A network data asset cross-validation method and system

Abstract

The present invention provides a network data asset cross-validation method and system, which relates to the field of data processing technology. The method includes: obtaining active detection results of network data assets through active asset detection technology; obtaining passive detection results of network data assets through passive asset detection technology; cross-validating the active detection results of network data assets with the passive detection results of network data assets to determine the current network security. The present invention can effectively combine active detection and passive detection technology, make full use of the advantages of both for cross-validation, and improve the comprehensiveness of network data asset detection results and the accuracy of network security monitoring results.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a network data asset cross-validation method and system. Background Art

[0002] Cyberspace assets refer to various resources and entities existing in cyberspace, including but not limited to data assets, equipment assets, network service assets, software assets, etc. Identifying the ownership of network assets helps to better manage network resources, optimize different assets, and improve network performance and efficiency.

[0003] Traditional cyberspace asset detection methods mainly include active detection and passive detection. Passive detection is a method that does not directly initiate requests or scans to the target, but obtains information about the target by monitoring network traffic and observing data in the network. Passive detection does not actively initiate connections or scans to the target, but passively collects information. This method is usually used to monitor the network, discover and identify the existence and behavior of target assets without having a direct impact on the target assets. Active detection is a method that directly initiates requests and scans to the target, used to actively discover and identify assets in the network. Active detection sends specific requests to the target, such as port scans, vulnerability scans, etc., to obtain information about the target assets. This method is a proactive way to help gain a deeper understanding of the security status of the network and discover potential security vulnerabilities.

[0004] However, existing technologies often use active detection or passive detection alone to search for network data assets and monitor network security, which will inevitably lead to limitations. Active detection requires prior knowledge of the target to be scanned, and may miss unknown devices or services. In addition, the information obtained by active detection may only be static information of the network and cannot reflect the actual dynamic traffic and communication patterns. Passive detection is difficult to accurately determine the specific type and function of the device by passively monitoring the traffic. It cannot actively discover unknown devices or services in the network and can only passively detect the actual traffic. Using active detection or passive detection alone will result in incomplete network data asset detection results and inaccurate network security monitoring results. Summary of the invention

[0005] In order to solve the technical problem in the prior art that the use of active detection or passive detection alone will lead to incomplete network data asset detection results and inaccurate network security monitoring results, the present invention provides a network data asset cross-validation method and system.

[0006] The technical solution provided by the embodiment of the present invention is as follows:

[0007] First aspect

[0008] An embodiment of the present invention provides a network data asset cross-validation method, comprising:

[0009] S1: Obtain active detection results of network data assets through active asset detection technology;

[0010] S2: Obtain the passive detection results of network data assets through passive asset detection technology;

[0011] S3: Cross-validate the active detection result of the network data assets and the passive detection result of the network data assets to determine the current network security.

[0012] Second aspect

[0013] An embodiment of the present invention provides a network data asset cross-validation system, comprising:

[0014] processor;

[0015] A memory having computer-readable instructions stored thereon, wherein when the computer-readable instructions are executed by the processor, the network data asset cross-validation method as described in the first aspect is implemented.

[0016] The third aspect

[0017] An embodiment of the present invention provides a computer-readable storage medium, on which a computer program is stored. When the program is executed by a processor, the network data asset cross-validation method as described in the first aspect is implemented.

[0018] The beneficial effects brought about by the technical solution provided by the embodiment of the present invention include at least:

[0019] In the present invention, the current network security is determined by cross-verifying the active detection results of network data assets with the passive detection results of network data assets. This can effectively combine active detection and passive detection technologies, fully utilize the advantages of both for cross-verification, and improve the comprehensiveness of network data asset detection results and the accuracy of network security monitoring results. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0021] Figure 1 A schematic diagram of a flow chart of a network data asset cross-validation method provided by an embodiment of the present invention;

[0022] Figure 2 A schematic diagram of the structure of a network data asset cross-validation method provided by an embodiment of the present invention;

[0023] Figure 3 A schematic diagram of a flow chart of a network security method provided by an embodiment of the present invention;

[0024] Figure 4 A schematic diagram of the structure of a network data asset cross-validation system provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0025] The technical solution of the present invention is described below in conjunction with the accompanying drawings.

