Network security situation awareness and early warning method and system based on big data

Abstract

The present application relates to a network security situation awareness and early warning method and system based on big data, the method comprising acquiring network operation data of a current network event and performing data integration and cleaning processing to obtain network security situation information, analyzing the network security situation information and then performing security situation assessment processing on the current network event to obtain security assessment information of the current network event, tracing back the information source of the risky security assessment information, identifying the attack threat level of the security assessment information, constructing a security situation model of the current network event according to the attack threat level of each network security situation, performing network security development trend awareness processing in combination with relevant historical attack event data, extracting possible risk hidden danger data according to the risk perception results and generating corresponding risk early warning information; the present application has the effect of improving the situation awareness and early warning of network security.

Description

Technical Field

[0001] The present invention relates to the technical field of situation awareness, and in particular to a network security situation awareness and early warning method and system based on big data. Background Art

[0002] At present, with the rapid development of information technology, various new types of network attacks occur frequently, especially network attacks that lead to the continuous occurrence of a large number of personal privacy information leaks. Network security issues have become the focus of great attention of network users and managers. In particular, the Internet has gradually become the main place for people's lives and communication, which has also put forward higher requirements for network security.

[0003] The existing network security early warning method is generally to view network operation security logs and control network access devices by setting up firewalls, IDS, and routing access control. However, for network attacks that are good at disguise, such as Trojan viruses, worms, and backdoors, traditional single defense devices or detection devices usually only associate event logs for screening and defense. There is a lack of network security intelligence to perceive and warn of various network attacks in advance, and it cannot meet the current network security needs of multi-source data iteration. Summary of the invention

[0004] In order to improve the timeliness of network security situation awareness and early warning, the present application provides a network security situation awareness and early warning method and system based on big data.

[0005] In the first aspect, the above-mentioned invention objective of the present application is achieved through the following technical solutions:

[0006] A network security situation awareness and early warning method based on big data, comprising:

[0007] Obtain the network operation data corresponding to the current network event and perform data integration and cleaning to obtain network security situation information;

[0008] Analyze the network security situation information, and perform security situation assessment processing on the current network event according to the analysis result to obtain security assessment information of the current network event;

[0009] Trace the information source of the risky security assessment information, identify the attack threat level of the security assessment information in combination with the information source, and build a security situation model of the current network event based on the attack threat level of each network security situation;

[0010] Obtain relevant historical attack event data, combine it with the security situation model to perform network security development trend perception processing, extract possible risk hidden danger data based on the risk perception results and generate corresponding risk warning information.

[0011] By adopting the above technical solution, through cleaning and integration of network operation data, repeated and redundant invalid data are cleaned, effective data is screened out from massive information for security situation awareness, reducing data processing workload, and analyzing network security situation information to conduct security situation assessment. Combined with the assessment results, the risks in the development direction of the security situation are preliminarily analyzed, and combined with the information source data of the corresponding risk situation and the attack threat level assessment results, a security situation model is constructed to quickly analyze the current network events, and with the relevant historical attack event data as a reference, network security development trend perception is performed, and based on the perception results, the risk potential data of the current network event is extracted, and based on the handling method of risk potentials in historical attack events, risk warning information is generated to perform situation risk warning processing, thereby improving the situation awareness of network security and the timeliness of warning.

[0012] In a preferred example, the present application may be further configured as follows: the network operation data corresponding to the current network event is obtained and the data is integrated and cleaned to obtain network security situation information, specifically including:

[0013] Obtain the number of accesses and the access time of the current network event on each service node, and perform derivative correlation analysis on the network operation data according to the number of accesses and the access time;

[0014] According to the derivative association analysis result, the network operation data is cleaned for redundancy, and the cleaned network operation data is integrated according to the access sequence;

[0015] According to the access service node of the current network event, performing node association analysis on the access service node, and predicting the derived service node that meets the node association according to the association analysis result;

[0016] The integrated network operation data is analyzed for commonalities, and the network operation data with commonalities is combined with the derived service nodes to perform event feature extraction and processing to obtain network security situation information.

[0017] By adopting the above technical solution, combined with the number of visits and access time of the current network event on each service node, the intended access type of the network event is analyzed, and then a derivative association analysis is performed, and an association analysis is performed on the service nodes or access directions with possible access probabilities, so as to reduce the omissions of security situation awareness, reduce the interference of invalid data by redundant cleaning of network operation data, and integrate the cleaned network operation data according to the access order, so as to facilitate the collection of relevant security situation data, and predict the derivative service nodes in combination with the analysis results of the association relationship between the access service nodes, so as to facilitate the perception of the development direction of the security situation, and match the data with the derivative service nodes in combination with the data commonalities between the network operation data, and extract the event features of the network event on the derivative service nodes according to the matching results, so as to obtain network security situation information, and further improve the accuracy of security situation awareness through the degree of matching between the commonalities of the derivative service nodes and the network operation data.

