[0076] Step 4-1, such as Figure 2 As shown, the filtered alarm information is used to generate a network alarm graph. The nodes in the graph are hosts in the target network, and the edges are the filtered alarm information. The alarm has four priorities 1-4. The smaller the priority, the more important it is. The priority of the edge is alert priority Converted to edge weight alert weight , the conversion formula is as follows:

[0077] alert weight =5-alert priority ,

[0078] Step 4-2, use centrality analysis to obtain the centrality of each node in the network alarm graph, and use the centrality to reflect the importance of the node in the network. Finally, the central node set C is obtained based on the centrality results.

[0079] There are many nodes in the network alarm diagram, so the centrality is used to analyze the centrality of each node. The centrality can reflect the importance of the node in the network. The greater the centrality, the higher the ranking. The proportion of central nodes can be adjusted according to the network environment.

[0080] Step 5, intimacy calculation: For the remaining common nodes in the target network, calculate their intimacy with the central node obtained in step 4 respectively, and take the maximum intimacy value as the situation value of the common node, obtain the situation change value of each host and the entire network over time, and finally output the situation change curve of each host and the network over time, so as to achieve the purpose of situation awareness.

[0081] The calculation formula of the situation value of node i at time t is as follows:

[0082] sit_value(i,t)=max{Intimacy(i,cent_node),cent_node∈C},

[0083] The calculation formula for calculating the intimacy between node i and node j is as follows:

[0084]

[0085] Where n is the number of paths from i to j, is the length of the kth path from i to j; one of i and j is a central node and the other is an ordinary node.

[0086] Suppose the kth path from i to j involves a total of u edges (0, 1, ...u-1), and the weight of the xth edge is alert weightx , then the calculation formula for a single path length is as follows:

[0087]

[0088] In the formula, λ x represents the attenuation factor of the x-th edge. The attenuation factor λ is calculated based on the historical data of the target network and the most accurate data on network security is selected as the optimal hyperparameter for the attenuation factor of each edge.

[0089] like Figure 3As shown in the figure, from the leftmost end of the situation curve graph, from top to bottom, the situation curves obtained are: ② the environment-based method of the prior art, ④ the measured data (data set), ① the method of the present invention, and ③ the hierarchical method of the prior art. The similarity between the trend of the method of the present invention and the measured data is significantly higher, and the situation curve overlap is better, which confirms the accuracy of the method.

[0090] <Example 2>

[0091] In the second embodiment, a network security situation awareness system based on centrality and intimacy analysis which can automatically implement the above method of the present invention is provided. The system includes an alarm generation unit, a first filtering unit, a second filtering unit, a centrality analysis unit, an intimacy calculation unit, an input display unit, and a control unit.

[0092] The alarm generation unit executes the contents described in step 1 above, and uses an intrusion detection tool to generate alarm information for the traffic data of the target network containing the attack event.

[0093] The first filtering unit executes the content described in step 2 above, and merges the alarm information generated by the same attack event based on at least the source IP, destination IP, and protocol fields. The duplicate alarm information is directly filtered, and the merged alarm information is the result of the first filtering and participates in the subsequent steps.

[0094] The double filtering unit performs the content described in step 3 above. It analyzes the possibility of the attack event corresponding to the alarm output result of the first filter based on the detailed asset information in the target network, and further filters out the alarm information corresponding to some attack events that are obviously not going to happen. The remaining part is used for subsequent steps.

[0095] The centrality analysis unit executes the content described in step 4 above, generates a network alarm graph based on the double-filtered alarm information, uses centrality analysis to obtain important host nodes in the target network, and participates in subsequent intimacy calculations; it includes an alarm graph generation unit and a central node acquisition unit.

[0096] The alarm graph generation unit executes the content described in step 4-1 above, and generates a network alarm graph with the filtered alarm information. The nodes in the graph are hosts in the target network, and the edges are the filtered alarm information. The alarm has four priorities 1-4. The smaller the priority, the more important it is. The priority of the edge is alerted. priority Converted to edge weight alert weight .

