A network security situation analysis method based on big data intelligence analysis

Abstract

The present invention relates to the technical field of network situation analysis, and specifically discloses a network security situation analysis method based on big data intelligence analysis, the method comprising: S1: collecting various basic data and threat intelligence data through various channels and methods through an intelligence collection layer, calculating the IP address anomaly coefficient and the data packet risk value of the original data based on a big data analysis platform through an intelligence analysis layer, and evaluating the threat level of the original data in combination with the two groups of data. Since this evaluation method makes a judgment on the threat situation of the original data based on multi-source data, the sensitivity of the analysis is relatively high, thereby increasing the accuracy of the judgment result on whether the original data is threat data, avoiding the situation in conventional analysis where the judgment method is too rough and the analysis sensitivity is relatively poor, resulting in an erroneous judgment on whether the data is threat intelligence, thereby affecting the subsequent use of the original data.

Description

Technical Field

[0001] The present invention relates to the technical field of network situation analysis, and in particular to a network security situation analysis method based on big data intelligence analysis. Background Art

[0002] Network security situation analysis refers to the process of comprehensive analysis and evaluation of various security incidents and threats in the current network environment. It aims to help network administrators and security professionals understand the security status of the network and take appropriate measures in a timely manner to improve network security protection capabilities.

[0003] Common network security situation analysis methods usually start by collecting and analyzing threat intelligence from various sources to understand current network threats, including malware, network attacks, and vulnerability exploits. Then, they evaluate and analyze possible security vulnerabilities in the network to identify potential risk points. In addition, they monitor network traffic and log information in real time to discover abnormal behaviors in the network. Finally, they take appropriate disposal measures based on the collected threat intelligence to reduce the impact of security incidents on the network.

[0004] Common threat intelligence collection methods in the prior art are usually to collect a large amount of data and analyze the collected data. The basis for the analysis is usually to judge the threat level of the data itself based on whether it is in an abnormal state. This judgment method is too rough and the analysis sensitivity is poor. The reliability of the judgment result is low, and it may make an incorrect judgment on whether the data is threat intelligence. Summary of the invention

[0005] The purpose of the present invention is to provide a network security situation analysis method based on big data intelligence analysis to solve the following technical problems:

[0006] How to improve the accuracy of the judgment results on whether data is threat intelligence.

[0007] The purpose of the present invention can be achieved through the following technical solutions:

[0008] A network security situation analysis method based on big data intelligence analysis, the method comprising:

[0009] S1: Collect various basic data and threat intelligence data through various channels and methods through the intelligence collection layer;

[0010] S2: The intelligence analysis layer calculates the IP address anomaly coefficient and data packet risk value of the original data based on the big data analysis platform, and combines the two sets of data to evaluate the threat level of the original data;

[0011] S3: The threat intelligence is stored through the intelligence storage layer based on the data storage function of the big data analysis platform;

[0012] S4: Read threat intelligence through the intelligence output layer and output intelligence through the web interface, API, and subscription push;

[0013] S5: The intelligence consumption layer consumes threat intelligence output by security products and customers to the intelligence output layer to protect customer security and generate security value.

[0014] Furthermore, the analysis process of the intelligence analysis layer in S2 includes:

[0015] S21: The machine uses the intelligence analysis software on the big data platform to combine the IP address anomaly coefficient and data packet risk value of the original data to calculate the total risk coefficient of the original data and evaluate the threat level;

[0016] S22: Advanced intelligence analysis by combining automated analysis results with expert security and intelligence experts.

[0017] Furthermore, the analysis process in S21 includes:

[0018] By formula Calculate the IP address anomaly coefficient γ of the i-th group of original data in the a-th time period on the inspection day ai ;

[0019] Among them, a is any time period of the inspection day, i is any set of original data, sjb ai is the number of packets sent by all IP addresses in the ath time period of the inspection day for the i-th group of original data, sjb u The preset number of packets to send for all IP addresses, sjb 01 For sjb ai The standard value, f c To define a function, when f c When (x)>1, let f c (x) = x, when f c When (x)≤1, let f c (x) = 1, pl ai is the connection frequency of all IP addresses in the ath time period of the i-th group of original data on the inspection day, pl u is the preset connection frequency, qiq ai is the number of ICPM requests of all IP addresses in the ath time period of the i-th group of original data on the inspection day, τ ai is the number of IP address changes of the i-th group of original data in the a-th time period on the inspection day, τ 01 is τ ai is the standard value of , and σ is the error influence coefficient.