[0018] In a preferred example, the present application may be further configured as follows: analyzing the network security situation information, performing security situation assessment processing on the current network event according to the analysis result, and obtaining security assessment information of the current network event, specifically including:

[0019] Comprehensively analyzing the attack direction and attack range of the network security situation information, and classifying the network attack type of the current network event according to the analysis results;

[0020] The event change probability of each service node in a single attack direction is calculated by formula (1), which is as follows:

[0021] ; (1)

[0022] Among them, ρ1 represents the event change probability of each service node in a single direction, D1-D n Respectively represent the sum of event codes of the current network event on each service node, - They respectively represent the event code changes between adjacent service nodes in a single attack direction of the current network event. - Indicates the routing coefficient of the code corresponding to the current network event in each service node, and n indicates the number of service nodes associated with the current network event;

[0023] Analyze the attack intensity of the current network event based on the event change probability between adjacent service nodes, and conduct security situation assessment and processing on the operation changes of the current network event in combination with the corresponding service nodes;

[0024] When the attack intensity of the event is in positive proportion to the corresponding node operation change, the current network event is evaluated as a network attack situation;

[0025] When the attack intensity of the event is inversely proportional to the corresponding node operation change, the current network event is evaluated as a normal network situation, and security assessment information of the current network event is obtained.

[0026] In a preferred example, the present application may be further configured as follows: the network security situation information is analyzed, and according to the analysis result, a security situation assessment process is performed on the current network event to obtain security assessment information of the current network event, and further includes:

[0027] For network events of indiscriminate attack type, obtain the event running rate of the current network event on each service node;

[0028] The event change probability of each service node within the same attack range is expressed by formula (2), which is as follows:

[0029] ; (2)

[0030] Among them, ρ2 represents the event change probability of each service node in the same attack range, V1-V n Indicates the event running rate corresponding to each service node.

[0031] By adopting the above technical solution and combining the attack direction and attack range analysis results of network security situation information, network events of different attack types are classified and processed, and the probability of event changes between single attack direction and indiscriminate attack range attack types is calculated to improve the accuracy of perception of security situation changes.

[0032] In a preferred example, the present application can be further configured as follows: the information source of the risky security assessment information is traced, and the attack threat level of the security assessment information is identified in combination with the information source, and a security situation model of the current network event is constructed according to the attack threat level of each network security situation, specifically including:

[0033] Obtaining the IP address and node traversal data of the security assessment information with risks, and performing information source tracing processing according to the IP address and the node traversal data to obtain the original information source data of the security assessment information;

[0034] Using the original information source data as the original structure parameter, performing data training on the security assessment information, and analyzing the event data difference between the security assessment information and the original information source data according to the training result;

[0035] The ratio between the event data difference and the original information source data is used as the attack threat coefficient of the current network event, and the attack threat degree of the security assessment information is evaluated in combination with the attack threat coefficient;

[0036] A security situation model of the current network event is constructed according to the attack threat level of each network security situation, wherein the security situation model is represented by formula (3), which is as follows:

[0037] ; (3)

[0038] Among them, A represents the security situation and attack danger level of the current network event. Indicates the probability of event change, determined in combination with the type of current network event or , Indicates the attack threat coefficient under the current development trend of the incident, Represents the security assessment information data under the current development trend, Represents the original information source data of the current network event, Indicates the event data differences between the original event features and the security assessment information, including feature pointing differences, feature code differences, and feature code variant differences.

[0039] By adopting the above technical solution, the security assessment information with risks is processed independently, and the information source is traced in combination with the corresponding IP address and node traversal data. The original information source data is used as the original structure parameter to train the security assessment information, so as to evaluate the difference in event data changes in the current network event during the development of the security situation. The attack threat coefficient is calculated by combining the ratio between the event data difference and the original information source data, and the attack threat degree is further analyzed. According to the attack threat degree and the development trend of the current network event, a security situation model is constructed, which facilitates more intuitive security situation perception and timely perception of the development of the security situation of the current network event.

[0040] In a preferred example, the present application can be further configured as follows: the acquisition of relevant historical attack event data, combined with the security situation model to perform network security development trend perception processing, extracting possible risk hidden danger data according to the risk perception result and generating corresponding risk warning information, specifically including:

[0041] According to the attack type of the current network event, historical attack event data related to the type is obtained, the historical attack event data is input into the security situation model, and parameter correction processing is performed on the security situation model;

[0042] Input the network security situation information into the revised security situation model to perform network security situation awareness, and analyze the security development trend of the current network event in combination with the communication association relationship between the service nodes;

[0043] Extract node operation data that does not meet the security situation model correction coefficient in terms of security development trend and mark them as potential risk data;

[0044] Combined with the maintenance information of historical attack events, risk avoidance is performed on current risk potential data, and corresponding risk warning information is generated for risk warning processing.

[0045] By adopting the above technical solution, the parameters of the current security situation model are corrected through type-related historical attack event data, so as to improve the matching degree between the parameter correction results of the security situation model and the current attack type, and the network security situation information of the current network event is combined to perform security situation awareness processing, and the communication association relationship between service nodes is combined to perform security development trend analysis, which is helpful for multi-dimensional analysis of the event development trend and reduce the omission of the possibility of situation development. In combination with the node operation data that does not meet the security situation model correction coefficient in the security development trend, risk hidden danger data is extracted, and with reference to the maintenance information of historical attack events, risk avoidance is performed on the current risk hidden danger data, and risk warning processing is performed through the corresponding risk warning information, so as to improve the timeliness and pertinence of risk warning.