[0026] In the embodiments of the present invention, words such as "exemplarily" and "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described as "example" in the present invention should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of the word "example" is intended to present the concept in a specific way. In addition, in the embodiments of the present invention, the meaning expressed by "and / or" can be both, or it can be either of the two.

[0027] In the embodiments of the present invention, "image" and "picture" can sometimes be used interchangeably. It should be noted that when the difference between them is not emphasized, the meanings they intend to express are the same. "of", "corresponding, relevant" and "corresponding" can sometimes be used interchangeably. It should be noted that when the difference between them is not emphasized, the meanings they intend to express are the same.

[0028] In the embodiments of the present invention, sometimes a subscript such as W1 may be mistakenly written as a non-subscript such as W1. When the difference is not emphasized, the meanings to be expressed are consistent.

[0029] In order to make the technical problems, technical solutions and advantages to be solved by the present invention more clear, a detailed description will be given below with reference to the accompanying drawings and specific embodiments.

[0030] Reference Manual Attached Figure 1 , showing a flow chart of a network data asset cross-validation method provided in an embodiment of the present invention.

[0031] Reference Manual Attached Figure 2 , showing a structural diagram of a network data asset cross-validation method provided by an embodiment of the present invention.

[0032] The embodiment of the present invention provides a network data asset cross-validation method, which can be implemented by a network data asset cross-validation device, which can be a terminal or a server. The processing flow of the network data asset cross-validation method can include the following steps:

[0033] S1: Obtain active detection results of network data assets through active asset detection technology.

[0034] Among them, active asset detection technology is a method used to obtain information about devices, services, and applications in the network. It obtains information about data assets by actively scanning network devices and systems, and is a commonly used technical means in the field of network management and security.

[0035] Furthermore, active asset detection technologies mainly include TCP scanning, UDP scanning, operating system identification, service identification, and vulnerability scanning. The present invention does not limit the specific active asset detection technology. At the same time, there are many mature active asset detection technologies, and the present invention will not repeat the principles and specific steps.

[0036] S2: Obtain the passive detection results of network data assets through passive asset detection technology.

[0037] Among them, passive asset detection technology is a technology that does not require active requests, but passively monitors network traffic and data packets to obtain information such as devices, services, and applications in the network. Compared with active asset detection technology, passive detection does not generate additional traffic in the network and is more concealed and secure.

[0038] Furthermore, passive asset detection technologies mainly include network traffic monitoring, network equipment log analysis, SNMP monitoring, network intrusion detection system (IDS), network intrusion prevention system (IPS), and DNS analysis, etc. The present invention does not limit the specific passive asset detection technology. At the same time, there are many very mature passive asset detection technologies, and the present invention will not repeat the principles and specific steps.

[0039] S3: Cross-validate the active detection results of network data assets with the passive detection results of network data assets to determine the current network security.

[0040] It should be noted that by cross-validating the results of active detection of network data assets with the results of passive detection of network data assets, and then determining the current network security, we can effectively combine active detection and passive detection technologies, make full use of the advantages of both for cross-validation, and improve the comprehensiveness of network data asset detection results and the accuracy of network security monitoring results.

[0041] Reference Manual Attached Figure 3 , which shows a flow chart of a network security method provided by an embodiment of the present invention.

[0042] In a possible implementation, S3 specifically includes sub-steps S301 and S302:

[0043] S301: Cross-validate the active detection results of network data assets and the passive detection results of network data assets to determine the consistency index, integrity index, correlation index and data flow closed-loop index of the current network data assets.

[0044] Among them, the consistency index is used to measure the consistency between the active detection results and the passive detection results. In the cross-validation of network data assets, the consistency index is used to determine the degree to which the active detection and passive detection methods detect the same assets.

[0045] For network security monitoring, if the consistency index is too low, it may mean that there are unknown or overlooked assets in the network, which may be potential security threats.

[0046] Optionally, the consistency index may be determined by:

[0047] Cross-validate the active detection results of network data assets with the passive detection results of network data assets to identify inconsistent network data assets.

[0048] Specifically, the active detection results of network data assets can be compared with the passive detection results of network data assets one by one to complete cross-validation.

[0049] Conduct targeted supplementary detection on inconsistent network data assets.

[0050] Specifically, supplementary detection refers to targeted passive detection of network data assets that are actively detected but not detected by passive detection, and targeted active detection of network data assets that are passively detected but not detected by active detection.