[0020] Furthermore, the analysis process in S21 also includes:

[0021] By formula Calculate the data packet risk value δ of the i-th group of original data on the inspection day i ;

[0022] Among them, ycsl i is the number of abnormal size packets of the i-th group of original data on the inspection day, fb i is the number of non-standard port number packets of the i-th group of original data on the inspection day, zsb i is the total number of packets of the i-th group of raw data on the inspection day, r is any day in the past period, m is the total number of days in the past period, zjl i is the growth of the data packet of the i-th group of original data on the inspection day, zjl ir is the growth of data packets of the i-th group of original data in the r-th day in the past period of time, zjl 01 For zjl i The standard value of , x1 and x2 are the first weight coefficients.

[0023] Furthermore, the analysis process in S21 also includes:

[0024] By formula Calculate the total risk coefficient ρ of the original data of group i on the inspection day i ;

[0025] Among them, b is the total number of time periods on the inspection day, and y1 and y2 are the second weight coefficients.

[0026] Furthermore, the analysis process in S21 also includes:

[0027] The total risk factor ρ of all the original data on the inspection day is i Compare with the preset total risk factor threshold interval [ρ1, ρ2] respectively;

[0028] If all ρ i If all are less than ρ1, it is judged that all current raw data do not pose risks and do not belong to threat intelligence;

[0029] If any ρ i If it belongs to [ρ1, ρ2], it is judged that the original data has risks and belongs to the first-level threat intelligence;

[0030] If any ρ i If it is greater than ρ2, the original data is judged to be high-risk and belongs to the second-level threat intelligence.

[0031] Furthermore, the types of intelligence stored in S3 include basic intelligence, advanced threat intelligence, and customized intelligence;

[0032] The basic intelligence includes IP fingerprint, Web fingerprint, IP information, domain name information, vulnerability library, sample library, IP IOC, domain name IOC, URL IOC, file IOC, and digital certificate;

[0033] The advanced threat intelligence includes advanced threat analysis reports, security incident analysis reports, and TTP analysis reports;

[0034] The customized intelligence includes periodic threat broadcasts, hot spot threat analysis reports, industry threat analysis reports, and asset threat analysis reports.

[0035] Furthermore, the output methods of the intelligence output layer in S3 include API interface, Portal interface, and email push;

[0036] The API interface is mainly used for the output of machine-readable intelligence. Security products can directly download the latest machine-readable intelligence from the intelligence center through this interface and use it;

[0037] The portal interface provides threat intelligence query services in the form of a query page, where you can enter the customer name, security event name, attack organization name, IP address, domain name, and file HASH for query;

[0038] The email push pushes threat intelligence via email based on the user's subscription requirements.

[0039] Beneficial effects of the present invention:

[0040] (1) The present invention calculates the IP address anomaly coefficient and the data packet risk value of the original data based on the big data analysis platform through the intelligence analysis layer, and evaluates the threat level of the original data by combining the two sets of data. Since this evaluation method is based on multi-source data to make a judgment on the threat situation of the original data, the sensitivity of the analysis is relatively high, thereby increasing the accuracy of the judgment result on whether the original data is threat data, and avoiding the situation in conventional analysis where the judgment method is too rough and the analysis sensitivity is poor, resulting in an erroneous judgment on whether the data is threat intelligence, thereby affecting the subsequent use of the original data.