[0046] In the second aspect, the above invention objective of the present application is achieved through the following technical solutions:

[0047] A network security situation awareness and early warning system based on big data, including:

[0048] The data integration module is used to obtain the network operation data corresponding to the current network event and perform data integration and cleaning to obtain network security situation information;

[0049] A data evaluation module is used to analyze the network security situation information, and perform security situation evaluation processing on the current network event according to the analysis result to obtain security evaluation information of the current network event;

[0050] The model building module is used to trace the information source of the security assessment information with risks, identify the attack threat level of the security assessment information in combination with the information source, and build a security situation model of the current network event according to the attack threat level of each network security situation;

[0051] The risk warning module is used to obtain relevant historical attack event data, combine the security situation model to perform network security development trend perception processing, extract possible risk hidden danger data based on the risk perception results and generate corresponding risk warning information.

[0052] By adopting the above technical solution, through cleaning and integration of network operation data, repeated and redundant invalid data are cleaned, effective data is screened out from massive information for security situation awareness, reducing data processing workload, and analyzing network security situation information to conduct security situation assessment. Combined with the assessment results, the risks in the development direction of the security situation are preliminarily analyzed, and combined with the information source data of the corresponding risk situation and the attack threat level assessment results, a security situation model is constructed to quickly analyze the current network events, and with the relevant historical attack event data as a reference, network security development trend perception is performed, and based on the perception results, the risk potential data of the current network event is extracted, and based on the handling method of risk potentials in historical attack events, risk warning information is generated to perform situation risk warning processing, thereby improving the situation awareness of network security and the timeliness of warning.

[0053] On the third aspect, the above-mentioned purpose of the present application is achieved through the following technical solutions:

[0054] A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps of the above-mentioned network security situation awareness and early warning method based on big data are implemented.

[0055] Fourthly, the above-mentioned purpose of the present application is achieved through the following technical solutions:

[0056] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the above-mentioned network security situation awareness and early warning method based on big data.

[0057] In summary, the present application includes at least one of the following beneficial technical effects:

[0058] 1. Through the cleaning and integration of network operation data, the repeated and redundant invalid data are cleaned, and effective data is selected from the massive information for security situation awareness, reducing the workload of data processing, and analyzing the network security situation information to conduct security situation assessment. Combined with the assessment results, the risks in the development direction of the security situation are preliminarily analyzed, and combined with the information source data of the corresponding risk situation and the attack threat level assessment results, a security situation model is constructed to quickly analyze the current network events, and the relevant historical attack event data is used as a reference to perceive the development trend of network security, and the data on the potential risks of the current network events are extracted based on the perception results, and the risk warning information is generated based on the handling methods of the risk hidden dangers in the historical attack events to carry out situation risk warning processing, thereby improving the situation awareness of network security and the timeliness of the warning;

[0059] 2. Combine the number of visits and access time of the current network event on each service node, analyze the intended access type of the network event, and then conduct derivative association analysis, conduct association analysis on the service nodes or access directions with possible access probability, reduce the omission of security situation awareness, reduce the interference of invalid data through redundant cleaning of network operation data, and integrate the cleaned network operation data according to the access order, so as to facilitate the collection of relevant security situation data, and conduct derivative service node prediction based on the analysis results of the association relationship between the access service nodes, so as to facilitate the perception of the development direction of the security situation, combine the data commonality between the network operation data and the derivative service nodes, and extract the event features of the network event on the derivative service nodes according to the matching results, so as to obtain network security situation information, and further improve the accuracy of security situation awareness through the matching degree between the common characteristics of the derivative service nodes and the network operation data;

[0060] 3. Combine the attack direction and attack range analysis results of network security situation information, classify and process network events of different attack types, and calculate the probability of event changes between single attack direction and indiscriminate attack range attack types to improve the accuracy of perception of security situation changes. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] Figure 1 This is a flowchart of the implementation of the network security situation awareness and early warning method based on big data in this embodiment.

[0062] Figure 2 This is a flowchart for implementing step S10 of the network security situation awareness and early warning method based on big data in this embodiment.

[0063] Figure 3 This is a flowchart for implementing step S20 of the network security situation awareness and early warning method based on big data in this embodiment.

[0064] Figure 4 This is a flowchart for implementing step S30 of the network security situation awareness and early warning method based on big data in this embodiment.

[0065] Figure 5 This is a flowchart for implementing step S40 of the network security situation awareness and early warning method based on big data in this embodiment.

[0066] Figure 6 It is a structural block diagram of the network security situation awareness and early warning system based on big data in this embodiment.

[0067] Figure 7 It is a schematic diagram of the internal structure of a computer device used to implement a network security situation awareness and early warning method. DETAILED DESCRIPTION

[0068] The present application is further described in detail below in conjunction with the accompanying drawings.

[0069] In one embodiment, if Figure 1 As shown, the present application discloses a network security situation awareness and early warning method based on big data, which specifically includes the following steps:

[0070] S10: Obtain network operation data corresponding to the current network event and perform data integration and cleaning to obtain network security situation information.

[0071] Specifically, Figure 2 As shown, step S10 specifically includes:

[0072] S101: Obtain the number of accesses and access time of the current network event on each service node, and perform derivative correlation analysis on the network operation data according to the number of accesses and access time.

