Network security incident analysis method, device, electronic device and storage medium

Abstract

The present invention relates to the field of security protection technology, and specifically discloses a network security event analysis method, device, electronic device and storage medium, wherein the method comprises the following steps: comprising the following steps: S1: obtaining historical event records of a server within a preset monitoring period; S2: calculating the attack interval; generating an attack interval set, and calculating the attack ratio; calculating the difference between two adjacent attack intervals in the sorting, and determining the target difference, and counting the total number of target differences; S3: calculating an evaluation score according to the total number of target differences, the attack ratio and the duration of a single network security event, and judging the attack situation of the server according to the evaluation score. The present invention can screen servers that need to be protected according to the attack situation of the server, thereby reducing the number of servers that need to be protected, and further reducing the manpower cost and time cost of protecting the server.

Description

Technical Field

[0001] The present invention relates to the field of security protection technology, and in particular to a network security event analysis method, device, electronic device and storage medium. Background Art

[0002] A network security incident refers to a malicious act or event targeting the security of a computer system, network or data. These acts or events may lead to data leakage, service interruption, system damage or other forms of security risks. Therefore, in order to improve the security of data when a network security incident occurs, it is usually necessary to perform security protection on the server.

[0003] There may be multiple servers in an enterprise, and different servers may correspond to different functions and purposes. For example, some servers may be used to host websites and applications to provide external services; other servers may be used to store and manage the company's internal database to ensure data integrity and security; and some servers may be used specifically to handle email services or file sharing to support internal communication and collaboration. In this case, the labor cost and time cost of server security protection are both high. Therefore, how to reduce the labor cost and time cost of server security protection has become an urgent problem to be solved. Summary of the invention

[0004] The purpose of the present invention is to provide a network security event analysis method, device, electronic device and storage medium to solve the above technical problems.

[0005] The purpose of the present invention can be achieved through the following technical solutions:

[0006] The network security incident analysis method includes the following steps:

[0007] S1: Obtain historical event records of the server within a preset monitoring period, wherein the historical event records include the time when the network security event occurred and the duration of a single network security event;

[0008] S2: Calculate the attack interval ΔD i =|D i -D i+1 |, D i represents the time when the i-th network security incident occurs, i∈[1,m-1], and m represents the total number of network security incidents occurring on a single server;

[0009] Generate attack interval set DJH = (ΔD1, ΔD2, ..., ΔD m-1), and calculate the attack ratio B = (sum{c∈DJH|c≤DPJ}) / (m-1), where sum{c∈DJH|c≤DPJ} represents the number of elements in the attack interval set DJH that are less than or equal to the average attack interval DPJ. The calculation formula of the average attack interval DPJ is: , ΔDa b represents the bth attack interval of the ath server;

[0010] The attack intervals are sorted in time axis order, and the difference between two adjacent attack intervals in the sorting is calculated. When the difference is less than 0, it is marked as a target difference, and the total number C of the target differences is counted;

[0011] S3: Calculate an evaluation score K according to the total number of target differences, the attack ratio, and the duration of a single network security incident, and determine the attack status of the server according to the evaluation score K;

[0012] The process of calculating the evaluation score K according to the total number of target differences, the attack ratio, and the duration of a single network security incident specifically includes:

[0013] Obtain the number of successful protections m' when a network security incident occurs, and calculate the evaluation score K through the formula, which is:

[0014] ;

[0015] Where T tot Indicates the length of the monitoring period, T y It indicates the duration of the yth cybersecurity incident, and α is the preset correction coefficient;

[0016] The process of judging the attack status of the server according to the evaluation score K specifically includes:

[0017] When 0<K≤K', it is judged that the server is slightly attacked and no action is taken;

[0018] When K'<K≤1.8K', it is judged that the server is under attack in general, and the end point of the monitoring period is used as the starting point of the monitoring period X, and the length of the monitoring period X is T tot , and merge the historical event records within the monitoring period into the historical event records within the monitoring period X, and execute subsequent steps;

[0019] When 1.8K'<K, it is judged that the server is seriously attacked and the staff is reminded to perform security protection;

[0020] K' represents the preset evaluation score threshold.

