Threat monitoring methods, devices and storage media

Abstract

This disclosure provides a threat monitoring method, apparatus, and storage medium, relating to the field of communication technology. It addresses the technical problems in related technologies where monitoring and analyzing MEC network traffic is difficult, potentially leading to delayed detection of network attacks and compromised network data security. The method includes: determining the total trust level value of a target node over multiple preset periods based on historical information interaction data; using the historical information interaction data to characterize the success or abnormal behavior of information interaction by the target node over the multiple preset periods; using the trust level value to characterize the trustworthiness of the target node; determining the security value of the target node based on the historical information interaction data, the total trust level value, and the security value; using the security value to characterize the likelihood of the target node being attacked; and monitoring the threat status of the target node based on the security value. This disclosure is applicable to MEC network threat monitoring scenarios.

Description

Technical Field

[0001] This disclosure relates to the field of communication technology, and in particular to a threat monitoring method, apparatus and storage medium. Background Technology

[0002] Currently, Mobile Edge Computing (MEC) technology migrates intensive computing tasks to nearby network edge servers, reducing congestion and network communication latency in the core and transport networks, and decreasing data transmission between customers and the core network, thereby improving service processing speed. However, MEC has a low level of security protection, making it vulnerable to network attacks and compromising data security.

[0003] To ensure data security, a common approach is to monitor and analyze traffic data during MEC operation, and to locate network attacks when they are detected. However, full traffic analysis requires analyzing all MEC traffic, which is difficult to monitor and analyze, and may make it hard to detect network attacks in a timely manner, thus compromising network data security. Summary of the Invention

[0004] This disclosure provides a threat monitoring method, device, and storage medium, which solves the technical problems in related technologies such as the difficulty in monitoring and analyzing MEC network traffic, the potential difficulty in timely detecting network attacks, and the difficulty in ensuring network data security.

[0005] To achieve the above objectives, the present disclosure adopts the following technical solution:

[0006] Firstly, a threat monitoring method is provided, comprising: determining the total trust level value of a target node over multiple preset periods based on historical information interaction data of the target node; the historical information interaction data is used to characterize the success or abnormal behavior of information interaction of the target node over multiple preset periods; the total trust level value is the sum of the trust level values ​​of each preset period; the trust level value is used to characterize the trustworthiness of the target node; determining the security value of the target node based on the historical information interaction data, the total trust level value; the security value is used to characterize the likelihood of the target node being attacked; and monitoring the threat status of the target node based on the security value.

[0007] In conjunction with the first aspect mentioned above, in one possible implementation, the historical information interaction data includes: the total number of information security interactions of the target node within multiple preset periods, and the total number of abnormal behaviors of the target node within multiple preset periods; the method specifically includes: determining the preset security value of the target node based on the total number of information security interactions of the target node and the total number of abnormal behaviors; and substituting the total number of information security interactions, the preset security value, and the total trust level value into the security value calculation formula to determine the security value.

[0008] In conjunction with the first aspect mentioned above, in one possible implementation, the method specifically includes: obtaining a second trust level value of the target node in a second target preset period; the second target preset period is the preset period preceding the first target preset period; determining a security level growth coefficient of the target node based on historical information interaction data of the target node; the security level growth coefficient is used to characterize the security level of the target node; and substituting the security level growth coefficient, the second trust level value, and the total number of abnormal behaviors into the trust level value calculation formula to determine a first trust level value.

[0009] In conjunction with the first aspect mentioned above, in one possible implementation, the method specifically includes: obtaining a preset security interaction number threshold; the preset security interaction number threshold is used to characterize the number of normal security interactions of nodes in the MEC network; and substituting the preset security interaction number threshold and the total number of information security interactions into the security level growth coefficient calculation formula to determine the security level growth coefficient.

[0010] In conjunction with the first aspect mentioned above, in one possible implementation, the method further includes: collecting network logs of the target node based on a preset time interval; and obtaining historical information interaction data of the target node based on the network logs.

[0011] In conjunction with the first aspect mentioned above, in one possible implementation, the safety value P k Satisfy the following formula:

[0012]

[0013] Where S represents the total number of information security interactions. S represents the total trust level value; P1 represents the total number of information security interactions; n represents the preset security value; and e represents the total number of preset cycles.

[0014] In conjunction with the first aspect mentioned above, in one possible implementation, the first trust level value T n Satisfy the following formula:

[0015] T n =T n-1 *ω n *e -F

[0016] Among them, T n A preset trust level value for the first target over a predetermined period; T n-1 The preset trust level value for the second objective over a predetermined period; ω n is the safety level growth coefficient; F is the total number of abnormal behaviors; e is a preset constant.