[0073] Specifically, the number of visits and access time of the current network event on each service node are counted, and the derivative correlation analysis of the network operation data is performed in combination with the access time and number of visits of a single node. That is, the more the number of visits and the longer the access time, the closer the correlation is. According to the access sequence between each service node and the adjacent service nodes, it is determined whether there is a derivative correlation between the adjacent service nodes.

[0074] S102: performing redundancy cleaning on the network operation data according to the derivative association analysis result, and performing data integration processing on the cleaned network operation data according to the access sequence.

[0075] Specifically, based on the results of the derivative association analysis, instruction comparison analysis is performed on all network operation data within the derivative range, and repeated, redundant or inactive data is deleted. The cleaned network operation data is integrated into the same cluster based on the access order of the service nodes and associated with the event tag of the current network event.

[0076] S103: performing node association analysis on the access service nodes according to the access service nodes of the current network event, and predicting derived service nodes that meet the node association according to the association analysis result.

[0077] Specifically, based on the collection of access service nodes of the current network event, node association is performed among the access service nodes with access records to obtain node association relationship analysis results with access associations, and derived service nodes are predicted based on the data interaction of the access service nodes. If there is data interaction between adjacent nodes, i.e. mutual calls, the adjacent nodes of the same type are marked as derived service nodes.

[0078] S104: Perform data commonality analysis on the integrated network operation data, combine the common network operation data with the derived service nodes to perform event feature extraction and processing, and obtain network security situation information.

[0079] Specifically, the integrated network operation data is analyzed for commonalities, the network operation data with similar data properties are classified, and the operation of the classified common network operation data on the derived service nodes is simulated. The final common characteristics of the data are extracted in combination with the simulation operation results as network security situation information.

[0080] S20: Analyze the network security situation information, and perform security situation assessment processing on the current network event according to the analysis result to obtain security assessment information of the current network event.

[0081] Specifically, Figure 3 As shown, step S20 includes:

[0082] S201: Comprehensively analyze the attack direction and attack range of the network security situation information, and classify the network attack type of the current network event according to the analysis results.

[0083] For example, for the access to node A, the access records of downstream nodes A1 and A2 of the same type are obtained synchronously according to the IP address of the current network event, and it is determined whether the downstream nodes A, A1 and A2 have the same IP address. If not, it is preliminarily determined that the attack direction of the current network security situation information is a range attack. If so, it is determined that the attack direction of the current network security situation information is a single-direction attack. Similarly, combined with the access conditions of multiple nodes such as nodes B, C, D that are different types from node A, if there is access information on nodes B, C, and D, it means that the attack range of the current network security attack information is a range attack. If there is no access information on nodes B, C, and D of different types, it means that the attack range of the current network security attack information is a single-direction attack, and the attack type of the current network event is further determined to be a single-direction attack type or a range attack type.

[0084] It should be noted that, in this embodiment, A and A1, A1 and A2 are adjacent service nodes.

[0085] The event change probability of each service node in a single attack direction is calculated by formula (1), which is as follows:

[0086] ; (1)

[0087] Among them, ρ1 represents the event change probability of each service node in a single direction, D1-D n Respectively represent the sum of event codes of the current network event on each service node, - They respectively represent the event code changes between adjacent service nodes in a single attack direction of the current network event. - It indicates the routing coefficient of the code corresponding to the current network event in each service node, and n indicates the number of service nodes associated with the current network event.

[0088] S202: Analyze the event attack intensity of the current network event according to the event change probability between adjacent service nodes, and perform security situation assessment processing on the operation change of the current network event in combination with the corresponding service node.

[0089] Specifically, combined with the event change probability between adjacent service nodes, the greater the event change probability, the higher the event attack intensity, obtain the code running changes of each service node for the current network event, and analyze whether the running of the current network event attacks the current service node. When the service node operating environment changes greatly and the event change probability is greater, it means that the security situation of the current network event is more aggressive. If the service node operating environment changes or the event change probability of the adjacent nodes is within a controllable range, it means that the security situation of the current network event is less aggressive and belongs to the development and change of the security situation, among which the service node operation changes include operation failures, operation mutations and normal operation.

[0090] S203: When the event attack intensity is in positive proportion to the corresponding node operation change, the current network event is evaluated as a network attack situation.

[0091] Specifically, when the event attack intensity is in positive proportion to the corresponding node operation change, such as the greater the event attack intensity, the greater the node operation change, it means that the service node is in an attacked state, and the operation data of the current network event is aggressive, then the current network event is evaluated as a network attack situation.

[0092] S204: When the event attack intensity is inversely proportional to the corresponding node operation change, the current network event is evaluated as a normal network situation, and security assessment information of the current network event is obtained.

[0093] Specifically, when the event attack intensity is in positive proportion to the corresponding node operation change, such as the greater the event attack intensity, the smaller the node operation change, it means that the service node is in normal operation and has not been attacked by abnormal network. The current network event is evaluated as a normal network situation. The network attack situation and the normal network situation are summarized to obtain the security assessment information of the current network event.

[0094] In one embodiment, step S20 further includes:

[0095] S205: For a network event of an indiscriminate attack type, obtain an event running rate of the current network event on each service node.

[0096] Specifically, for network events of the indiscriminate attack type, the event running rate of the current network event on each service node is counted and stored in the network event alarm information according to the node IP of the service node.