[0041] (2) The present invention collects various basic data and threat intelligence data through various channels and methods, and evaluates the threat level of the original data, so as to realize the storage of threat intelligence. Threat intelligence can promote the transformation from passive defense to active defense. Its vulnerability, asset security and other intelligence can be used to improve structural security; and threat indicators, reputation and other machine-readable intelligence can be directly applied to security equipment to accelerate response and increase passive defense capabilities; TTP, advanced threat analysis, threat warning and other campaign and strategic intelligence can be used to build a more effective active defense system, thereby realizing the analysis of network security situation and taking corresponding measures in time to improve network security protection capabilities.

[0042] (3) The present invention calculates the total risk coefficient ρ of all the original data on the inspection day i By comparing them with the preset total risk coefficient threshold interval [ρ1, ρ2] respectively, not only can it be judged whether there is a risk based on the total risk coefficient of the i-th group of original data on the inspection day, but also the original data judged to be threat intelligence can be evaluated and graded, thereby increasing the sensitivity of the analysis of whether the original data is threat intelligence and ensuring the accuracy of the judgment result, avoiding the situation in conventional analysis where the judgment method is too rough and the analysis sensitivity is poor, leading to incorrect judgment on whether the data is threat intelligence, affecting the subsequent use of the original data.

[0043] (4) The present invention stores the original intelligence data and the intelligence results generated by each analysis system, formats and stores various threat intelligence, updates the stored intelligence history, and indexes the threat intelligence at different dimensions and stores threat intelligence usage records. Through such settings, the stored threat intelligence can provide enterprises with timely and accurate threat information, helping enterprises to take measures in advance before the threat occurs, better adjust their security strategies, and strengthen network defense capabilities, thereby effectively reducing the impact of threats on their business. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] The present invention will be further described below in conjunction with the accompanying drawings.

[0045] Figure 1 It is a flow chart of a network security situation analysis method based on big data intelligence analysis in the present invention;

[0046] Figure 2 It is a flow chart of the analysis process of the intelligence analysis layer in the present invention. DETAILED DESCRIPTION

[0047] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0048] See also Figure 1 As shown, in one embodiment, the present application provides a network security situation analysis method based on big data intelligence analysis, the method comprising:

[0049] S1: Collect various basic data and threat intelligence data through various channels and methods through the intelligence collection layer;

[0050] S2: The intelligence analysis layer calculates the IP address anomaly coefficient and data packet risk value of the original data based on the big data analysis platform, and combines the two sets of data to evaluate the threat level of the original data;

[0051] S3: The threat intelligence is stored through the intelligence storage layer based on the data storage function of the big data analysis platform;

[0052] S4: Read threat intelligence through the intelligence output layer and output intelligence through the web interface, API, and subscription push;

[0053] S5: The intelligence consumption layer consumes threat intelligence output by security products and customers to the intelligence output layer to protect customer security and generate security value;

[0054] Through the above technical solution, this embodiment provides a network security situation analysis method, firstly, the intelligence collection layer collects various basic data and threat intelligence data through various channels and methods, then the intelligence analysis layer calculates the IP address anomaly coefficient and the data packet risk value of the original data based on the big data analysis platform, and combines the two sets of data to evaluate the threat level of the original data, then the intelligence storage layer realizes the storage of threat intelligence based on the data storage function of the big data analysis platform, and reads the threat intelligence through the intelligence output layer, and outputs the intelligence through the Web interface, API, and subscription push mode, and finally reads the threat intelligence through the intelligence output layer, and outputs the intelligence through the Web interface, API, and subscription push mode;

[0055] By first collecting various basic data and threat intelligence data through various channels and methods, and evaluating the threat level of the original data, the storage of threat intelligence can be realized. Threat intelligence can promote the transformation from passive defense to active defense. Its vulnerability, asset security and other intelligence can be used to improve structural security; and machine-readable intelligence such as threat indicators and reputation can be directly applied to security equipment to accelerate response and increase passive defense capabilities; TTP, advanced threat analysis, threat warning and other campaign and strategic intelligence can be used to build a more effective active defense system, thereby realizing the analysis of network security situation and taking corresponding measures in time to improve network security protection capabilities;

[0056] In addition, the intelligence analysis layer calculates the IP address anomaly coefficient and data packet risk value of the original data based on the big data analysis platform, and combines the two sets of data to evaluate the threat level of the original data. Since this evaluation method is based on multi-source data to judge the threat situation of the original data, the analysis sensitivity is relatively high, thereby increasing the accuracy of the judgment result on whether the original data is threat data, and avoiding the situation in conventional analysis where the judgment method is too rough and the analysis sensitivity is poor, resulting in incorrect judgment on whether the data is threat intelligence, affecting the subsequent use of the original data.