[0017] Secondly, a threat monitoring device is provided, comprising: a processing unit; the processing unit being configured to determine the total trust level value of a target node over multiple preset periods based on historical information interaction data of the target node; the historical information interaction data being used to characterize the success or abnormal behavior of information interaction of the target node over multiple preset periods; the total trust level value being the sum of the trust level values ​​of each preset period; the trust level value being used to characterize the trustworthiness of the target node; the processing unit being configured to determine the security value of the target node based on the historical information interaction data and the total trust level value; the security value being used to characterize the likelihood of the target node being attacked; and the processing unit being configured to monitor the threat status of the target node based on the security value.

[0018] In conjunction with the second aspect above, in one possible implementation, the historical information interaction data includes: the total number of information security interactions of the target node within multiple preset periods, and the total number of abnormal behaviors of the target node within multiple preset periods; the processing unit is specifically used to: determine the preset security value of the target node based on the total number of information security interactions of the target node and the total number of abnormal behaviors; and substitute the total number of information security interactions, the preset security value, and the total trust level value into the security value calculation formula to determine the security value.

[0019] In conjunction with the second aspect above, in one possible implementation, the device further includes: a communication unit; and a processing unit, specifically configured to instruct the communication unit to acquire a second trust level value of the target node in a second target preset period; the second target preset period is the preset period preceding the first target preset period; to determine a security level growth coefficient of the target node based on historical information interaction data of the target node; the security level growth coefficient is used to characterize the security level of the target node; and to determine a first trust level value by substituting the security level growth coefficient, the second trust level value, and the total number of abnormal behaviors into the trust level value calculation formula.

[0020] In conjunction with the second aspect above, in one possible implementation, the processing unit is specifically used to: instruct the communication unit to obtain a preset security interaction number threshold; the preset security interaction number threshold is used to characterize the number of normal security interactions of nodes in the MEC network; and substitute the preset security interaction number threshold and the total number of information security interactions into the security level growth coefficient calculation formula to determine the security level growth coefficient.

[0021] In conjunction with the second aspect above, in one possible implementation, the processing unit is specifically used for: collecting network logs of the target node based on a preset time interval; and obtaining historical information interaction data of the target node based on the network logs.

[0022] In conjunction with the second aspect mentioned above, in one possible implementation, the safety value P k Satisfy the following formula:

[0023]

[0024] Where S represents the total number of information security interactions. S represents the total trust level value; P1 represents the total number of information security interactions; n represents the preset security value; and e represents the total number of preset cycles.

[0025] In conjunction with the second aspect above, in one possible implementation, the first trust level value T n Satisfy the following formula:

[0026] T n =T n-1 *ω n *e -F

[0027] Among them, T n A preset trust level value for the first target over a predetermined period; T n-1 The preset trust level value for the second objective over a predetermined period; ω n is the safety level growth coefficient; F is the total number of abnormal behaviors; e is a preset constant.

[0028] Thirdly, a threat monitoring device is provided, comprising: a processor and a memory; wherein the memory is used to store computer execution instructions, and when the threat monitoring device is running, the processor executes the computer execution instructions stored in the memory to cause the threat monitoring device to perform the threat monitoring method as described in the first aspect above and any possible implementation thereof.

[0029] Fourthly, a computer-readable storage medium is provided, which stores instructions that, when executed by a processor of a threat monitoring device, cause the threat monitoring device to perform the threat monitoring method as described in the first aspect and any possible implementation thereof.

[0030] Fifthly, a chip is provided, the chip including a processor and a communication interface, the communication interface and the processor being coupled, the processor being used to run computer programs or instructions to implement the threat monitoring method as described in the first aspect above and any possible implementation thereof.

[0031] In this disclosure, the names of the aforementioned threat monitoring devices do not limit the devices or functional modules themselves. In actual implementation, these devices or functional modules may appear under other names. As long as the functions of each device or functional module are similar to those of this disclosure, they fall within the scope of this disclosure and its equivalents.

[0032] The technical solution provided in this disclosure offers at least the following beneficial effects: This disclosure provides a data service method, which includes: determining the total trust level value of a target node over multiple preset periods based on historical information interaction data of the target node; using historical information interaction data to characterize the success or abnormal behavior of information interaction of the target node over multiple preset periods; the total trust level value is the sum of the trust level values ​​for each preset period; the trust level value is used to characterize the trustworthiness of the target node; that is, the trustworthiness of the target node is determined based on the success or abnormal behavior of information interaction over multiple preset periods; then, based on historical information interaction data, the total trust level value, and the target node's security value, a security value is determined to characterize the likelihood of the target node being attacked, based on the success of information interaction, abnormal behavior, and trustworthiness over multiple preset periods; and monitoring the threat situation of the target node is achieved through real-time monitoring of the security value. This solves the technical problem of the difficulty in monitoring and analyzing MEC network traffic, the potential difficulty in timely detecting network attacks, and the difficulty in ensuring network data security. Attached Figure Description

[0033] To more clearly illustrate the technical solutions in the embodiments of this disclosure or the prior art, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below.