[0097] S206: The event change probability of each service node within the same attack range is expressed by formula (2), and formula (2) is as follows:

[0098] ; (2)

[0099] Among them, ρ2 represents the event change probability of each service node in the same attack range, V1-V n Indicates the event running rate corresponding to each service node.

[0100] S30: Trace back the information source of the risky security assessment information, identify the attack threat level of the security assessment information in combination with the information source, and build a security situation model of the current network event according to the attack threat level of each network security situation.

[0101] Specifically, Figure 4 As shown, step S30 includes:

[0102] S301: Acquire the IP address and node traversal data of the security assessment information with risks, perform information source tracing processing according to the IP address and the node traversal data, and obtain the original information source data of the security assessment information.

[0103] Specifically, when the security assessment information is marked as having a risk, the corresponding network event IP address and node traversal data, including the node traversal order and node traversal status, are obtained, and the information source is reversed according to the IP address and node traversal order. If the node traversal status appears to be forward deduced during the reverse deduction process, the corresponding reverse deduction route is excluded, and the last service node whose reverse deduction direction is all reverse deduction is taken as the original information source node to obtain the original information source data of the security assessment information.

[0104] S302: Using the original information source data as the original structure parameter, data training is performed on the security assessment information, and event data differences between the security assessment information and the original information source data are analyzed based on the training results.

[0105] Specifically, the original information source data is used as the original structure parameter, and combined with the CNN (Convolutional Neural Network) deep learning algorithm, the code grayscale image in the original information source data is obtained, and the corresponding grayscale image features are extracted. Image clustering is performed on each event feature in the original information source, and the clustering results are marked with original event features. The network structure between the original event features is constructed through the preset CNN deep learning algorithm, and then the security assessment information is trained with data in combination with the network structure. The event data differences between the original event features in the network security structure and the security assessment information are analyzed, including feature pointing differences, feature code differences, feature code variant differences, etc.

[0106] S303: Taking the ratio between the event data difference and the original information source data as the attack threat coefficient of the current network event, and evaluating the attack threat level of the security assessment information in combination with the attack threat coefficient.

[0107] Specifically, the ratio between the event data difference and the original information source data is calculated, and the corresponding ratio is used as the attack threat coefficient of the current network event. The higher the attack threat coefficient, the higher the attack threat level of the security assessment information, and the lower the attack threat coefficient, the lower the attack threat level of the security assessment information.

[0108] S304: Construct a security situation model of the current network event according to the attack threat level of each network security situation, wherein the security situation model is represented by formula (3), which is as follows:

[0109] ; (3)

[0110] Among them, A represents the security situation and attack danger level of the current network event. Indicates the probability of event change, determined in combination with the type of current network event or , Indicates the attack threat coefficient under the current development trend of the incident, Represents the security assessment information data under the current development trend, Represents the original information source data of the current network event, Indicates the event data differences between the original event features and the security assessment information, including feature pointing differences, feature code differences, and feature code variant differences.

[0111] S40: Obtain relevant historical attack event data, combine it with the security situation model to perform network security development trend perception processing, extract possible risk hidden danger data based on the risk perception results and generate corresponding risk warning information.

[0112] Specifically, Figure 5 As shown, step S40 includes:

[0113] S401: Acquire historical attack event data related to the type of attack of the current network event, input the historical attack event data into a security situation model, and perform parameter correction processing on the security situation model.

[0114] Specifically, according to the attack type of the current network event, historical attack event data related to the type is obtained, including the attack situation and maintenance log information of the historical attack events, and the historical attack event data is input into the security situation model, and the parameters of the security situation model are corrected. For example, the historical attack event data is input into the security situation model, and the security situation attack risk value that conforms to the historical attack events is calculated. Then, the average value between the current security situation attack risk value and the security situation attack risk value of the historical attack events is calculated as the parameter correction coefficient.

[0115] S402: Input the network security situation information into the revised security situation model to perform network security situation awareness, and analyze the security development trend of the current network event in combination with the communication association relationship between the service nodes.

[0116] Specifically, the network security situation information is input into the revised security situation model, and the service node access direction of the network security situation information is analyzed. In combination with the communication association relationship between the service nodes, if the service nodes can send data to each other and maintain normal communication status, the communication association relationship between the service nodes and the service node access direction are combined to analyze the future development trend of the current network event, such as the next access service node or the next access direction.

[0117] S403: Extract node operation data that does not meet the security situation model correction coefficient in terms of security development trend, and mark them as risk potential data that may have potential risks.

[0118] Specifically, for the node operation data that does not conform to the security situation model correction coefficient in the security development trend, the operation data of each service node in the security development trend is input into the security situation model for data matching. If it does not conform to the correction coefficient of the security situation model, such as being too large or too small, the corresponding node operation data will be marked as risk data that may have potential risks.

[0119] S404: Based on the maintenance information of historical attack events, risk avoidance is performed on current risk potential data, and corresponding risk warning information is generated for risk warning processing.

[0120] Specifically, the current risk hidden danger data is compared with the maintenance information of historical attack events, and the maintenance information of the historical attack events with the closest analogy is used as a warning reference, which is packaged together with the current risk hidden danger data and sent to the management end for risk warning processing.