[0021] As a further solution of the present invention: in the step S2, during the process of calculating the average attack interval DPJ, when |ΔDa b When -DPJ|≥ΔDPJ', remove ΔDa b And calculate the average attack interval DPJ again.

[0022] As a further solution of the present invention: in the step S2, when the average attack interval DPJ≤DPJ', DPJ=DPJ' is set and subsequent steps are executed, and DPJ' represents a preset average attack interval threshold.

[0023] As a further solution of the present invention: in the step S1, when no network security incident occurs to the server within a preset monitoring period, subsequent steps are not executed for the server, and it is determined that the attack situation of the server is relatively low.

[0024] A network security incident analysis device, comprising:

[0025] Record collection module: obtain historical event records of the server within a preset monitoring period, wherein the historical event records include the time when the network security event occurred and the duration of a single network security event;

[0026] Historical event processing module: Calculate attack interval ΔD i =|D i -D i+1 |, D i represents the time when the i-th network security incident occurs, i∈[1,m-1], and m represents the total number of network security incidents occurring on a single server;

[0027] Generate attack interval set DJH = (ΔD1, ΔD2, ..., ΔD m-1 ), and calculate the attack ratio B = (sum{c∈DJH|c≤DPJ}) / (m-1), where sum{c∈DJH|c≤DPJ} represents the number of elements in the attack interval set DJH that are less than or equal to the average attack interval DPJ. The calculation formula of the average attack interval DPJ is: , ΔDa b represents the bth attack interval of the ath server;

[0028] The attack intervals are sorted in time axis order, and the difference between two adjacent attack intervals in the sorting is calculated. When the difference is less than 0, it is marked as a target difference, and the total number C of the target differences is counted;

[0029] Judgment module: calculates the evaluation score K according to the total number of target differences, the attack ratio and the duration of a single network security incident, and judges the attack status of the server according to the evaluation score K;

[0030] The process of calculating the evaluation score K according to the total number of target differences, the attack ratio, and the duration of a single network security incident specifically includes:

[0031] Obtain the number of successful protections m' when a network security incident occurs, and calculate the evaluation score K through the formula, which is:

[0032] ;

[0033] Where T tot Indicates the length of the monitoring period, T y It indicates the duration of the yth cybersecurity incident, and α is the preset correction coefficient;

[0034] The process of judging the attack status of the server according to the evaluation score K specifically includes:

[0035] When 0<K≤K', it is judged that the server is slightly attacked and no action is taken;

[0036] When K'<K≤1.8K', it is judged that the server is under attack in general, and the end point of the monitoring period is used as the starting point of the monitoring period X, and the length of the monitoring period X is T tot , and merge the historical event records within the monitoring period into the historical event records within the monitoring period X, and execute subsequent steps;

[0037] When 1.8K'<K, it is judged that the server is seriously attacked and the staff is reminded to perform security protection;

[0038] K' represents the preset evaluation score threshold.

[0039] An electronic device comprises a display screen, a memory, a processor and a computer program, wherein the memory stores the computer program, and when the computer program is executed by the processor, the processor executes the steps of the network security event analysis method.

[0040] A storage medium stores a computer program, and when the computer program is executed by a processor, the processor executes the steps of the network security event analysis method.

[0041] Beneficial effects of the present invention: In the present invention, firstly, the historical event records of the server within the preset monitoring period are obtained, and then the time when the network security event occurred and the duration of a single event are determined; this step is basic data collection, which understands the past attack records and provides data support for subsequent analysis; then, the attack interval is calculated, and an attack interval set is generated, and the attack ratio is determined; it should be noted that the attack interval is used to quantify the intensity of attacks on the server (that is, the frequency of network security events). The smaller the attack interval, the shorter the time interval between two adjacent attacks on the server; the attack ratio is used to screen which servers are more intensively attacked than the rest of the servers. The higher the attack ratio, the higher the proportion of the number of attack intervals in the attack interval set that is less than the average attack interval, which further indicates that it may be attacked more frequently in the same period of time, providing a basis for subsequent screening of which servers need security protection;