[0034] Figure 1 This is a schematic diagram of the structure of a threat monitoring system provided in an embodiment of the present disclosure;

[0035] Figure 2 This is a schematic diagram of the hardware structure of a threat monitoring device provided in an embodiment of the present disclosure;

[0036] Figure 3 A schematic flowchart illustrating a threat monitoring method provided in an embodiment of this disclosure;

[0037] Figure 4 A flowchart illustrating yet another threat monitoring method provided in this disclosure embodiment;

[0038] Figure 5 A flowchart illustrating yet another threat monitoring method provided in this disclosure embodiment;

[0039] Figure 6 A flowchart illustrating yet another threat monitoring method provided in this disclosure embodiment;

[0040] Figure 7 A flowchart illustrating yet another threat monitoring method provided in this disclosure embodiment;

[0041] Figure 8 This is a schematic diagram of the structure of another threat monitoring system provided in the embodiments of this disclosure;

[0042] Figure 9 This is a schematic diagram of the structure of a threat monitoring device provided in an embodiment of this disclosure. Detailed Implementation

[0043] The following description, in conjunction with the accompanying drawings, details a threat monitoring method, apparatus, and storage medium provided in the embodiments of this disclosure.

[0044] In this article, the term "and / or" is merely a description of the relationship between related objects, indicating that there can be three relationships. For example, A and / or B can represent three situations: A exists alone, A and B exist simultaneously, and B exists alone.

[0045] The terms “first” and “second” in this disclosure and its accompanying drawings are used to distinguish different objects or to distinguish different treatments of the same object, rather than to describe a particular order of objects.

[0046] Furthermore, the terms "comprising" and "having," and any variations thereof, used in the description of this disclosure are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not limited to the listed steps or units, but may optionally include other steps or units not listed, or may optionally include other steps or units inherent to such processes, methods, products, or apparatus. It should be noted that in the embodiments of this disclosure, words such as "exemplary" or "for example" are used to indicate examples, illustrations, or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of this disclosure should not be construed as preferred or advantageous over other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present the relevant concepts in a specific manner.

[0047] In the description of this disclosure, unless otherwise stated, "multiple" means two or more.

[0048] Currently, MEC (Multi-access Edge Computing) is based on mobile network platforms. The ultimate goal of mobile networks is a fully connected world, where data generated is built and continuously creates value in the cloud. Applications such as connected vehicles, smart manufacturing, smart agriculture, municipal meter reading, smart buildings, telemedicine, and disaster early warning are the primary entry points for the Internet of Things (IoT) in vertical industries and will flourish in the era of 5G mobile communication technology. MEC provides network service environments and cloud computing capabilities at the edge of mobile cellular networks, aiming to reduce latency, ensure efficient network operation and service, and provide a better user experience. However, due to its relatively low security level, MEC is vulnerable to cyberattacks, making it difficult to guarantee data security. A common method to ensure data security is to monitor and analyze traffic data during MEC operation, locating cyberattacks when they are detected. However, full traffic analysis requires analyzing all MEC traffic, which is difficult to monitor and analyze, potentially hindering the timely detection of cyberattacks and compromising network data security.

[0049] To address the aforementioned technical problems, this disclosure provides a threat monitoring method, apparatus, and storage medium to resolve the difficulties in monitoring and analyzing MEC network traffic, which may hinder timely detection of network attacks and compromise network data security. The method includes: determining the total trust level value of a target node over multiple preset periods based on historical information interaction data; using historical information interaction data to characterize the success or abnormal behavior of information interaction by the target node over these periods; the total trust level value being the sum of the trust level values ​​for each preset period; the trust level value characterizing the trustworthiness of the target node; that is, determining the trustworthiness of the target node based on the success or abnormal behavior of information interaction over multiple preset periods; then determining the security value of the target node based on historical information interaction data, the total trust level value, and the security value; that is, determining the security value characterizing the likelihood of the target node being attacked based on the success, abnormal behavior, and trustworthiness of information interaction over multiple preset periods; and monitoring the security value in real time to achieve threat monitoring of the target node. This solves the technical problems of the difficulty in monitoring and analyzing MEC network traffic, which may hinder timely detection of network attacks and compromise network data security.

[0050] In one possible implementation, the aforementioned threat detection method can be applied to the threat detection system 100. The following, in conjunction with... Figure 1 This application provides a detailed description of a threat monitoring system 100 according to an embodiment. For example... Figure 1 As shown, Figure 1 A threat monitoring system 100 is provided for embodiments of this disclosure. The system includes: a target node device 101 and a threat monitoring device 102.