[0097] The central node acquisition unit executes the content described in step 4-2 above, uses centrality analysis to obtain the centrality of each node in the network alarm graph, reflects the importance of the node in the network through the centrality, and finally obtains the central node set C based on the centrality result.

[0098] The intimacy calculation unit executes the content described in step 5 above. For the remaining common nodes in the target network, the intimacy with the central node obtained in the centrality analysis unit is calculated respectively, and the maximum intimacy value is obtained as the situation value of the common node, and the situation change value of each host and the entire network over time is obtained.

[0099] The input display unit is used to allow the user to input operation instructions, and to display the input, output and intermediate processing data of the corresponding unit or unit according to the operation instructions.

[0100] The control unit is connected to the alarm generation unit, the first filtering unit, the second filtering unit, the centrality analysis unit, the intimacy calculation unit, and the input display unit to control their operations.

[0101] The above embodiments are merely examples of the technical solutions of the present invention. The network security situation awareness method and system based on centrality and intimacy analysis involved in the present invention are not limited to the contents described in the above embodiments, but are subject to the scope defined by the claims. Any modification, supplement or equivalent substitution made by technical personnel in the field to which the present invention belongs on the basis of this embodiment is within the scope of protection required by the claims of the present invention.

Claims

1. A network security situation awareness method based on centrality and intimacy analysis, characterized in that: The following steps are involved: Step 1, alarm generation: Use intrusion detection tools to generate alarm information for traffic data containing attack events on the target network; Step 2, alarm first filtering: at least based on the source IP, destination IP, and protocol fields, the alarm information generated by the same attack event is merged, and duplicate alarm information is directly filtered. The merged alarm information is the result of the first filtering and participates in the subsequent steps; Step 3, double filtering of alarms: Based on the detailed information of assets in the target network, the alarm output results of the first filtering are analyzed to determine the possibility of the attack events corresponding to the alarms, and the alarm information corresponding to some attack events that are obviously unlikely to occur is further filtered out, and the remaining part is used for subsequent steps; Step 4, centrality analysis: Generate a network alarm graph based on the double-filtered alarm information, use centrality analysis to obtain important host nodes in the target network, and participate in subsequent intimacy calculations; Step 4-1, generate a network alarm graph from the filtered alarm information. The nodes in the graph are hosts in the target network, and the edges are the filtered alarm information. The alarms have four priorities 1-4. The smaller the priority, the more important it is. Converted to edge weight , the conversion formula is as follows: ， Step 4-2: Use centrality analysis to obtain the centrality of each node in the network alarm graph. The centrality reflects the importance of the node in the network. Finally, the central node set is obtained based on the centrality results. C ; Step 5, intimacy calculation: For the remaining common nodes in the target network, calculate the intimacy with the central node obtained in step 4 respectively, and take the maximum intimacy value as the situation value of the common node, and obtain the situation change value of each host and the entire network over time; i Node and j The calculation formula for node intimacy is as follows: ， In the formula, n For i arrive j The number of paths, For i arrive j The length of the kth path; i and j One of them is the central node and the other is a common node; Set from i to j No. k The paths involved u Edges (0,1,… u -1), No. x The weight of the edge is , then the calculation formula for a single path length is as follows: In the formula, Indicates x The attenuation factor λ is calculated based on the historical data of the target network, and the set of data with the most accurate estimation of network security is selected as the optimal hyperparameter of the attenuation factor of each edge.

2. The network security situation awareness method based on centrality and intimacy analysis according to claim 1 is characterized by: in, In step 1, for the source attack data set, an intrusion detection tool is used to generate several alarm messages, which include alarms for the same attack event and alarm messages with a lower probability of occurrence. Each alarm message contains at least the alarm time, source IP, destination IP, source port, destination port, and protocol information.

3. The network security situation awareness method based on centrality and intimacy analysis according to claim 1 is characterized by: in, In step 2, the alarm interval generated by the same attack event is short. For each alarm information, a data set to be fused is generated according to the time window. The occurrence time is , is the total number of alarms, time window threshold , then each warning message The dataset to be fused as follows: ， In the formula, and Respectively represent p and q Warning information.