[0121] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0122] In one embodiment, a network security situation awareness and early warning system based on big data is provided, and the network security situation awareness and early warning system based on big data corresponds one to one with the network security situation awareness and early warning method based on big data in the above embodiment. Figure 6 As shown in the figure, the network security situation awareness and early warning system based on big data includes data integration module, data evaluation module, model building module and risk early warning module. The detailed description of each functional module is as follows:

[0123] The data integration module is used to obtain the network operation data corresponding to the current network event and perform data integration and cleaning processing to obtain network security situation information.

[0124] The data evaluation module is used to analyze the network security situation information, perform security situation evaluation on the current network event according to the analysis results, and obtain the security evaluation information of the current network event.

[0125] The model building module is used to trace the information source of the security assessment information with risks, identify the attack threat level of the security assessment information in combination with the information source, and build a security situation model of the current network event according to the attack threat level of each network security situation.

[0126] The risk warning module is used to obtain relevant historical attack event data, combine it with the security situation model to perceive the network security development trend, extract possible risk data based on the risk perception results, and generate corresponding risk warning information.

[0127] Preferably, the data integration module specifically includes:

[0128] The derivative analysis submodule is used to obtain the number of visits and access time of the current network event on each service node, and perform derivative correlation analysis on the network operation data based on the number of visits and access time.

[0129] The data integration submodule is used to perform redundancy cleaning on the network operation data according to the results of the derivative association analysis, and to perform data integration on the cleaned network operation data according to the access sequence.

[0130] The association analysis submodule is used to perform node association analysis on the access service nodes according to the access service nodes of the current network event, and predict the derived service nodes that meet the node association according to the association analysis results.

[0131] The data extraction submodule is used to perform data commonality analysis on the integrated network operation data, and to extract event features from the common network operation data in combination with the derived service nodes to obtain network security situation information.

[0132] Preferably, the data evaluation module specifically includes:

[0133] The attack analysis submodule is used to conduct a comprehensive analysis of the attack direction and attack range of the network security situation information, and classify the network attack type of the current network event based on the analysis results.

[0134] The event change probability of each service node in a single attack direction is calculated by formula (1), which is as follows:

[0135] ; (1)

[0136] Among them, ρ1 represents the event change probability of each service node in a single direction, D1-D n Respectively represent the sum of event codes of the current network event on each service node, - They respectively represent the event code changes between adjacent service nodes in a single attack direction of the current network event. - It indicates the routing coefficient of the code corresponding to the current network event in each service node, and n indicates the number of service nodes associated with the current network event.

[0137] The situation assessment submodule is used to analyze the event attack intensity of the current network event according to the event change probability between adjacent service nodes, and to perform security situation assessment processing on the operation changes of the current network event in combination with the corresponding service node.

[0138] The attack marking submodule is used to evaluate the current network event as a network attack situation when the event attack intensity is in positive proportion to the corresponding node operation change.

[0139] The normal marking submodule is used to evaluate the current network event as a normal network situation when the event attack intensity is inversely proportional to the corresponding node operation change, and obtain the security assessment information of the current network event.

[0140] Preferably, the data evaluation module further includes:

[0141] The data collection submodule is used to obtain the event running rate of the current network event on each service node for network events of indiscriminate attack type.

[0142] The event change probability of each service node within the same attack range is expressed by formula (2), which is as follows:

[0143] ; (2)

[0144] Among them, ρ2 represents the event change probability of each service node in the same attack range, V1-V n Indicates the event running rate corresponding to each service node.

[0145] Preferably, the model building module specifically includes:

[0146] The information tracing submodule is used to obtain the IP address and node traversal data of the security assessment information with risks, and to perform information source tracing processing based on the IP address and node traversal data to obtain the original information source data of the security assessment information.

[0147] The data training submodule is used to use the original information source data as the original structure parameter to perform data training on the security assessment information, and analyze the event data differences between the security assessment information and the original information source data based on the training results.

[0148] The threat assessment submodule is used to use the ratio between the event data difference and the original information source data as the attack threat coefficient of the current network event, and evaluate the attack threat level of the security assessment information in combination with the attack threat coefficient.

[0149] The model building submodule is used to build a security situation model of the current network event according to the attack threat level of each network security situation. The security situation model is expressed by formula (3), which is as follows:

[0150] ; (3)

[0151] Among them, A represents the security situation and attack danger level of the current network event. Indicates the probability of event change, determined in combination with the type of current network event or , Indicates the attack threat coefficient under the current development trend of the incident, Represents the security assessment information data under the current development trend, Represents the original information source data of the current network event, Indicates the event data differences between the original event features and the security assessment information, including feature pointing differences, feature code differences, and feature code variant differences.

[0152] Preferably, the risk warning module specifically includes:

[0153] The parameter correction submodule is used to obtain historical attack event data related to the type of attack of the current network event, input the historical attack event data into the security situation model, and perform parameter correction processing on the security situation model.

[0154] The development analysis submodule is used to input network security situation information into the revised security situation model to conduct network security situation awareness, and analyze the security development trend of the current network event in combination with the communication association relationship between service nodes.

[0155] The data extraction submodule is used to extract the node operation data that does not meet the security situation model correction coefficient in terms of security development trend, and mark it as risk potential data that may have potential risks.