[0042] Afterwards, the total number of target differences is counted; it is worth noting that calculating the attack ratio is equivalent to comparing with the rest of the servers. However, in actual situations, there may be a situation where the attack ratio is low, but the time interval between attacks on the server itself is shortening (i.e., the number of target differences less than 0 is large). Therefore, it is necessary to consider not only external comparison (i.e., attack ratio) but also the comparison with itself. External comparison can help identify servers that are attacked more frequently than other servers, while self-comparison can reveal the changing trend of the attack frequency of a single server during the monitoring period. Taking these two comparison methods into consideration, the server attack situation can be more comprehensively evaluated to select which servers need security protection; finally, the evaluation score is calculated based on the total number of target differences, the attack ratio, and the duration of a single network security incident, and the server attack situation is judged based on the evaluation score. The present invention can screen servers that need security protection according to the server attack situation, thereby reducing the number of servers that need security protection, and thereby reducing the manpower cost and time cost of security protection for the server. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] The present invention will be further described below in conjunction with the accompanying drawings.

[0044] Figure 1 It is a flow chart of the network security incident analysis method of the present invention. DETAILED DESCRIPTION

[0045] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0046] See also Figure 1 As shown, the present invention is a network security event analysis method, comprising the following steps:

[0047] S1: Obtain historical event records of the server within a preset monitoring period, wherein the historical event records include the time when the network security event occurred and the duration of a single network security event;

[0048] S2: Calculate the attack interval ΔD i =|D i -D i+1 |, D i represents the time when the i-th network security incident occurs, i∈[1,m-1], and m represents the total number of network security incidents occurring on a single server;

[0049] Generate attack interval set DJH = (ΔD1, ΔD2, ..., ΔD m-1 ), and calculate the attack ratio B = (sum{c∈DJH|c≤DPJ}) / (m-1), where sum{c∈DJH|c≤DPJ} represents the number of elements in the attack interval set DJH that are less than or equal to the average attack interval DPJ. The calculation formula of the average attack interval DPJ is: , ΔDa b represents the bth attack interval of the ath server;

[0050] The attack intervals are sorted in time axis order, and the difference between two adjacent attack intervals in the sorting is calculated. When the difference is less than 0, it is marked as a target difference, and the total number C of the target differences is counted;

[0051] S3: Calculate an evaluation score K according to the total number of target differences, the attack ratio, and the duration of a single network security incident, and determine the attack status of the server according to the evaluation score K;

[0052] The process of calculating the evaluation score K according to the total number of target differences, the attack ratio, and the duration of a single network security incident specifically includes:

[0053] Obtain the number of successful protections m' when a network security incident occurs, and calculate the evaluation score K through the formula, which is:

[0054] ;

[0055] Where T tot Indicates the length of the monitoring period, T y It indicates the duration of the yth cybersecurity incident, and α is the preset correction coefficient;

[0056] The process of judging the attack status of the server according to the evaluation score K specifically includes:

[0057] When 0<K≤K', it is judged that the server is slightly attacked and no action is taken;

[0058] When K'<K≤1.8K', it is judged that the server is under attack in general, and the end point of the monitoring period is used as the starting point of the monitoring period X, and the length of the monitoring period X is T tot , and merge the historical event records within the monitoring period into the historical event records within the monitoring period X, and execute subsequent steps;

[0059] When 1.8K'<K, it is judged that the server is seriously attacked and the staff is reminded to perform security protection;

[0060] K' represents the preset evaluation score threshold.