[0051] Based on the results of the supplemental detection, determine the number of network data assets detected by both active and passive detection.

[0052] According to the ratio of the number of network data assets detected by both active detection and passive detection to the number of detected network data assets, the consistency index of the current network data assets is determined:

[0053]

[0054] Among them, y represents the consistency index, s ab Indicates the number of network data assets detected by both active and passive detection, st Indicates the number of detected network data assets, s a Indicates the number of network data assets detected actively but not detected by passive detection, s b Indicates the number of network data assets detected passively but not detected by active detection.

[0055] In the present invention, the calculation of the consistency index compares the number of assets detected by both active detection and passive detection with the total number of assets detected, thereby obtaining a percentage that reflects the degree of consistency of the conclusions drawn by the two detection methods, and can more accurately determine the consistency level of network data assets. By calculating the consistency index, network administrators can easily track and monitor whether the results of active detection and passive detection are consistent. If the consistency index is low, it may be necessary to further adjust the detection strategy or check the effectiveness of the detection method to improve the consistency and security of network data assets.

[0056] Furthermore, the completeness index is used to measure the ratio of the detected network data assets to the total number of actual network data assets. In the cross-validation of network data assets, the completeness index is used to determine whether the detected assets cover the entire network data asset library.

[0057] For network security monitoring, if the integrity index is too low, it may mean that there are unauthorized devices or unknown network nodes in the network. These devices or network nodes may be potential security threats. It may also mean that network data assets have been tampered with or damaged.

[0058] Optionally, the integrity indicator may be determined by:

[0059] The active detection results of network data assets and the passive detection results of network data assets are combined and counted.

[0060] The integrity index of the current network data assets is determined based on the ratio of the total number of network data assets detected by active detection and passive detection to the total number of network data assets recorded in the network data asset database:

[0061]

[0062] Among them, w represents the integrity index, s t It represents the number of detected network data assets, and s0 represents the total number of network data assets recorded in the network data asset database.

[0063] In the present invention, when determining the integrity of network data assets, comparing the number of detected assets with the total number of assets recorded in the database helps manage and maintain network assets. If the number of detected assets differs greatly from the total number of records, it may mean that the network database needs to be updated or there are undetected assets. By calculating the integrity index, the efficiency and accuracy of active and passive detection methods can be evaluated. If the integrity index is low, it may be necessary to further optimize the detection strategy or improve the detection method to improve the efficiency and accuracy of the detection of network data assets.

[0064] Furthermore, the correlation index is used to measure the degree of correlation between two different detection methods (active and passive), which is usually evaluated by calculating the relative entropy (KL divergence) of the probability distribution.

[0065] Among them, relative entropy, also known as KL divergence (Kullback-Leibler divergence), is a method used to measure the difference between two probability distributions.

[0066] For network security monitoring, if the correlation index is too low, it means that the correlation between the active detection results of network data assets and the passive detection results of network data assets is too low, which may mean that the activities of certain network data assets in the network are inconsistent with normal conditions, which may be a sign of security threats.

[0067] Optionally, the correlation index may be determined by:

[0068] Calculate the relative entropy between the active detection results of network data assets and the passive detection results of network data assets to obtain the correlation index:

[0069]

[0070] Among them, g represents the correlation index, D KL represents KL divergence calculation, P represents the active detection result of network data assets, Q represents the passive detection result of network data assets, and P k represents the probability value of the kth network data asset in the active detection result of network data assets, Q k Represents the probability value of the kth network data asset in the passive detection result of network data assets, k=1,2,L,s t ,s t Indicates the number of detected network data assets.

[0071] In the present invention, by calculating the relative entropy, the effectiveness of active detection and passive detection methods in discovering network data assets can be evaluated. If the relative entropy is large, it means that the results obtained by the two methods are quite different and the correlation is low. It may be necessary to further optimize the detection strategy or improve the detection method to improve the efficiency and accuracy of the detection of network data assets. The increase in relative entropy may mean that there is a large deviation between the results of active detection and passive detection, which may be caused by changes in the network environment, imperfect detection methods, or network attacks. Therefore, a larger correlation index may help to discover potential abnormal situations or security issues, and provide early warning and processing.