4. The network security situation awareness method based on centrality and intimacy analysis according to claim 1 is characterized by: in, In step 3, if the operating system information in the alarm is inconsistent with the operating system of the target host, or the vulnerability targeted by the alarm does not exist in the target host, the alarm is filtered and does not participate in subsequent steps.

5. A network security situation awareness system based on centrality and intimacy analysis, characterized in that: include: The alarm generation department uses intrusion detection tools to generate alarm information for traffic data containing attack events on the target network; The first filtering unit merges the alarm information generated by the same attack event based on at least the source IP, destination IP, and protocol fields. Duplicate alarm information is directly filtered. The merged alarm information is the result of the first filtering and is involved in subsequent steps. The secondary filtering unit analyzes the possibility of the attack events corresponding to the alarm output results of the primary filtering based on the detailed asset information in the target network, and further filters out the alarm information corresponding to some attack events that are obviously unlikely to occur, and the remaining part is used for subsequent steps; The centrality analysis unit generates a network alarm graph based on the double-filtered alarm information, uses centrality analysis to obtain important host nodes in the target network, and participates in subsequent intimacy calculations; it includes an alarm graph generation unit and a central node acquisition unit; The alarm graph generation unit generates a network alarm graph from the filtered alarm information. The nodes in the graph are hosts in the target network, and the edges are the filtered alarm information. The alarms have four priorities 1-4. The smaller the priority, the more important it is. Converted to edge weight , the conversion formula is as follows: ， The central node acquisition unit uses centrality analysis to obtain the centrality of each node in the network alarm graph, and reflects the importance of the node in the network through centrality. Finally, the central node set is obtained based on the centrality results. C ; The intimacy calculation unit calculates the intimacy of the remaining common nodes in the target network with the central node obtained in the centrality analysis unit, and obtains the maximum intimacy value as the situation value of the common node, and obtains the situation change value of each host and the entire network over time; i Node and j The calculation formula for node intimacy is as follows: ， In the formula, n For i arrive j The number of paths, For i arrive j The length of the kth path; i and j One of them is the central node and the other is a common node; Set from i to j No. k The paths involved u Edges (0,1,… u -1), No. x The weight of the edge is , then the calculation formula for a single path length is as follows: In the formula, Indicates x The decay factor λ is calculated based on the historical data of the target network, and the set of data with the most accurate network security estimation is selected as the optimal hyperparameter of the decay factor of each edge; The control unit is connected to the alarm generation unit, the first filtering unit, the second filtering unit, the centrality analysis unit, and the intimacy calculation unit to control their operations.

6. The situation awareness system based on centrality and intimacy analysis according to claim 5 is characterized in that: Also includes: The input display unit is connected to the control unit for communication and is used to allow the user to input operation instructions and display them accordingly.

7. The network security situation awareness system based on centrality and intimacy analysis according to claim 5 is characterized by: in, In the alarm generation unit, for the source attack data set, an intrusion detection tool is used to generate several alarm messages. These alarm messages include alarms for the same attack event and alarm messages with a lower probability of occurrence. Each alarm message contains at least the alarm time, source IP, destination IP, source port, destination port, and protocol information used.

8. The network security situation awareness system based on centrality and intimacy analysis according to claim 5 is characterized by: in, In the first filtering part, the alarm interval generated by the same attack event is short. For each alarm information, a data set to be fused is generated according to the time window. The occurrence time is , is the total number of alarms, time window threshold , then each warning message The dataset to be fused as follows: ， In the formula, and Respectively represent p and q Warning information.

9. The network security situation awareness system based on centrality and intimacy analysis according to claim 5 is characterized by: in, In the double filtering section, if the operating system information in the alarm is inconsistent with the operating system of the target host, or the vulnerability targeted by the alarm does not exist in the target host, the alarm is filtered and does not participate in subsequent steps.

Images