[0057] See also Figure 2 As shown, the analysis process of the intelligence analysis layer in S2 includes:

[0058] S21: The machine uses the intelligence analysis software on the big data platform to combine the IP address anomaly coefficient and data packet risk value of the original data to calculate the total risk coefficient of the original data and evaluate the threat level;

[0059] S22: Advanced intelligence analysis by combining automated analysis results with expert security and intelligence experts;

[0060] Through the above technical solution, this embodiment has passed the analysis process of the intelligence analysis layer. First, the machine uses the intelligence analysis software on the big data platform to combine the IP address anomaly coefficient and the data packet risk value of the original data to calculate the total risk coefficient of the original data and evaluate the threat level. Then, expert security experts and intelligence experts combine the automatic analysis results to perform advanced intelligence analysis, where the machine analysis uses the intelligence analysis software on the big data platform to analyze the original data and intelligence, specifically including intelligence standardization, multi-source intelligence cleaning, deep intelligence mining, multi-dimensional intelligence association, threat scenario perception, intelligent intelligence analysis, interactive visualization analysis, threat level assessment, intelligence life cycle management, etc. Expert analysis includes security experts and intelligence experts combining automatic analysis results to perform advanced intelligence analysis, including advanced threat analysis, TTP analysis, customized intelligence analysis, intelligence data verification, etc.

[0061] By setting it in this way, the accuracy of judging whether the original data is threat intelligence can be further improved, thereby ensuring the subsequent use of the original data.

[0062] The analysis process in S21 includes:

[0063] By formula Calculate the IP address anomaly coefficient γ of the i-th group of original data in the a-th time period on the inspection day ai ;

[0064] Among them, a is any time period of the inspection day, i is any set of original data, sjb ai is the number of packets sent by all IP addresses in the ath time period of the inspection day for the i-th group of original data, sjb u The preset number of packets to send for all IP addresses, sjb 01 For sjb ai The standard value of f c To define a function, when f c When (x)>1, let f c (x) = x, when f c When (x)≤1, let f c (x) = 1, pl ai is the connection frequency of all IP addresses in the ath time period of the i-th group of original data on the inspection day, pl u is the preset connection frequency, qiq ai is the number of ICPM requests of all IP addresses in the ath time period of the i-th group of original data on the inspection day, τ ai is the number of IP address changes of the i-th group of original data in the a-th time period on the inspection day, τ 01 is τ ai The standard value of , which can be set based on the allowable error in the empirical data, σ is the error influence coefficient, which can be set based on the empirical data fitting;

[0065] Through the above technical solution, this embodiment provides the IP address anomaly coefficient γ of the i-th group of original data in the a-th time period on the inspection day: ai , can be obtained by formula Calculated, because if a certain IP address or port number sends or receives a large number of data packets in a short period of time, this may indicate abnormal data transmission behavior, and a large number of ICMP requests in the network traffic may indicate a denial of service attack attempt, and frequent changes in IP addresses may indicate that the IP address is used in distributed denial of service attacks or other forms of network attacks. Finally, when the connection frequency of a certain IP address suddenly increases, or there is a significant anomaly compared to the normal pattern, this may indicate that the IP address is conducting malicious activities, such as scanning, attacking, or data theft;

[0066] Therefore, when the number of packets sent by all IP addresses in the a-th time period of the inspection day, the number of ICPM requests of all IP addresses, and the number of IP address changes of the i-th group of original data are more, and the connection frequency of the IP address is higher, then the IP address anomaly coefficient of the i-th group of original data in the a-th time period of the inspection day will be greater; conversely, when the number of packets sent by all IP addresses in the a-th time period of the inspection day, the number of ICPM requests of all IP addresses, and the number of IP address changes of the i-th group of original data are fewer, and the connection frequency of the IP address is higher, then the IP address anomaly coefficient of the i-th group of original data in the a-th time period of the inspection day will be smaller. Through such a setting, a preliminary judgment can be made on whether the original data has risks based on the anomaly coefficients of all IP addresses in the original data, and accurate data can be provided for the subsequent calculation of the total risk coefficient of the original data, thereby ensuring the accuracy of the result of judging whether the original data is threat intelligence.