[0072] Furthermore, the data flow closed loop index is used to evaluate whether the various data flows in the network device diagram can form a closed loop. This is very important for determining the correctness of network device configuration and the rationality of network traffic.

[0073] For network security monitoring, the closed-loop index helps detect whether the various data flows in the network device diagram can form a closed loop, monitor whether there are abnormal loops and conflicts, and avoid unexpected data paths or unauthorized access. This helps prevent malicious traffic and data leakage. If the closed-loop index is too low, the detected asset topology is chaotic or unclear, which may mean that there are unauthorized data flow paths in the network, which may be used by attackers to enter the network and perform malicious activities.

[0074] Optionally, the method for determining the data flow closed-loop index includes:

[0075] Determine the network device map based on the results of active detection of network data assets.

[0076] Based on the passive detection results of network data assets, the network device map is cross-validated and corrected.

[0077] Analyze whether the various data flows in the revised network equipment diagram can be closed.

[0078] According to the results of whether various data flows can be closed-loop, determine the data flow closed-loop index:

[0079]

[0080] Among them, b represents the closed-loop index of data flow, s c represents the number of data flows that can be closed, and S represents the total number of data flows used for testing.

[0081] In the present invention, the data flow closed-loop index can help determine whether the data transmission path in the network is complete and connected, which helps to better understand the data flow in the network, discover abnormal data flows or abnormal data transmission paths, and thus improve the reliability of network data flow analysis. By analyzing the data flow closed-loop index, data flow interruptions or incompleteness can be discovered, which helps network administrators and security teams optimize the allocation of network resources and improve data transmission efficiency and network performance.

[0082] S302: Determine the current network security based on the K nearest neighbor algorithm according to the consistency index, integrity index, correlation index and data flow closed-loop index of the current network data assets.

[0083] Among them, K-Nearest Neighbors (KNN) is a basic machine learning algorithm, which is often used for classification and regression problems. Its main principle is that if most of the K most similar samples (i.e., nearest neighbors) of a sample in the feature space belong to a certain category, then the sample also belongs to this category and has the average value of this category.

[0084] However, the traditional K nearest neighbor algorithm often uses the simplest and most direct Euclidean distance when calculating the distance, ignoring the importance of various factors, resulting in easy deviation when selecting the nearest neighbor, thereby affecting the classification effect. Therefore, the present invention proposes a new K nearest neighbor algorithm.

[0085] In a possible implementation, S302 specifically includes S3021 to S3026:

[0086] S3021: Construct a feature vector of the current network data asset based on the consistency index, integrity index, correlation index and data flow closed-loop index of the current network data asset.

[0087] S3022: Calculate the distance between the feature vector of the current network data asset and the feature vectors of each network data asset in the network data asset database:

[0088]

[0089] Among them, D i represents the distance between the feature vector of the current network data asset and the feature vector of the ith network data asset in the network data asset database. X represents the feature vector of the current network data asset. X=(y,w,g,b), y represents the consistency index, w represents the integrity index, g represents the correlation index, b represents the data flow closed-loop index, and X i represents the feature vector of the ith network data asset, X i =(y i,w i ,g i ,b i ), y i represents the consistency index of the ith network data asset, w i represents the integrity index of the ith network data asset, g i represents the correlation index of the ith network data asset, b i represents the closed-loop index of the data flow of the i-th network data asset, λ y Represents the weight coefficient of the consistency index, λ w Represents the weight coefficient of the integrity index, λ g Represents the weight coefficient of the correlation index, λ b Indicates the weight coefficient of the data flow closed-loop index.

[0090] Among them, those skilled in the art can set the weight coefficient λ of the consistency index according to actual conditions. y , the weight coefficient λ of the integrity index w , the weight coefficient λ of the correlation index g And the weight coefficient λ of the data flow closed-loop index b The present invention does not limit the size.

[0091] In the present invention, using different weights for different features can more accurately measure the similarity or distance between two samples, which helps the K nearest neighbor algorithm to better select the nearest neighbor and improve the accuracy of prediction. Through weighted processing, the similarity measurement is more discriminative. For samples that are similar but have different importance, the weighted distance can better reflect their differences, thereby better distinguishing different categories of network data assets.

[0092] S3023: Arrange the network data assets in the network data asset database in descending order according to the distance from the current network data asset.