[0051] The target node device 101 is used to provide historical information interaction data to the threat monitoring device 102, so that the threat monitoring device 102 can determine the security value of the target node device 101 based on the historical information interaction data, and monitor the threat status of the target node device 101 based on the security value.

[0052] The threat monitoring device 102 is used to determine the total trust level value of the target node device 101 over multiple preset periods based on historical information interaction data of the target node device 101; the historical information interaction data is used to characterize the success or abnormal behavior of information interaction of the target node device 101 over multiple preset periods; the total trust level value is the sum of the trust level values ​​of each preset period in the multiple preset periods; the trust level value is used to characterize the trustworthiness of the target node device 101; based on the historical information interaction data and the total trust level value, the security value of the target node device 101 is determined; the security value is used to characterize the possibility of the target node device 101 being attacked; based on the security value, the threat status of the target node device 101 is monitored.

[0053] In one possible implementation, the hardware structure of the threat monitoring device includes: Figure 2 The components included in the threat monitoring device 200 shown below are described in detail below. Figure 2 The hardware structure of a threat monitoring device is illustrated using the threat monitoring device 200 shown as an example. Figure 2 As shown, the threat monitoring device 200 includes at least one processor 201, a communication line 202, and at least one communication interface 204, and may also include a memory 203. The processor 201, memory 203, and communication interface 204 can be connected via the communication line 202.

[0054] The processor 201 may be a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement embodiments of the present disclosure, such as one or more digital signal processors (DSPs), or one or more field-programmable gate arrays (FPGAs).

[0055] Communication line 202 may include a path for transmitting information between the aforementioned components.

[0056] The communication interface 204 is used to communicate with other devices or communication networks. It can use any transceiver-like device, such as Ethernet, radio access network (RAN), wireless local area network (WLAN), etc.

[0057] The memory 203 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium capable of including or storing desired program code having the form of instructions or data structures and accessible by a computer, but not limited thereto.

[0058] In one possible design, the memory 203 can exist independently of the processor 201, meaning the memory 203 can be an external memory of the processor 201. In this case, the memory 203 can be connected to the processor 201 via a communication line 202 to store execution instructions or application code, and its execution is controlled by the processor 201 to implement the threat monitoring method provided in the embodiments of this disclosure below. In another possible design, the memory 203 can also be integrated with the processor 201, meaning the memory 203 can be an internal memory of the processor 201. For example, the memory 203 can be a cache, which can be used to temporarily store some data and instruction information.

[0059] As one possible implementation, processor 201 may include one or more CPUs, for example Figure 2 CPU0 and CPU1 in the example. Alternatively, the threat monitoring device 200 may include multiple processors, such as CPU0 and CPU1. Figure 2 The processors 201 and 207 are included. Alternatively, the threat monitoring device 200 may also include an output device 205 and an input device 206.

[0060] The following provides a detailed description of a threat monitoring method provided by an embodiment of this disclosure.

[0061] like Figure 3 As shown, Figure 3 This disclosure provides a threat monitoring method that can be applied to, for example... Figure 2 The threat monitoring device shown includes the following methods S301-S303, which are described in detail below.

[0062] S301, The threat monitoring device determines the total trust level of the target node within multiple preset periods based on the historical information interaction data of the target node.

[0063] Historical information interaction data is used to characterize the success or abnormal behavior of the target node in information interaction over multiple preset periods. The total trust level value is the sum of the trust level values ​​for each preset period; the trust level value is used to characterize the trustworthiness of the target node; the target node is any node in the MEC network.

[0064] In one possible implementation, the threat monitoring device acquires the information interaction success and abnormal behavior of the target node within multiple preset periods, and determines the total trust level value of the target node within multiple preset periods based on the information interaction success and abnormal behavior.

[0065] S302. The threat monitoring device determines the security value of the target node based on historical information exchange data and the overall trust level value.

[0066] The security value is used to characterize the likelihood that the target node will be attacked.

[0067] In one possible implementation, the threat monitoring device determines the likelihood of a target node being attacked based on historical information exchange data, the overall trust level value, and so on.

[0068] S303. The threat monitoring device monitors the threat status of target nodes based on security values.

[0069] In one possible implementation, the threat monitoring device determines that the target node is under attack if the security value is less than a preset security threshold.

[0070] In one possible implementation, the threat monitoring device sends an alarm message to the maintenance equipment when it determines that the target node has been attacked.