[0061] It should be noted that, as is common knowledge in the field, common network security incidents include, but are not limited to, malware attacks, phishing, denial of service attacks (DoS) and distributed denial of service attacks (DDoS), and man-in-the-middle attacks;

[0062] It is worth noting that first, the historical event records of the server within the preset monitoring period are obtained, and then the time when the network security event occurred and the duration of a single event are determined; this step is basic data collection, understanding past attack records, and providing data support for subsequent analysis; after that, the attack interval is calculated, and an attack interval set is generated, and the attack ratio is determined; it should be noted that the attack interval is used to quantify the intensity of attacks on the server (that is, the frequency of network security events). The smaller the attack interval, the shorter the time interval between two consecutive attacks on the server; the attack ratio is used to screen which servers are more intensively attacked than the rest of the servers. The higher the attack ratio, the higher the proportion of the number of attack intervals in the attack interval set that is less than the average attack interval, which means that it may be attacked more frequently in the same period of time, providing a basis for subsequent screening of which servers need security protection;

[0063] Afterwards, the total number of target differences is counted; it is worth noting that calculating the attack ratio is equivalent to comparing with the rest of the servers. However, in actual situations, there may be a situation where the attack ratio is low, but the time interval between attacks is shortening (that is, the number of target differences less than 0 is large). Therefore, it is necessary to consider not only external comparison (that is, attack ratio) but also the comparison with oneself. External comparison can help identify servers that are attacked more frequently than other servers, while self-comparison can reveal the changing trend of the attack frequency of a single server during the monitoring period. Taking these two comparison methods into consideration, the attack situation of the server can be more comprehensively evaluated to select which servers need security protection; finally, the evaluation score is calculated based on the total number of target differences, the attack ratio and the duration of a single network security incident, and the attack situation of the server is judged based on the evaluation score.

[0064] It is worth noting that the more times a network security incident is successfully protected when it occurs, the better the security protection effect of the system is, and it is inversely proportional to the evaluation score; the larger the target ratio, the more intensively the server is attacked compared to the average level, and it is directly proportional to the evaluation score; for the same reason, the total number of target differences and the duration of a single network security incident are directly proportional to the evaluation score, which will not be elaborated here; among them, the duration of a single network security incident is used to reflect the degree of attack on the server. The longer a single network security incident lasts, the higher the degree of attack on the server.

[0065] It can be understood that the attack situation of the server is graded according to different intervals of the evaluation score K. The evaluation score K is a comprehensive indicator calculated based on historical attack data, which reflects the attack status of the server during the monitoring period. Through graded processing, appropriate response measures can be taken for different attack situations, thereby avoiding waste of resources and overreaction. For servers with minor attacks, no processing is done, which can save resources. For servers with general attacks, historical event records are merged into the monitoring period X, which can avoid data security risks caused by the server's failure to protect itself in time. For servers with serious attacks, staff are reminded to perform security protection on them, thereby improving the data security of the server. Security protection measures include but are not limited to updating system patches.

[0066] In another preferred implementation of the present invention, in the step S2, during the process of calculating the average attack interval DPJ, when |ΔDa b When -DPJ|≥ΔDPJ', remove ΔDa b And calculate the average attack interval DPJ again.

[0067] It should be noted that outliers may significantly affect the calculation of the average value, causing the result to deviate from the actual situation; by removing these outliers, the accuracy of the average attack interval DPJ calculation can be improved, making it more reflective of the actual situation of most data; by removing outliers and recalculating the average attack interval DPJ, it is ensured that it more accurately reflects the average frequency of server attacks, thereby improving the accuracy of subsequent judgments.

[0068] In another preferred implementation of the present invention, in step S2, when the average attack interval DPJ≤DPJ', DPJ=DPJ' is set and subsequent steps are executed, and DPJ' represents a preset average attack interval threshold.

[0069] It should be noted that when the average attack interval is small, each server may be frequently attacked. In this case, if the average attack interval DPJ is still used to determine the total ratio, the final calculated evaluation score will be too small, which may lead to the failure to timely provide security protection for some servers that are actually severely attacked, thereby affecting the security of the data.

[0070] In another preferred implementation of the present invention, in the step S1, when no network security incident occurs to the server within a preset monitoring period, subsequent steps are not executed for the server, and it is determined that the attack on the server is minor.