[0067] The analysis process in S21 also includes:

[0068] By formula Calculate the data packet risk value δ of the i-th group of original data on the inspection day i ;

[0069] Among them, ycsl i is the number of abnormal size packets of the i-th group of original data on the inspection day, fb i is the number of non-standard port number packets of the i-th group of original data on the inspection day, zsb i is the total number of packets of the i-th group of raw data on the inspection day, r is any day in the past period, m is the total number of days in the past period, zjl i is the growth of the data packet of the i-th group of original data on the inspection day, zjl ir is the growth of data packets of the i-th group of original data in the r-th day in the past period of time, zjl 01 For zjl i The standard value of , which can be set according to the allowable error in the empirical data, x1 and x2 are the first weight coefficients, which can be set according to empirical fitting;

[0070] Through the above technical solution, this embodiment provides the data packet risk value δ of the i-th group of original data on the inspection day: i , can be obtained by formula It is calculated that since a large number of packets of abnormal size (such as extremely large or extremely small packets) appear in the network traffic, this may indicate the existence of data tampering, hiding malicious content or bypassing security detection, and if a large number of packets using non-standard port numbers appear in the network traffic, this may indicate the existence of potential malicious activities, and the higher the packet growth on the day, the more abnormal data transmission behavior may be. Therefore, when the number of packets of abnormal size and the number of packets with non-standard port numbers of the i-th group of original data on the inspection day is greater, and the difference between the packet growth of the i-th group of original data on the inspection day and the average packet growth of the i-th group of original data in the past period of time is greater, then the packet risk value of the i-th group of original data on the inspection day is greater. Conversely, when the number of packets of abnormal size and the number of packets with non-standard port numbers of the i-th group of original data on the inspection day is smaller, and the difference between the packet growth of the i-th group of original data on the inspection day and the average packet growth of the i-th group of original data in the past period of time is smaller, then the packet risk value of the i-th group of original data on the inspection day is smaller;

[0071] Through such a setting, after calculating the data packet risk value of the i-th group of original data on the inspection day, the size of the data packet risk of the i-th group of original data on the inspection day can be reflected, and accurate data can be provided for the subsequent calculation of the total risk coefficient of the original data, thereby ensuring the accuracy of the result of judging whether the original data is threat intelligence.

[0072] The analysis process in S21 also includes:

[0073] By formula Calculate the total risk coefficient ρ of the original data of group i on the inspection day i ;

[0074] Wherein, b is the total number of time periods on the inspection day, y1 and y2 are second weight coefficients, and the second weight coefficients can be set according to empirical data fitting;

[0075] Through the above technical solution, this embodiment provides the total risk coefficient ρ of the i-th group of original data on the inspection day i , can be obtained by formula It is calculated that by combining the data packet risk value of the i-th group of original data on the inspection day with the IP address anomaly coefficient of the i-th group of original data in the a-th time period on the inspection day, and assigning different second weight coefficients to the two groups of data, the accuracy and reliability of the calculation results can be improved, thereby increasing the sensitivity of the analysis of whether the original data is threat intelligence, and then improving the accuracy of the judgment results.