[0071] The technical solution provided by the above embodiments can bring at least the following beneficial effects: The total trust level value of the target node within multiple preset periods is determined based on historical information interaction data of the target node; the historical information interaction data is used to characterize the success or abnormal behavior of information interaction of the target node within multiple preset periods; the total trust level value is the sum of the trust level values ​​of each preset period; the trust level value is used to characterize the trustworthiness of the target node; that is, the trustworthiness of the target node is determined based on the success or abnormal behavior of information interaction within multiple preset periods; then, based on historical information interaction data, the total trust level value, and the target node's security value is determined; that is, based on the success, abnormal behavior, and trustworthiness of information interaction within multiple preset periods, a security value is determined to characterize the possibility of the target node being attacked; through real-time monitoring of the security value, the threat situation of the target node is monitored. This solves the technical problem that monitoring and analyzing MEC network traffic is difficult, making it difficult to detect network attacks in a timely manner, and making it difficult to guarantee network data security.

[0072] In one possible implementation, historical information interaction data includes: the total number of information security interactions of the target node within multiple preset periods, and the total number of abnormal behaviors of the target node within multiple preset periods; combined with Figure 3 ,like Figure 4 As shown, the process by which the aforementioned S302 threat monitoring device determines the security value of the target node based on historical information interaction data and the overall trust level value can be specifically implemented through the following S401-S402, which will be explained in detail below.

[0073] S401. The threat monitoring device determines the preset security value of the target node based on the total number of information security interactions and the total number of abnormal behaviors of the target node.

[0074] In one possible implementation, the preset security value is an initial security value set by the threat monitoring device based on security information such as the total number of security interactions and the total number of abnormal behaviors of the target node.

[0075] For example, the preset security value is set to 0.3 by the threat monitoring device based on security information such as the total number of security interactions and the total number of abnormal behaviors of the target node. The preset security value ranges from 0.2 to 0.5.

[0076] S402. The threat monitoring device substitutes the total number of information security interactions, the preset security value, and the total trust level value into the security value calculation formula to determine the security value.

[0077] In one possible implementation, the security value P k Satisfy the following formula 1:

[0078]

[0079] Where S represents the total number of information security interactions. S represents the total trust level value; P1 represents the total number of information security interactions; n represents the preset security value; and e represents the total number of preset cycles.

[0080] In one possible implementation, the threat monitoring device substitutes the total number of information security interactions, the preset security value, and the total trust level value into Formula 1 above to determine the security value P of the target node. k .

[0081] It is understandable that the parameter e in Formula 1 -S 、(1-e -S This can achieve the following effect: As the total number of secure information interactions increases, the preset security value affects the security value P. k The impact is reduced.

[0082] The technical solution provided by the above embodiments can bring at least the following beneficial effects: The threat monitoring device determines the total number of information security interactions and the total number of abnormal behaviors of the target node through historical information interaction data, and determines the preset security value of the target node based on the total number of information security interactions and the total number of abnormal behaviors; then, it substitutes the total number of information security interactions, the preset security value, and the total trust level value into the security value calculation formula to determine the security value of the target node; so that the threat monitoring device can monitor the threat situation of the target node through real-time monitoring of the security value. This solves the technical problem that monitoring and analyzing MEC network traffic is difficult, and it may be difficult to detect network attacks in a timely manner, making it difficult to guarantee network data security.

[0083] One possible implementation is, such as Figure 5 As shown, the process of determining the trust level value of the target node in each preset period can be specifically determined through the following S501-S503, which will be explained in detail below.

[0084] S501, The threat monitoring device acquires the second trust level value of the target node in the second target preset period.

[0085] The second target preset period is the preset period preceding the first target preset period.

[0086] In one possible implementation, the threat monitoring device determines the second trust level value for the second target preset period based on the security level growth coefficient, the total number of abnormal behaviors, and the trust level value of the previous preset period of the second target preset period.

[0087] In one possible implementation, when the second target preset period is the first preset period, the threat monitoring device determines the average trust level of all nodes in the MEC network as the second trust level value of the second target preset period.

[0088] S502, The threat monitoring device determines the security level growth coefficient of the target node based on the historical information exchange data of the target node.

[0089] In one possible implementation, the threat monitoring device determines the security level growth coefficient of the target node based on the total number of information security interactions.

[0090] S503. The threat monitoring device substitutes the security level growth coefficient, the second trust level value, and the total number of abnormal behaviors into the trust level value calculation formula to determine the first trust level value.

[0091] In one possible implementation, the first trust level value T n The following formula 2 is satisfied:

[0092] T n =T n-1 *ω n *e -F Formula 2

[0093] Among them, T n A preset trust level value for the first target over a predetermined period; T n-1 The preset trust level value for the second objective over a predetermined period; ω n is the safety level growth coefficient; F is the total number of abnormal behaviors; e is a preset constant.

[0094] In one possible implementation, the threat monitoring device substitutes the security level growth coefficient, the second trust level value, and the total number of abnormal behaviors into Formula 2 above to determine the first trust level value T. n .