[0093] S3024: Select the top K network data assets as the K nearest neighbors of the current network data asset.

[0094] S3025: Count the probabilities that the K nearest neighbors belong to each network security category, where the network security categories include normal, suspicious, and abnormal.

[0095] S3026: The network security category with the highest probability is taken as the category to which the current network data asset belongs.

[0096] In the present invention, the top K neighbors are selected for classification, the probabilities of them belonging to various network security categories are counted, and the network security category with the highest probability is used as the category of the current network data asset, which can improve the accuracy, robustness and generalization ability of classification and provide intuitive classification explanation.

[0097] Furthermore, the traditional K-nearest neighbor algorithm often faces the problem of difficulty in determining the number of neighbors K. Choosing an inappropriate K value may cause the model to overfit or underfit. If the K value is too small, the model will be too complex and easily affected by noise, resulting in overfitting; if the K value is too large, the model will be too simple and easily ignore the details of the data, resulting in underfitting.

[0098] In a possible implementation, the training method of the K nearest neighbor algorithm specifically includes:

[0099] Construct the loss function for the K-nearest neighbor algorithm.

[0100] Specifically, the loss function may adopt one or more of a cross entropy loss function, a mean square error loss function, and a logarithmic loss function.

[0101] A sample data set is obtained, where the sample data set includes multiple training samples, and each training sample includes a feature vector.

[0102] Each training sample is classified using the K nearest neighbor algorithm.

[0103] With the goal of minimizing the loss function, the parameters of the K nearest neighbor algorithm are searched through the improved sparrow search algorithm, and the optimal parameter set of the K nearest neighbor algorithm is determined to complete the training of the K nearest neighbor algorithm.

[0104] The parameters of the K nearest neighbor algorithm include: the number of neighbors K, the weight coefficient λ of the consistency index y , the weight coefficient λ of the integrity index w , the weight coefficient λ of the correlation index g And the weight coefficient λ of the data flow closed-loop index b .

[0105] In a possible implementation, the objective is to minimize the loss function, and the parameters of the K nearest neighbor algorithm are searched by an improved sparrow search algorithm to determine the optimal parameter set of the K nearest neighbor algorithm, specifically including:

[0106] Initialize the sparrow population, which contains multiple individuals, each of which represents a feasible parameter set.

[0107] The inverse of the loss function is used as the fitness function of the improved sparrow search algorithm:

[0108]

[0109] Among them, σ() represents the fitness function, L() represents the loss function, and θ represents the parameter set.

[0110] Individuals in a sparrow population were classified into finders, followers, and anti-predators.

[0111] It should be noted that by dividing the sparrow individuals into discoverers, followers and anti-predators, the algorithm can perform global search and local search at the same time. During the iteration process, the discoverer calculates the distance with other sparrow individuals to find the optimal neighbor individuals with higher fitness values, thereby promoting global search; while followers and anti-predators search in local areas, which helps to converge to the local optimal solution faster.

[0112] Calculate the distance between the current discoverer and other sparrow individuals:

[0113] D j =||XX j ||2

[0114] Among them, D j represents the distance between the current discoverer and the jth sparrow individual, X represents the parameter set represented by the current discoverer, and X j represents the parameter set represented by the j-th sparrow individual, and ||||2 represents the calculation of the second norm.

[0115] The sparrow individual with the highest fitness value among the sparrow individuals whose distance to the current discoverer is less than the preset distance is taken as the optimal neighbor individual.

[0116] At each iteration, the finder's position is updated according to the following formula:

[0117]

[0118] in, represents the position of the i-th discoverer at the t+1th iteration, represents the position of the i-th individual at the t-th iteration, exp() represents the exponential function with the natural constant e as the base, i represents the index value of the individual, r1 represents a random number between 0 and 1, T represents the maximum number of iterations, R2 represents the alarm value, ST represents the safety threshold, w represents the adaptive weight factor, and f b represents the fitness of the current global optimal individual, R represents a random number in the interval 0 to 1 that obeys a normal distribution, and I represents the unit column matrix.

[0119] Among them, the innovative introduction of the adaptive weight factor w can be dynamically adjusted during the iteration process, making the change of the step size more flexible. When R2<ST, w·r1·fb The role of is to explore around the current position.