[0156] The risk warning submodule is used to combine the maintenance information of historical attack events, perform risk avoidance on current risk potential data, and generate corresponding risk warning information for risk warning processing.

[0157] For the specific definition of the network security situation awareness and early warning system based on big data, please refer to the definition of the network security situation awareness and early warning method based on big data above, which will not be repeated here. Each module in the above-mentioned network security situation awareness and early warning system based on big data can be implemented in whole or in part through software, hardware and their combination. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0158] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 7 As shown. The computer device includes a processor, a memory, a network interface and a database connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data in the network security situation awareness and early warning process. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a network security situation awareness and early warning method based on big data is implemented.

[0159] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of a network security situation awareness and early warning method based on big data are implemented.

[0160] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM, Read-Only Memory), programmable ROM (PROM, Programmable Read-Only Memory), electrically programmable ROM (EPROM, Erasable Programmable Read-Only Memory), electrically erasable programmable ROM (EEPROM, Electrically Erasable Programmable Read-Only Memory) or flash memory. Volatile memory may include random access memory (RAM, Random Access Memory) or external cache memory. By way of illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), Rambus Direct Random Access Memory (RDRAM), direct RAM bus dynamic RAM (DRDRAM), and Rambus Direct Random Access Memory (RDRAM).

[0161] Those skilled in the art will clearly understand that for the sake of convenience and brevity of description, only the division of the above-mentioned functional units and modules is used as an example. In actual applications, the above-mentioned functions can be distributed and completed by different functional units and modules as needed, that is, the internal structure of the system can be divided into different functional units or modules to complete all or part of the functions described above.

[0162] The embodiments described above are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

Claims

1. A network security situation awareness and early warning method based on big data, characterized in that: include: Obtain the network operation data corresponding to the current network event and perform data integration and cleaning to obtain network security situation information; Analyze the network security situation information, and perform security situation assessment processing on the current network event according to the analysis result to obtain security assessment information of the current network event; Trace the information source of the risky security assessment information, identify the attack threat level of the security assessment information in combination with the information source, and build a security situation model of the current network event based on the attack threat level of each network security situation; Obtain relevant historical attack event data, combine the security situation model to perform network security development trend perception processing, extract possible risk data based on risk perception results and generate corresponding risk warning information; The obtaining of network operation data corresponding to the current network event and performing data integration and cleaning processing to obtain network security situation information specifically includes: Obtain the number of accesses and the access time of the current network event on each service node, and perform derivative correlation analysis on the network operation data according to the number of accesses and the access time; According to the derivative association analysis result, the network operation data is cleaned for redundancy, and the cleaned network operation data is integrated according to the access sequence; According to the access service node of the current network event, performing node association analysis on the access service node, and predicting a derived service node that meets the node association according to the association analysis result; Performing data commonality analysis on the integrated network operation data, combining the common network operation data with the derived service nodes to perform event feature extraction processing to obtain network security situation information; The analyzing the network security situation information and performing security situation assessment processing on the current network event according to the analysis result to obtain security assessment information of the current network event specifically includes: Comprehensively analyzing the attack direction and attack range of the network security situation information, and classifying the network attack type of the current network event according to the analysis results; The event change probability of each service node in a single attack direction is calculated by formula (1), which is as follows: ； （1） in, Indicates the event change probability of each service node in a single direction, - Respectively represent the sum of event codes of the current network event on each service node, - They respectively represent the event code changes between adjacent service nodes in a single attack direction of the current network event. - Indicates the routing coefficient of the code corresponding to the current network event in each service node, Indicates the number of service nodes associated with the current network event; Analyze the attack intensity of the current network event based on the event change probability between adjacent service nodes, and conduct security situation assessment and processing on the operation changes of the current network event in combination with the corresponding service nodes; When the attack intensity of the event is in positive proportion to the corresponding node operation change, the current network event is evaluated as a network attack situation; When the attack intensity of the event is inversely proportional to the corresponding node operation change, the current network event is evaluated as a normal network situation, and security assessment information of the current network event is obtained; The step of analyzing the network security situation information and performing security situation assessment processing on the current network event according to the analysis result to obtain security assessment information of the current network event further includes: For network events of indiscriminate attack type, obtain the event running rate of the current network event on each service node; The event change probability of each service node within the same attack range is expressed by formula (2), which is as follows: ； （2） in, represents the event change probability of each service node within the same attack range, - Indicates the event running rate corresponding to each service node; The tracing of the information source of the risky security assessment information, identifying the attack threat level of the security assessment information in combination with the information source, and constructing a security situation model of the current network event according to the attack threat level of each network security situation specifically include: Obtaining the IP address and node traversal data of the security assessment information with risks, and performing information source tracing processing according to the IP address and the node traversal data to obtain the original information source data of the security assessment information; Using the original information source data as the original structure parameter, performing data training on the security assessment information, and analyzing the event data difference between the security assessment information and the original information source data according to the training result; The ratio between the event data difference and the original information source data is used as the attack threat coefficient of the current network event, and the attack threat degree of the security assessment information is evaluated in combination with the attack threat coefficient; A security situation model of the current network event is constructed according to the attack threat level of each network security situation, wherein the security situation model is represented by formula (3), which is as follows: ； （3） Among them, A represents the security situation and attack danger level of the current network event. Indicates the probability of event change, determined in combination with the type of current network event or , Indicates the attack threat coefficient under the current development trend of the incident, Represents the security assessment information data under the current development trend, Represents the original information source data of the current network event, Indicates the event data differences between the original event features and the security assessment information, including feature pointing differences, feature code differences, and feature code variant differences.