[0071] A network security incident analysis device, comprising:

[0072] Record collection module: obtain historical event records of the server within a preset monitoring period, wherein the historical event records include the time when the network security event occurred and the duration of a single network security event;

[0073] Historical event processing module: Calculate attack interval ΔD i =|D i -D i+1 |, D i represents the time when the i-th network security incident occurs, i∈[1,m-1], and m represents the total number of network security incidents occurring on a single server;

[0074] Generate attack interval set DJH = (ΔD1, ΔD2, ..., ΔD m-1 ), and calculate the attack ratio B = (sum{c∈DJH|c≤DPJ}) / (m-1), where sum{c∈DJH|c≤DPJ} represents the number of elements in the attack interval set DJH that are less than or equal to the average attack interval DPJ. The calculation formula of the average attack interval DPJ is: , ΔDa brepresents the bth attack interval of the ath server;

[0075] The attack intervals are sorted in time axis order, and the difference between two adjacent attack intervals in the sorting is calculated. When the difference is less than 0, it is marked as a target difference, and the total number C of the target differences is counted;

[0076] Judgment module: calculates the evaluation score K according to the total number of target differences, the attack ratio and the duration of a single network security incident, and judges the attack status of the server according to the evaluation score K;

[0077] The process of calculating the evaluation score K according to the total number of target differences, the attack ratio, and the duration of a single network security incident specifically includes:

[0078] Obtain the number of successful protections m' when a network security incident occurs, and calculate the evaluation score K through the formula, which is:

[0079] ;

[0080] Where T tot Indicates the length of the monitoring period, T y It indicates the duration of the yth cybersecurity incident, and α is the preset correction coefficient;

[0081] The process of judging the attack status of the server according to the evaluation score K specifically includes:

[0082] When 0<K≤K', it is judged that the server is slightly attacked and no action is taken;

[0083] When K'<K≤1.8K', it is judged that the server is under attack in general, and the end point of the monitoring period is used as the starting point of the monitoring period X, and the length of the monitoring period X is T tot , and merge the historical event records within the monitoring period into the historical event records within the monitoring period X, and execute subsequent steps;

[0084] When 1.8K'<K, it is judged that the server is seriously attacked and the staff is reminded to perform security protection;

[0085] K' represents the preset evaluation score threshold.

[0086] An electronic device comprises a display screen, a memory, a processor and a computer program, wherein the memory stores the computer program, and when the computer program is executed by the processor, the processor executes the steps of the network security event analysis method.

[0087] A storage medium stores a computer program, and when the computer program is executed by a processor, the processor executes the steps of the network security event analysis method.

[0088] The above is a detailed description of an embodiment of the present invention, but the content is only a preferred embodiment of the present invention and cannot be considered to limit the scope of implementation of the present invention. All equivalent changes and improvements made within the scope of the present invention should still fall within the scope of the patent coverage of the present invention.

Claims

1. A network security incident analysis method, characterized in that: The following steps are involved: S1: Obtain historical event records of the server within a preset monitoring period, wherein the historical event records include the time when the network security event occurred and the duration of a single network security event; S2: Calculate the attack interval ΔD i =|D i -D i+1 |, D i represents the time when the i-th network security incident occurs, i∈[1,m-1], and m represents the total number of network security incidents occurring on a single server; Generate attack interval set DJH = (ΔD1, ΔD2, ..., ΔD m-1 ), and calculate the attack ratio B = (sum{c∈DJH|c≤DPJ}) / (m-1), where sum{c∈DJH|c≤DPJ} represents the number of elements in the attack interval set DJH that are less than or equal to the average attack interval DPJ. The calculation formula of the average attack interval DPJ is: , ΔDa b represents the bth attack interval of the ath server; The attack intervals are sorted in time axis order, and the difference between two adjacent attack intervals in the sorting is calculated. When the difference is less than 0, it is marked as a target difference, and the total number C of the target differences is counted; S3: Calculate an evaluation score K according to the total number of target differences, the attack ratio, and the duration of a single network security incident, and determine the attack status of the server according to the evaluation score K; The process of calculating the evaluation score K according to the total number of target differences, the attack ratio, and the duration of a single network security incident specifically includes: Obtain the number of successful protections m' when a network security incident occurs, and calculate the evaluation score K through the formula, which is: ； Where T tot Indicates the length of the monitoring period, T y It indicates the duration of the yth cybersecurity incident, and α is the preset correction coefficient; The process of judging the attack status of the server according to the evaluation score K specifically includes: When 0<K≤K', it is judged that the server is slightly attacked and no action is taken; When K'<K≤1.8K', it is judged that the server is under attack in general, and the end point of the monitoring period is used as the starting point of the monitoring period X, and the length of the monitoring period X is T tot , and merge the historical event records within the monitoring period into the historical event records within the monitoring period X, and execute subsequent steps; When 1.8K'<K, it is judged that the server is seriously attacked and the staff is reminded to perform security protection; K' represents the preset evaluation score threshold.