[0120] It should be noted that the introduction of adaptive weight factors can make the search process more diverse and global, helping to avoid falling into the local optimal solution. The adjustment of the adaptive weight factor can balance the algorithm between exploring and utilizing the current optimal solution, avoiding falling into the local optimal solution in the early stage.

[0121] As the traditional sparrow search algorithm is easy to fall into the local optimal solution, mutation processing is introduced to the sparrow individuals.

[0122] Generate a random number and compare it with the mutation probability. If the random number is smaller than the mutation probability, update the position of the discoverer twice:

[0123]

[0124] Wherein, r2 represents a random number between 0 and 1.

[0125] In the present invention, by introducing mutation processing, the algorithm can have more randomness in the search process, thereby increasing the diversity of the search, helping to avoid the algorithm from falling into the local optimal solution, and improving the algorithm's global search ability. Mutation processing can prompt the algorithm to conduct a wider exploration in the search space, try to jump out of the limitations of the local optimal solution, and help find a better solution. This can increase the possibility of the algorithm finding the global optimal solution.

[0126] Optionally, the mutation probability is specifically:

[0127]

[0128] Among them, P t represents the mutation probability at the tth iteration, P0 represents the initial mutation probability, PT represents the termination mutation probability, and e represents the natural constant.

[0129] It should be noted that the lower mutation probability at the beginning helps the algorithm to make more use of the solution space near the current optimal solution and perform local optimization, thereby accelerating convergence; and as the number of iterations increases, the mutation probability increases, which helps the algorithm gradually jump out of the local optimal solution and conduct more extensive exploration, balancing the relationship between exploration and utilization. In the early stage, more attention can be paid to exploring the breadth of the search space, and in the later stage, more attention can be paid to the depth of the search space, which helps to search the solution space more comprehensively.

[0130] In the present invention, the introduction of a mutation probability mechanism that changes with the number of iterations helps the algorithm to gradually adjust the exploration strategy during the search process, balance exploration and utilization, increase diversity, and adaptively adjust the search strategy, thereby improving the global search capability and robustness of the algorithm.

[0131] Update the follower's position according to the following formula:

[0132]

[0133] in, represents the position of the i-th follower at the t+1th iteration, represents the global worst position at the tth iteration, A represents the optimal position of the discoverer at the t+1th iteration. + =A T (AA T ) -1 , A represents a random row matrix, the elements in A are 1 or -1, and m represents the total number of individuals in the population.

[0134] Update the position of the anti-predator according to the following formula:

[0135]

[0136] in, represents the position of the i-th anti-predator at the t+1th iteration, represents the global optimal position at the tth iteration, τ represents the step size control parameter, R3 represents a random number between -1 and 1, and f i represents the fitness of the current individual, f g represents the fitness of the individual in the optimal position, f w represents the fitness of the individual in the worst position, and ε represents a hyperparameter that avoids the denominator being 0.

[0137] When the number of iterations reaches the maximum number of iterations, the individual with the highest current fitness is output, and the parameter set represented by the individual with the highest fitness is taken as the optimal parameter set and output.

[0138] In the present invention, the optimal parameter set of the K nearest neighbor algorithm can be effectively determined by using the improved sparrow search algorithm. The algorithm has strong global search capability, adaptability and diversity maintenance characteristics, and can achieve good optimization effects in different problem scenarios.

[0139] The beneficial effects brought about by the technical solution provided by the embodiment of the present invention include at least:

[0140] In the present invention, the current network security is determined by cross-verifying the active detection results of network data assets with the passive detection results of network data assets. This can effectively combine active detection and passive detection technologies, fully utilize the advantages of both for cross-verification, and improve the comprehensiveness of network data asset detection results and the accuracy of network security monitoring results.

[0141] Reference Manual Attached Figure 4 , showing a schematic diagram of the structure of a network data asset cross-validation system provided by the present invention.

[0142] The present invention further provides a network data asset cross-validation system 20, which is applied to the above-mentioned network data asset cross-validation method, and comprises:

[0143] Processor 201;

[0144] The memory 202 stores computer-readable instructions, and when the computer-readable instructions are executed by the processor 201, the network data asset cross-validation method described in the method embodiment is implemented.

[0145] The network data asset cross-validation system 20 provided by the present invention can execute the above-mentioned network data asset cross-validation method and achieve the same or similar technical effects. To avoid repetition, the present invention will not elaborate on it.