[0095] Understandably, when the total number of abnormal behaviors of the target node is 0, e -F The value of 1 has no effect on the security level growth coefficient. When the total number of abnormal behaviors of the target node is not 0, e -F For numbers between 0 and 1, the security level growth coefficient will decrease as abnormal node behavior gradually increases. -F This will result in an exponential decrease, thereby accelerating the rate at which the target node's first trust level value declines.

[0096] The technical solution provided by the above embodiments can bring at least the following beneficial effects: the threat monitoring device obtains the second trust level value of the target node in the second target preset period, and determines the security level growth coefficient of the target node based on the historical information interaction data of the target node. The security level growth coefficient, the second trust level value, and the total number of abnormal behaviors are substituted into the trust level value calculation formula to determine the first trust level value. That is, the trust level value of the target node in each preset period is determined by the above method, so that the threat monitoring device can determine the total trust level value of the sum of the trust level values ​​of each preset period in multiple preset periods.

[0097] In one possible implementation, combining Figure 5 ,like Figure 6 As shown in the figure, the process by which the threat monitoring device determines the security level growth coefficient of the target node based on the historical information interaction data of the target node in S502 can be specifically implemented through the following S601-S602, which will be explained in detail below.

[0098] S601, The threat monitoring device acquires a preset threshold number of security interactions.

[0099] The preset security interaction threshold is used to characterize the number of normal security interactions between nodes in the MEC network.

[0100] In one possible implementation, the threat monitoring device acquires the number of security interactions of all nodes in the MEC network and determines the average number of security interactions of all nodes in the MEC network as a preset security interaction threshold.

[0101] S602. The threat monitoring device substitutes the preset security interaction number threshold and the total number of information security interactions into the security level growth coefficient calculation formula to determine the security level growth coefficient.

[0102] In one possible implementation, the safety level growth coefficient ω i The following formula 3 is satisfied:

[0103] ω i =e S / V Formula 3

[0104] Where S is the total number of information security interactions; V is the preset threshold for the number of security interactions; and e is a constant.

[0105] Understandably, when the total number of information security interactions is less than a preset threshold, the S / V ratio is less than 1, resulting in a smaller security level growth coefficient and a slower increase in the target node's security level compared to the previous period. Conversely, when the total number of information security interactions exceeds the preset threshold, indicating that the target node has a sufficient history of information security interactions, the S / V ratio is greater than 1, resulting in a larger security level growth coefficient and a faster increase in the node's security level compared to the previous period. Nodes with a certain history of security interactions experience a faster growth rate in their security level growth coefficient.

[0106] The technical solution provided by the above embodiments can bring at least the following beneficial effects: the threat monitoring device obtains a preset security interaction number threshold for characterizing the number of normal security interactions of nodes in the MEC network, substitutes the preset security interaction number threshold and the total number of information security interactions into the security level growth coefficient calculation formula, and determines the security level growth coefficient. That is, the security level growth coefficient is determined by whether the target node has sufficient information security interaction history, so that the threat monitoring device can determine the trust level value of each preset period in multiple preset periods based on the security level growth coefficient.

[0107] One possible implementation is, such as Figure 7 As shown, before the threat monitoring device determines the total trust level value of the target node within multiple preset periods based on the historical information interaction data of the target node in S301, it is also necessary to obtain the historical information interaction data of the target node. This process can be implemented through the following S701-S702, which will be explained in detail below.

[0108] S701, The threat monitoring device collects network logs of target nodes based on preset time intervals.

[0109] In one possible implementation, the threat monitoring device collects network logs of nodes in the MEC network from network security protection devices at preset time intervals.

[0110] For example, the threat monitoring device obtains network logs of nodes in the MEC network from network security devices such as firewalls, intrusion prevention systems, and intrusion detection systems every half hour.

[0111] S702, the threat monitoring device obtains historical information interaction data of the target node based on network logs.

[0112] In one possible implementation, the threat monitoring device retrieves and organizes the network logs of nodes in the MEC network to obtain historical information interaction data of the target nodes.

[0113] The technical solution provided by the above embodiments can bring at least the following beneficial effects: the threat monitoring device collects network logs of the target node based on a preset time interval, and obtains historical information interaction data of the target node based on the network logs, so that the threat monitoring device can determine the security value of the target node based on the historical information interaction data of the target node, that is, by real-time monitoring of the security value, the threat situation of the target node is monitored.

[0114] One possible implementation is, such as Figure 8 As shown, Figure 8 This is a schematic diagram of the structure of another threat monitoring system 800 provided in an embodiment of the present disclosure. The threat monitoring system 800 includes: a log collection module 801, an intelligent decision-making module 802, and an intelligent orchestration module 803.

[0115] The log collection module 801 is used to collect network log files; the intelligent decision-making module 802 is used to process the collected network log files to determine the total number of information security interactions and the total number of abnormal behaviors; the intelligent orchestration module 803 is used to determine the security level growth coefficient, trust level value, and security value, and based on the security value, to monitor the threat status of nodes.