2. The network security incident analysis method according to claim 1, characterized in that: In the step S2, when calculating the average attack interval DPJ, when |ΔDa b When -DPJ|≥ΔDPJ', remove ΔDa b And calculate the average attack interval DPJ again.

3. The network security incident analysis method according to claim 1, characterized in that: In the step S2, when the average attack interval DPJ≤DPJ', DPJ=DPJ' is set and subsequent steps are performed, where DPJ' represents a preset average attack interval threshold.

4. The network security incident analysis method according to claim 1, characterized in that: In the step S1, when no network security incident occurs to the server within a preset monitoring period, subsequent steps are not executed for the server, and it is determined that the attack situation of the server is low.

5. A network security event analysis device, characterized in that: include: Record collection module: obtain historical event records of the server within a preset monitoring period, wherein the historical event records include the time when the network security event occurred and the duration of a single network security event; Historical event processing module: Calculate attack interval ΔD i =|D i -D i+1 |, D i represents the time when the i-th network security incident occurs, i∈[1,m-1], and m represents the total number of network security incidents occurring on a single server; Generate attack interval set DJH = (ΔD1, ΔD2, ..., ΔD m-1 ), and calculate the attack ratio B = (sum{c∈DJH|c≤DPJ}) / (m-1), where sum{c∈DJH|c≤DPJ} represents the number of elements in the attack interval set DJH that are less than or equal to the average attack interval DPJ. The calculation formula of the average attack interval DPJ is: , ΔDa b represents the bth attack interval of the ath server; The attack intervals are sorted in time axis order, and the difference between two adjacent attack intervals in the sorting is calculated. When the difference is less than 0, it is marked as a target difference, and the total number C of the target differences is counted; Judgment module: calculates the evaluation score K according to the total number of target differences, the attack ratio and the duration of a single network security incident, and judges the attack status of the server according to the evaluation score K; The process of calculating the evaluation score K according to the total number of target differences, the attack ratio, and the duration of a single network security incident specifically includes: Obtain the number of successful protections m' when a network security incident occurs, and calculate the evaluation score K through the formula, which is: ； Where T tot Indicates the length of the monitoring period, T y It indicates the duration of the yth cybersecurity incident, and α is the preset correction coefficient; The process of judging the attack status of the server according to the evaluation score K specifically includes: When 0<K≤K', it is judged that the server is slightly attacked and no action is taken; When K'<K≤1.8K', it is judged that the server is under attack in general, and the end point of the monitoring period is used as the starting point of the monitoring period X, and the length of the monitoring period X is T tot , and merge the historical event records within the monitoring period into the historical event records within the monitoring period X, and execute subsequent steps; When 1.8K'<K, it is judged that the server is seriously attacked and the staff is reminded to perform security protection; K' represents the preset evaluation score threshold.

6. An electronic device, characterized in that: It includes a display screen, a memory, a processor and a computer program, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the network security event analysis method according to any one of claims 1 to 4.

7. A storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by a processor, the processor executes the steps of the network security incident analysis method described in any one of claims 1 to 4.

Images