[0146] The beneficial effects brought about by the technical solution provided by the embodiment of the present invention include at least:

[0147] In the present invention, the current network security is determined by cross-verifying the active detection results of network data assets with the passive detection results of network data assets. This can effectively combine active detection and passive detection technologies, fully utilize the advantages of both for cross-verification, and improve the comprehensiveness of network data asset detection results and the accuracy of network security monitoring results.

[0148] It should be understood that the processor in the embodiment of the present invention may be a central processing unit (CPU), and the processor may also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0149] It should also be understood that the memory in the embodiments of the present invention may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of random access memory (RAM) are available, such as static RAM (SRAM), dynamic random access memory (DRAM), synchronous DRAM (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link DRAM (SLDRAM), and direct rambus RAM (DR RAM).

[0150] The above embodiments can be implemented in whole or in part by software, hardware (such as circuits), firmware or any other combination. When implemented by software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, the process or function described in the embodiment of the present invention is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center by wired (such as infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (for example, a floppy disk, a hard disk, a tape), an optical medium (for example, a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state hard disk.

[0151] It should be understood that the term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. A and B can be singular or plural. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship, but it may also indicate an "and / or" relationship. Please refer to the context for specific understanding.

[0152] In the present invention, "at least one" means one or more, and "more than one" means two or more. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can be represented by: a, b, c, ab, ac, bc, or abc, where a, b, c can be single or multiple.

[0153] It should be understood that in various embodiments of the present invention, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0154] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0155] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described equipment, devices and units can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0156] In the several embodiments provided by the present invention, it should be understood that the disclosed devices, apparatuses and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0157] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0158] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0159] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0160] An embodiment of the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein the program, when executed by a processor, implements the network data asset cross-validation method as described in the method embodiment.

[0161] A computer-readable storage medium provided by the present invention can implement the steps and effects of the network data asset cross-validation method of the above method embodiment. To avoid repetition, the present invention will not go into details.

[0162] The beneficial effects brought about by the technical solution provided by the embodiment of the present invention include at least:

[0163] In the present invention, the current network security is determined by cross-verifying the active detection results of network data assets with the passive detection results of network data assets. This can effectively combine active detection and passive detection technologies, fully utilize the advantages of both for cross-verification, and improve the comprehensiveness of network data asset detection results and the accuracy of network security monitoring results.

[0164] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

[0165] There are a few points to note:

[0166] (1) The drawings of the embodiments of the present invention only relate to the structures related to the embodiments of the present invention, and other structures may refer to the general design.

[0167] (2) For the sake of clarity, in the drawings used to describe the embodiments of the present invention, the thickness of the layers or regions is exaggerated or reduced, that is, these drawings are not drawn according to the actual scale. It is understood that when an element such as a layer, film, region or substrate is referred to as being "on" or "under" another element, the element may be "directly" "on" or "under" the other element or there may be intermediate elements.

[0168] (3) In the absence of conflict, the embodiments of the present invention and the features therein may be combined with each other to obtain new embodiments.