[0116] As can be seen, the above mainly describes the technical solutions provided by the embodiments of this disclosure from a methodological perspective. To achieve the above functions, it includes corresponding hardware structures and / or software modules for executing each function. Those skilled in the art should readily recognize that, in conjunction with the modules and algorithm steps of the various examples described in the embodiments disclosed herein, the embodiments of this disclosure can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed in hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this disclosure.

[0117] This disclosure embodiment can divide the threat monitoring device into functional modules according to the above method example. For example, each function can be divided into its own functional module, or two or more functions can be integrated into one processing module. The integrated module can be implemented in hardware or as a software functional module. Optionally, the module division in this disclosure embodiment is illustrative and only represents one logical functional division; other division methods may be used in actual implementation.

[0118] One possible implementation is, such as Figure 9 , Figure 9 This is a schematic diagram of the structure of a threat monitoring device 900 provided in this disclosure.

[0119] Threat monitoring device 900 includes: a processing unit 902; the processing unit 902 is used to determine the total trust level value of the target node within multiple preset periods based on historical information interaction data of the target node; the historical information interaction data is used to characterize the success or abnormal behavior of information interaction of the target node within multiple preset periods; the total trust level value is the sum of the trust level values ​​of each preset period in the multiple preset periods; the trust level value is used to characterize the trustworthiness of the target node; the processing unit 902 is used to determine the security value of the target node based on historical information interaction data and the total trust level value; the security value is used to characterize the possibility of the target node being attacked; the processing unit 902 is used to monitor the threat status of the target node based on the security value.

[0120] In one possible implementation, the historical information interaction data includes: the total number of information security interactions of the target node within multiple preset periods, and the total number of abnormal behaviors of the target node within multiple preset periods; the processing unit 902 is specifically used to: determine the preset security value of the target node based on the total number of information security interactions of the target node and the total number of abnormal behaviors; and substitute the total number of information security interactions, the preset security value, and the total trust level value into the security value calculation formula to determine the security value.

[0121] In one possible implementation, the device further includes: a communication unit 901; and a processing unit 902, specifically configured to instruct the communication unit 901 to acquire a second trust level value of the target node in a second target preset period; the second target preset period is the previous preset period of the first target preset period; to determine a security level growth coefficient of the target node based on historical information interaction data of the target node; the security level growth coefficient is used to characterize the security level of the target node; and to determine a first trust level value by substituting the security level growth coefficient, the second trust level value, and the total number of abnormal behaviors into the trust level value calculation formula.

[0122] In one possible implementation, the processing unit 902 is specifically used to: instruct the communication unit 901 to obtain a preset security interaction number threshold; the preset security interaction number threshold is used to characterize the number of normal security interactions of nodes in the MEC network; and substitute the preset security interaction number threshold and the total number of information security interactions into the security level growth coefficient calculation formula to determine the security level growth coefficient.

[0123] In one possible implementation, the processing unit 902 is specifically used for: collecting network logs of the target node based on a preset time interval; and obtaining historical information interaction data of the target node based on the network logs.

[0124] In one possible implementation, the security value P k Satisfy the following formula 1:

[0125]

[0126] Where S represents the total number of information security interactions. S represents the total trust level value; P1 represents the total number of information security interactions; n represents the preset security value; and e represents the total number of preset cycles.

[0127] In conjunction with the second aspect above, in one possible implementation, the first trust level value T n The following formula 2 is satisfied:

[0128] T n =T n-1 *ω n *e -F Formula 2

[0129] Among them, T n A preset trust level value for the first target over a predetermined period; T n-1 The preset trust level value for the second objective over a predetermined period; ω n is the safety level growth coefficient; F is the total number of abnormal behaviors; e is a preset constant.

[0130] This disclosure also provides a threat monitoring device, which includes a processor and a memory; wherein the memory is used to store computer execution instructions, and when the threat monitoring device is running, the processor executes the computer execution instructions stored in the memory to enable the threat monitoring device to perform the threat monitoring method described in this disclosure.

[0131] Embodiments of this disclosure provide a computer program product containing instructions that, when executed on a computer, cause the computer to perform the threat monitoring method described in the above method embodiments.

[0132] Embodiments of this disclosure provide a chip including a processor and a communication interface, the communication interface and the processor being coupled together, the processor being used to run computer programs or instructions to implement the threat monitoring method as described in the above method embodiments.

[0133] The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of computer-readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), registers, hard disks, optical fibers, compact disc read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing, or any other form of computer-readable storage medium in the art. An exemplary storage medium is coupled to a processor, enabling the processor to read information from and write information to the storage medium. Of course, the storage medium may also be a component of the processor. The processor and the storage medium may reside in an application-specific integrated circuit (ASIC). In this embodiment of the disclosure, the computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0134] Since the apparatus, devices, computer-readable storage media, and computer program products in the embodiments of this disclosure can be applied to the above methods, the technical effects they can achieve can also be referred to the above method embodiments. The embodiments of this disclosure will not be repeated here.