[0076] The analysis process in S21 also includes:

[0077] The total risk factor ρ of all the original data on the inspection day is i Compare with the preset total risk factor threshold interval [ρ1, ρ2] respectively;

[0078] If all ρ i If all are less than ρ1, it is judged that all current raw data do not pose risks and do not belong to threat intelligence;

[0079] If any ρ i If it belongs to [ρ1, ρ2], it is judged that the original data has risks and belongs to the first-level threat intelligence;

[0080] If any ρ i If it is greater than ρ2, the original data is judged to be high risk and belongs to the second-level threat intelligence;

[0081] Through the above technical solution, this embodiment calculates the total risk coefficient ρ of all the original data on the inspection day i By comparing with the preset total risk coefficient threshold interval [ρ1, ρ2] respectively, it is possible to judge whether the i-th group of raw data has risks according to its total risk coefficient on the inspection day, and to evaluate and grade the raw data judged as threat intelligence, thereby increasing the sensitivity of the analysis of whether the raw data is threat intelligence and ensuring the accuracy of the judgment results, avoiding the situation in which the judgment method is too rough and the analysis sensitivity is poor in conventional analysis, resulting in wrong judgment of whether the data is threat intelligence, affecting the subsequent use of raw data;

[0082] It should be noted that the above-mentioned preset total risk coefficient threshold interval [ρ1, ρ2] can be set based on empirical data fitting.

[0083] The types of intelligence stored in S3 include basic intelligence, advanced threat intelligence, and customized intelligence;

[0084] The basic intelligence includes IP fingerprint, Web fingerprint, IP information, domain name information, vulnerability library, sample library, IP IOC, domain name IOC, URL IOC, file IOC, and digital certificate;

[0085] The advanced threat intelligence includes advanced threat analysis reports, security incident analysis reports, and TTP analysis reports;

[0086] The customized intelligence includes periodic threat broadcasts, hot spot threat analysis reports, industry threat analysis reports, and asset threat analysis reports;

[0087] Through the above technical solution, this embodiment provides the types of intelligence stored in S3, including basic intelligence, advanced threat intelligence, and customized intelligence. It stores the original intelligence data and the intelligence results generated by each analysis system, as well as the formatted storage of various threat intelligence, and updates the stored intelligence history, as well as indexes the threat intelligence at different dimensions and stores the threat intelligence usage records. Through such settings, the stored threat intelligence can provide enterprises with timely and accurate threat information, help enterprises take measures in advance before the threat occurs, better adjust their security strategies, and strengthen network defense capabilities, thereby effectively reducing the impact of threats on their business.

[0088] The output methods of the intelligence output layer in S3 include API interface, Portal interface, and email push;

[0089] The API interface is mainly used for the output of machine-readable intelligence. Security products can directly download the latest machine-readable intelligence from the intelligence center through this interface and use it;

[0090] The portal interface provides threat intelligence query services in the form of a query page, where you can enter the customer name, security event name, attack organization name, IP address, domain name, and file HASH for query;

[0091] The email push pushes threat intelligence by email according to the user's subscription requirements;

[0092] Through the above technical solution, this embodiment provides an output method for the intelligence output layer, including API interface, Portal interface, and email push. Through such settings, users can query different types of threat intelligence according to conditions, and the query results support intelligence display and correlation relationship display in different dimensions, as well as support download and feedback functions for query results. The analysis results are displayed visually to more intuitively understand abnormal behaviors and security threats in the network, which helps to quickly locate problems and take corresponding security measures.

[0093] The above is a detailed description of an embodiment of the present invention, but the content is only a preferred embodiment of the present invention and cannot be considered to limit the scope of implementation of the present invention. All equivalent changes and improvements made within the scope of the present invention should still fall within the scope of the patent coverage of the present invention.