[0169] The above are only specific embodiments of the present invention, but the protection scope of the present invention is not limited thereto. The protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A network data asset cross-validation method, characterized in that: include: S1: Obtain active detection results of network data assets through active asset detection technology; S2: Obtain the passive detection results of network data assets through passive asset detection technology; S3: Cross-validate the active detection result of the network data asset and the passive detection result of the network data asset to determine the current network security; Wherein, the S3 specifically includes: S301: Cross-validate the network data asset active detection result and the network data asset passive detection result to determine the consistency index, integrity index, correlation index and data flow closed-loop index of the current network data asset; S302: Determine the current network security based on the K nearest neighbor algorithm according to the consistency index, integrity index, correlation index and data flow closed loop index of the current network data assets; The consistency index is determined by: Cross-validating the network data asset active detection result and the network data asset passive detection result to determine inconsistent network data assets; Conduct targeted supplementary detection of inconsistent network data assets; Based on the results of the supplementary detection, determine the number of network data assets detected by both active and passive detection; According to the ratio of the number of network data assets detected by both active detection and passive detection to the number of detected network data assets, the consistency index of the current network data assets is determined: Among them, y represents the consistency index, s ab Indicates the number of network data assets detected by both active and passive detection, s t Indicates the number of detected network data assets, s a Indicates the number of network data assets detected actively but not detected by passive detection, s b Indicates the number of network data assets detected passively but not detected by active detection; The method for determining the integrity index includes: Combining statistics on the active detection results of the network data assets and the passive detection results of the network data assets; The integrity index of the current network data assets is determined based on the ratio of the total number of network data assets detected by active detection and passive detection to the total number of network data assets recorded in the network data asset database: Among them, w represents the integrity index, s t represents the number of detected network data assets, and s0 represents the total number of network data assets recorded in the network data asset database; Wherein, the determination method of the correlation index includes: The relative entropy between the active detection result of the network data asset and the passive detection result of the network data asset is calculated to obtain a correlation index: Among them, g represents the correlation index, D KL represents KL divergence calculation, P represents the active detection result of network data assets, Q represents the passive detection result of network data assets, and P k represents the probability value of the kth network data asset in the active detection result of network data assets, Q k represents the probability value of the kth network data asset in the passive detection result of network data assets, k = 1, 2, ..., st, and st represents the number of detected network data assets; The method for determining the data flow closed-loop index includes: Determine the network equipment map based on the active detection results of network data assets; According to the passive detection result of the network data assets, cross-validate the network device map and correct the network device map; Analyze whether the various data flows in the revised network device diagram can be closed; According to the results of whether various data flows can be closed-loop, determine the data flow closed-loop index: Among them, b represents the closed-loop index of data flow, s c It represents the number of data flows that can be closed, and S represents the total number of data flows used for testing.

2. The network data asset cross-validation method according to claim 1, characterized in that: The S302 specifically includes: S3021: construct a feature vector of the current network data asset according to the consistency index, integrity index, correlation index and data flow closed-loop index of the current network data asset; S3022: Calculate the distance between the feature vector of the current network data asset and the feature vectors of each network data asset in the network data asset database: Among them, D i represents the distance between the feature vector of the current network data asset and the feature vector of the ith network data asset in the network data asset database. X represents the feature vector of the current network data asset. X=(y,w,g,b), y represents the consistency index, w represents the integrity index, g represents the correlation index, b represents the data flow closed-loop index, and X i represents the feature vector of the ith network data asset, X i =(y i ,w i ,g i ,b i ), y i represents the consistency index of the ith network data asset, w i represents the integrity index of the ith network data asset, g i represents the correlation index of the ith network data asset, b i represents the closed-loop index of the data flow of the i-th network data asset, λ y Represents the weight coefficient of the consistency index, λ w Represents the weight coefficient of the integrity index, λ g Represents the weight coefficient of the correlation index, λ b Indicates the weight coefficient of the data flow closed-loop index; S3023: Arrange each network data asset in the network data asset database in descending order according to the distance from the current network data asset; S3024: Select the top K network data assets as the K nearest neighbors of the current network data asset; S3025: Count the probabilities that the K nearest neighbors belong to each network security category, where the network security categories include normal, suspicious, and abnormal; S3026: The network security category with the highest probability is taken as the category to which the current network data asset belongs.

3. The network data asset cross-validation method according to claim 2, characterized in that: The training method of the K nearest neighbor algorithm specifically includes: Construct the loss function of the K nearest neighbor algorithm; Acquire a sample data set, wherein the sample data set includes a plurality of training samples, and each training sample includes a feature vector; Classify each training sample using the K nearest neighbor algorithm; Taking the minimum of the loss function as the goal, the parameters of the K nearest neighbor algorithm are searched through the improved sparrow search algorithm to determine the optimal parameter set of the K nearest neighbor algorithm to complete the training of the K nearest neighbor algorithm; The parameters of the K nearest neighbor algorithm include: the number of neighbors K, the weight coefficient λ of the consistency index y , the weight coefficient λ of the integrity index w , the weight coefficient λ of the correlation index g , the weight coefficient λ of the data flow closed-loop index b .

4. A network data asset cross-validation system, characterized in that: include: processor; A memory having computer-readable instructions stored thereon, wherein when the computer-readable instructions are executed by the processor, the network data asset cross-validation method according to any one of claims 1 to 3 is implemented.

5. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the network data asset cross-validation method according to any one of claims 1 to 3 is implemented.

Images