[0135] The above descriptions are merely specific embodiments of this disclosure, but the scope of protection of this disclosure is not limited thereto. Any variations or substitutions within the technical scope disclosed in this disclosure should be included within the scope of protection of this disclosure. Therefore, the scope of protection of this disclosure should be determined by the scope of the claims.

Claims

1. A threat monitoring method characterized by, The method comprises: determining a total trust level value of the target node in a plurality of preset periods based on historical information interaction data of the target node; the historical information interaction data is obtained based on a network log, and is used to represent information interaction success or abnormal behavior of the target node in the plurality of preset periods; the total trust level value is the sum of trust level values of each preset period in the plurality of preset periods; the trust level value is used to represent the trust degree of the target node; wherein the historical information interaction data comprises: total information security interaction times of the target node in the plurality of preset periods, and total abnormal behavior times of the target node in the plurality of preset periods; The trust level value T n satisfies the following equation: Wherein, T n is the trust level value of the first target preset period; T n-1 is the trust level value of the second target preset period; is the security level growth coefficient, used to represent the security degree of the target node; F is the total number of abnormal behaviors; and e is a preset constant. determining a preset security value of the target node based on the total information security interaction times and the total abnormal behavior times; substituting the total information security interaction times, the preset security value and the total trust level value into a security value calculation formula to determine a security value of the target node; the security value is used to represent the possibility of the target node being attacked; The security value P k satisfies the following equation: Wherein, S is the total number of information security interactions, is the total trust level value; P1 is the preset security value; n is the total number of periods of the plurality of preset periods; e is a preset constant; monitoring the threat situation of the target node based on the security value.

2. The method of claim 1, wherein, The trust level value of the target node in each preset period is determined according to the following process: obtaining a second trust level value of the target node in a second target preset period; the second target preset period is a previous preset period of a first target preset period; determining a security level growth coefficient of the target node based on the historical information interaction data of the target node; substituting the security level growth coefficient, the second trust level value and the total abnormal behavior times into a trust level value calculation formula to determine a first trust level value.

3. The method of claim 2, wherein, The method further comprises: acquiring a network log of the target node based on a preset time interval; obtaining the historical information interaction data of the target node based on the network log.

4. The method according to any one of claims 1 to 3, characterized in that, The method comprises: a processing unit; the processing unit is configured to determine a total trust level value of the target node in a plurality of preset periods based on historical information interaction data of the target node; 5. A threat monitoring apparatus characterized by comprising: the historical information interaction data is obtained based on a network log, and is used to represent information interaction success or abnormal behavior of the target node in the plurality of preset periods; the total trust level value is the sum of trust level values of each preset period in the plurality of preset periods; the trust level value is used to represent the trust degree of the target node; wherein the historical information interaction data comprises: total information security interaction times of the target node in the plurality of preset periods, and total abnormal behavior times of the target node in the plurality of preset periods; determining a preset security value of the target node based on the total information security interaction times and the total abnormal behavior times; substituting the total information security interaction times, the preset security value and the total trust level value into a security value calculation formula to determine a security value of the target node; the security value is used to represent the possibility of the target node being attacked; monitoring the threat situation of the target node based on the security value. The trust level value T n satisfies the following equation: Wherein, T n is the trust level value of the first target preset period; T n-1 is the trust level value of the second target preset period; is the security level growth coefficient, used to represent the security degree of the target node; F is the total number of abnormal behaviors; and e is a preset constant. The processing unit is specifically configured to determine a preset security value of the target node based on the total number of information security interactions of the target node and the total number of abnormal behaviors; The total number of information security interactions, the preset security value, and the total trust level value are substituted into a security value calculation formula to determine a security value of the target node; the security value is used to represent a possibility of the target node being attacked; The security value P k satisfies the following equation: Wherein, S is the total number of information security interactions, is the total trust level value; P1 is the preset security value; n is the total number of periods of the plurality of preset periods; e is a preset constant; The processing unit is configured to monitor a threat situation of the target node based on the security value.

6. A threat monitoring apparatus, characterized by, The threat monitoring device comprises: A processor and a memory; the memory is configured to store computer execution instructions; when the threat monitoring device is running, the processor executes the computer execution instructions stored in the memory, so that the threat monitoring device executes the threat monitoring method in any one of claims 1-4.

7. A computer readable storage medium characterized in that, The computer readable storage medium stores instructions; when the instructions in the computer readable storage medium are executed by the processor of the threat monitoring device, the threat monitoring device executes the threat monitoring method in any one of claims 1-4.

Images