Claims

1. A network security situation analysis method based on big data intelligence analysis, characterized in that: The method comprises: S1: Collect various basic data and threat intelligence data through various channels and methods through the intelligence collection layer; S2: The intelligence analysis layer calculates the IP address anomaly coefficient and data packet risk value of the original data based on the big data analysis platform, and combines the two sets of data to evaluate the threat level of the original data; S3: The threat intelligence is stored through the intelligence storage layer based on the data storage function of the big data analysis platform; S4: Read threat intelligence through the intelligence output layer and output intelligence through the web interface, API, and subscription push; S5: The intelligence consumption layer consumes threat intelligence output by security products and customers to the intelligence output layer to protect customer security and generate security value; The analysis process of the intelligence analysis layer in S2 includes: S21: The machine uses the intelligence analysis software on the big data platform to combine the IP address anomaly coefficient and data packet risk value of the original data to calculate the total risk coefficient of the original data and evaluate the threat level; S22: Advanced intelligence analysis is performed by security experts and intelligence experts in combination with platform analysis results; The analysis process in S21 includes: By formula Calculate the IP address anomaly coefficient γ of the i-th group of original data in the a-th time period on the inspection day ai ; Among them, a is any time period of the inspection day, i is any set of original data, sjb ai is the number of packets sent by all IP addresses in the ath time period of the inspection day for the i-th group of original data, sjb u The preset number of packets to send for all IP addresses, sjb 01 For sjb ai The standard value, f c To define a function, when f c When (x)>1, let f c (x) = x, when f c When (x)≤1, let f c (x) = 1, pl ai is the connection frequency of all IP addresses in the ath time period of the i-th group of original data on the inspection day, pl u is the preset connection frequency, qiq ai is the number of ICPM requests of all IP addresses in the ath time period of the i-th group of original data on the inspection day, τ ai is the number of IP address changes of the i-th group of original data in the a-th time period on the inspection day, τ 01 is τ ai is the standard value of , and σ is the error influence coefficient.

2. According to the network security situation analysis method based on big data intelligence analysis according to claim 1, it is characterized in that: The analysis process in S21 also includes: By formula Calculate the data packet risk value δ of the i-th group of original data on the inspection day i ; Among them, ycsl i is the number of abnormal size packets of the i-th group of original data on the inspection day, fb i is the number of non-standard port number packets of the i-th group of original data on the inspection day, zsb i is the total number of packets of the i-th group of raw data on the inspection day, r is any day in the past period, m is the total number of days in the past period, zjl i is the growth of the data packet of the i-th group of original data on the inspection day, zjl ir is the growth of data packets of the i-th group of original data in the r-th day in the past period of time, zjl 01 For zjl i The standard value of , x1 and x2 are the first weight coefficients.

3. A network security situation analysis method based on big data intelligence analysis according to claim 2, characterized in that: The analysis process in S21 also includes: By formula Calculate the total risk coefficient ρ of the original data of group i on the inspection day i ; Among them, b is the total number of time periods on the inspection day, and y1 and y2 are the second weight coefficients.

4. A network security situation analysis method based on big data intelligence analysis according to claim 3, characterized in that: The analysis process in S21 also includes: The total risk factor ρ of all the original data on the inspection day is i Compare with the preset total risk factor threshold interval [ρ1, ρ2] respectively; If all ρ i If all are less than ρ1, it is judged that all current raw data do not pose risks and do not belong to threat intelligence; If any ρ i If it belongs to [ρ1, ρ2], it is judged that the original data has risks and belongs to the first-level threat intelligence; If any ρ i If it is greater than ρ2, the original data is judged to be high-risk and belongs to the second-level threat intelligence.

5. The network security situation analysis method based on big data intelligence analysis according to claim 1 is characterized in that: The types of intelligence stored in S3 include basic intelligence, advanced threat intelligence, and customized intelligence; The basic intelligence includes IP fingerprint, Web fingerprint, IP information, domain name information, vulnerability library, sample library, IPIOC, domain name IOC, URLIOC, file IOC, and digital certificate; The advanced threat intelligence includes advanced threat analysis reports, security incident analysis reports, and TTP analysis reports; The customized intelligence includes periodic threat broadcasts, hot spot threat analysis reports, industry threat analysis reports, and asset threat analysis reports.

6. A network security situation analysis method based on big data intelligence analysis according to claim 1, characterized in that: The output methods of the intelligence output layer in S3 include API interface, Portal interface, and email push; The API interface is mainly used for the output of machine-readable intelligence. Security products can directly download the latest machine-readable intelligence from the intelligence center through this interface and use it; The portal interface provides threat intelligence query services in the form of a query page, where you can enter the customer name, security event name, attack organization name, IP address, domain name, and file HASH for query; The email push pushes threat intelligence via email based on the user's subscription requirements.

Images