2. The network security situation awareness and early warning method based on big data according to claim 1 is characterized in that: The acquisition of relevant historical attack event data, combining the security situation model to perform network security development trend perception processing, extracting possible risk hidden danger data based on risk perception results and generating corresponding risk warning information specifically includes: According to the attack type of the current network event, historical attack event data related to the type is obtained, the historical attack event data is input into the security situation model, and parameter correction processing is performed on the security situation model; Input the network security situation information into the revised security situation model to perform network security situation awareness, and analyze the security development trend of the current network event in combination with the communication association relationship between the service nodes; Extract node operation data that does not meet the security situation model correction coefficient in terms of security development trend and mark them as potential risk data; Combined with the maintenance information of historical attack events, risk avoidance is performed on current risk potential data, and corresponding risk warning information is generated for risk warning processing.

3. A network security situation awareness and early warning system based on big data, characterized in that: include: The data integration module is used to obtain the network operation data corresponding to the current network event and perform data integration and cleaning to obtain network security situation information; A data evaluation module is used to analyze the network security situation information, and perform security situation evaluation processing on the current network event according to the analysis result to obtain security evaluation information of the current network event; The model building module is used to trace the information source of the security assessment information with risks, identify the attack threat level of the security assessment information in combination with the information source, and build a security situation model of the current network event according to the attack threat level of each network security situation; The risk warning module is used to obtain relevant historical attack event data, perform network security development trend perception processing in combination with the security situation model, extract possible risk hidden danger data based on the risk perception results and generate corresponding risk warning information; Wherein, the data integration module specifically includes: A derivative analysis submodule, used to obtain the number of accesses and the access time of the current network event on each service node, and to perform derivative correlation analysis on the network operation data according to the number of accesses and the access time; A data integration submodule, for performing redundancy cleaning processing on the network operation data according to the derived association analysis result, and performing data integration processing on the cleaned network operation data according to the access order; The association analysis submodule is used to perform node association analysis on the access service node according to the access service node of the current network event, and predict the derived service node that meets the node association according to the association analysis result; The data extraction submodule is used to perform data commonality analysis on the integrated network operation data, and extract event features from the network operation data with commonality in combination with the derived service nodes to obtain network security situation information; Wherein, the data evaluation module specifically includes: An attack analysis submodule is used to comprehensively analyze the attack direction and attack range of the network security situation information, and classify the network attack type of the current network event according to the analysis results; The event change probability of each service node in a single attack direction is calculated by formula (1), which is as follows: ； （1） in, Indicates the probability of event change for each service node in a single direction, - Respectively represent the sum of event codes of the current network event on each service node, - They respectively represent the event code changes between adjacent service nodes in a single attack direction of the current network event. - Indicates the routing coefficient of the code corresponding to the current network event in each service node, Indicates the number of service nodes associated with the current network event; The situation assessment submodule is used to analyze the event attack intensity of the current network event according to the event change probability between adjacent service nodes, and to perform security situation assessment processing on the operation changes of the current network event in combination with the corresponding service node; An attack marking submodule, used to evaluate the current network event as a network attack situation when the attack intensity of the event is in positive proportion to the corresponding node operation change; A normal marking submodule is used to evaluate the current network event as a normal network situation when the attack intensity of the event is inversely proportional to the corresponding node operation change, and obtain security assessment information of the current network event; Wherein, the data evaluation module also includes: The data collection submodule is used to obtain the event running rate of the current network event on each service node for network events of indiscriminate attack types; The event change probability of each service node within the same attack range is expressed by formula (2), which is as follows: ； （2） in, represents the event change probability of each service node within the same attack range, - Indicates the event running rate corresponding to each service node; The model building module specifically includes: An information tracing submodule is used to obtain the IP address and node traversal data of the risky security assessment information, and perform information source tracing processing according to the IP address and the node traversal data to obtain the original information source data of the security assessment information; A data training submodule is used to use the original information source data as the original structure parameter to perform data training on the security assessment information, and analyze the event data difference between the security assessment information and the original information source data according to the training result; A threat assessment submodule, used to use the ratio between the event data difference and the original information source data as the attack threat coefficient of the current network event, and to assess the attack threat level of the security assessment information in combination with the attack threat coefficient; The model building submodule is used to build a security situation model of the current network event according to the attack threat level of each network security situation, wherein the security situation model is represented by formula (3), which is as follows: ； （3） Among them, A represents the security situation and attack danger level of the current network event. Indicates the probability of event change, determined in combination with the type of current network event or , Indicates the attack threat coefficient under the current development trend of the incident, Represents the security assessment information data under the current development trend, Represents the original information source data of the current network event, Indicates the event data differences between the original event features and the security assessment information, including feature pointing differences, feature code differences, and feature code variant differences.

4. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the network security situation awareness and early warning method based on big data are implemented as described in any one of claims 1 to 2.

5. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the network security situation awareness and early warning method based on big data are implemented as described in any one of claims 1 to 2.

Images